Load Balancing and Failover

OneSpan Authentication Server Appliance provides load-balancing and failover between HSM slots.

The IDENTIKEY Wizard can be used to choose from a list of available HSM models for this purpose. For more information, refer to the OneSpan Authentication Server Appliance Installation and Maintenance Guide.

Session pool

When the OneSpan Authentication Server daemon is started, OneSpan Authentication Server Appliance will automatically create a session pool to use when accessing each HSM. HSM slots with an attribute matching the OneSpan Authentication Server configuration setting slotSelectionAttribute will be added to the session pool – up to the value of the slotsExpected configuration setting.

When OneSpan Authentication Server Appliance needs to access data protected by the HSM, it takes a random session from the pool. Where multiple HSM devices are available, this spreads the load across all slots.

If a session does not receive a response from a slot, the HSM is blacklisted and slots on the other HSM device(s) will be used, where available.

HSM re-initialization

OneSpan Authentication Server Appliance will stop and re-initialize all HSM devices in the session pool if one of the following applies:

• All configured HSM devices are blacklisted.
• At least one HSM has been blacklisted and no sessions are currently required.