Hardware Security Module (HSM)

For some enterprise level systems, we need more power devoted towards cryptography. One of the ways we can do that is with a hardware security module, or HSM.

HSM and TPM Compared

A big part of this HSM is going to be key management. It's a key management system. That's not all of what it does, but it's a big part of what it does.

There's actually a lot of overlap between what the TPM does and the HSM. In fact, a lot of documentation will compare and contrast the two, because there are a lot of similarities between these two. They both do random number generation. They both generate cryptographic keys. They both can do encryption and decryption. They can do storage of these keys. So they can do a lot of different functions, and both can do a lot of similar functions.

So what are the differences between them? Well, the TPM is much more localized in its scope. What I mean by that is, when you buy a laptop or a desktop, most of the ones that you buy out there will have some sort of TPM chip in it. Even a server will have a TPM chip in it as well. But it's more for that local secure boot and secure operations of that computer. It's a chip that you can find that's on the motherboard, and it's really just for local performance, so it's not anything high-speed with it.

But when you're talking about HSM, now we're taking this cryptography idea to a higher level. It serves a different function. It operates at an enterprise level. We would install this on something like a server or within an infrastructure, so it's mainly for secure management of keys. We'll install it on maybe some sort of hardware, or it could be a separate piece of hardware that does this managing of these keys, and it gives you enterprise level performance.

Now, a TPM chip usually nowadays is already on your motherboard and comes pre-installed, versus an HSM is probably something you're going and purchasing — or, if you purchase it on the server, it comes as a separate card or separate piece of hardware on that server.

What an HSM Looks Like

So what does it look like? Well, maybe you're buying some sort of card that you're installing, like a PCIe card that you're installing on there. Or maybe there is some sort of server or hardware, like there's actually separate machines: you set up a server to be your HSM hardware and then manage all of these keys. Or it could be maybe some sort of removable device like a USB.

An Example

This is probably best illustrated with an example. Now, there's a lot of different examples and a lot of different ways of implementing this, so let's just talk about a single example here so we get an idea of what some of these systems are capable of doing.

So here we have a server that's set up as our HSM. Or maybe it's some sort of appliance — maybe we purchased this appliance and it's set up to act as our HSM. And we have some sort of access servers right here, and we have the database. Now, there is certain data on this database that is encrypted.

So let's say the client makes a request. Maybe it's our machine and we're making a request: we want to pull some data from the database. So the access servers go and grab the data from the database and bring it back. But some of it's encrypted and it requires a key to decrypt it. So what's going to happen is they are going to send this data to the HSM. The HSM will then decrypt it and then send it back to the access servers, and then we present that information to the client.

Now, those keys have never left this HSM system. So it's a very secure way of doing this, that we don't allow those keys to be out — because as soon as those keys get out, then somebody else could gain access to those keys and then steal this data and decrypt it.