I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 interface. The key and data decryption is done inside the HSM. Plain text keys never leaves the HSM memory.
Yet I'm concerned about the security. If an attacker manages to break in to the application server, he could just retrieve the encrypted data from the database and query the HSM.
I would like to have "external" component involved in decryption, linked to the user authentication. So even the attacker manages to hijack the server and the database and gets access on the HSM interface, the key material present is not sufficient. The encryption protocol should contain component which only authorized user knows or haves, but this knowledge is not stored anywhere and is not derivable. There is also a challenge: the key is actually related to the group of the user, not the identity. This means different users of same group must have access to the same key.