Amazon CloudHSM (It is Safenet in the backend), Safenet Luna HSM SaaS version and other cloud HSM providers provide Key Management and encryption services on device in the cloud.

From my research, I understand that they can be used to encrypt some data and get the encrypted blob for storage in DB / disk either on - the CLOUD (Amazon RDS / Amazon S3) or - On Premise behind the firewall (Local Database / Local File System)

(CloudHSM) <===== talking to ====> (On Premise / Behind the Firewall application)

  • What are the Security concerns w.r.t this model ?
  • Any specific recommendations from Network Security point of view ?
  • Is this even a valid model in the first place.

In most cases, you would install the driver/engine software in your servers and would do PKCS#11 over TLS.

Be aware that some vendors' offering may not be a true HSM; specifically it may be the software and management around an HSM delivered as a virtual appliance. These are not meant to provide the same level of resilience to attack as a true HSM. The key-store is an encrypted file on the virtual appliance, and not an encrypted NVRAM inside a blob of epoxy. This means in theory, it could be repeatedly cloned for massively parallel offline cryptanalysis. As such, these virtual appliances will not receive FIPS-140 certification.

I cannot say which of the first-tier vendors I got this from, nor can I go into more depth, as some things are covered by NDA, but I would work closely with your employer's risk management team and audit to determine whether it is an acceptable risk to outsource.

  • Thank you for your insights. I understand the NDA shackles :) However, can you please comment on whether the CloudHSMs in "general" (without naming any) across various Cloud Offerings in the market today stick to the definition of HSM ("Hardware" Security Module) in the truest sense. Thanks again for bringing in a new and valid concern pertaining to the question I raised.
    – acthota
    Mar 9 '16 at 10:44
  • 1
    @acthota In many cases, they are true multi-tennant HSMs, with a thin service-layer in front of the HSM, to abstract away the hardware-specific stuff.
    – DTK
    Mar 10 '16 at 5:27
  • @acthota No problem, me amigo. As a simple example (since they are on my mind this week), take a look at the Gemalto / SafeNet Luna SA (I think they now just call it Luna Network HSM). It can be carved into as many as 100 micro partitions, each with a separate login and separate store of secrets. Front that with an authenticated REST service and you've got crypto-offload and secret-storage as a service.
    – DTK
    Mar 10 '16 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.