🔐 HSM

Hardware Security Modules for Non-Exportable Keys & Audit-Grade Crypto

Hardware Security Modules (HSMs) are tamper-resistant appliances that generate, store, and use cryptographic keys without ever exposing private material in software. SolveForce designs HSM programs (on-prem, colo, and cloud-adjacent) with dual-control/quorum, envelope encryption, code & TLS signing, and audit-grade evidence—so encryption, identity, and signing remain provable and safe.

Where HSM fits in the SolveForce model:
🔒 Security (Semantics) → Cybersecurity • 🔑 Key Fabric → Key Management / HSM • 🪪 Certificates/Trust → PKI
🧾 Identity → IAM / SSO / MFA • 🔐 Encryption → Encryption • 📊 Evidence/Automation → SIEM / SOAR
☁️ Cloud & Interconnect → Cloud • Direct Connect • 🏢 Facilities → Colocation

🎯 Outcomes (Why HSM)

  • Non-exportable keys for root CA, KEKs, code/TLS signing—never leaves hardware.
  • Quorum & dual-control (M-of-N) for destructive actions (unwrap/destroy/zeroize).
  • Envelope encryption at scale (root → KEK → DEK) with fast rotation and no data loss.
  • Proven trust — FIPS-validated hardware, tamper evidence, immutable audit logs.
  • Low latency cryptography — HA clusters sized for JWT/TLS/signing throughput.

🧱 HSM Building Blocks (Spelled Out)

  • FIPS 140-2/140-3 validated hardware — secure boundary, tamper-responding, secure RNG.
  • Administrative personas — Security Officer, Crypto Officer, Auditor; separation of duties by policy.
  • Quorum (M-of-N) & Dual-Control — multiple humans + roles for key unwrap/destroy and policy changes.
  • Key hierarchy — Root in HSM → Key-Encryption Keys (KEKs) per service/tenant/env → Data-Encryption Keys (DEKs) per dataset/object.
  • Backup/Escrow — HSM-wrapped key backups (or Shamir shares) stored off-site; recovery tested quarterly.

See the broader program → Key Management / HSM

🔐 HSM Use Cases (Concrete & Common)

  • Certificate Authorities (PKI) — root/intermediate CA keys; CRL/OCSP signing; ACME EAB support. → PKI
  • TLS private keys — terminate TLS with non-exportable keys; support for ACME automation. → Encryption
  • JWT / OAuth2 / OIDC — sign ID/Access tokens; JWKS rotation, kid headers, staged key rollover. → IAM / SSO / MFA
  • Code & Container Signing — CI/CD artifact signing (Cosign/Sigstore), firmware, drivers; attestations attached to builds.
  • Database/Storage Encryption — TDE/master keys; KEK/DEK re-wrap model for fast rotation.
  • Payments & Tokenization — PAN encryption, HSM-resident keys for token vaults; PCI DSS alignment. → DLP

🧭 Deployment Patterns (Where to Put the HSM)

  • On-Prem / Campus — low-latency crypto near apps; full physical control.
  • Colocation (carrier-dense) — proximity to Direct Connect/ExpressRoute/Interconnect; diverse carriers; cross-connects. → Colocation • Direct Connect
  • Cloud-Adjacent — connect physical HSMs to cloud workloads over private on-ramps; or pair with cloud HSM/KMS for hybrid models. → Cloud
  • Cluster & HA — active/active or active/standby with HSM-to-HSM sync, regional redundancy, and tamper alarms to SIEM.

🔄 Envelope Encryption (No-Drama Rotation)

1) Generate DEK to encrypt data.
2) Wrap DEK with a KEK (inside HSM/KMS); store wrapped DEK with ciphertext.
3) Rotate KEK → re-wrap DEKs (no data re-encrypt).
4) Rotate DEKs → use new DEKs for new data; bulk re-encrypt as policy allows.
5) Revoke/Disable → flip state, retain evidence; plan back-out.

Result: fast rotations, no plaintext key exposure, and clean audit trail.
Deep dive → Key Management / HSM

🧰 Integration Patterns (Apps & Infrastructure)

  • JWT/JWS/JWE — HSM-backed signing keys; JWKS endpoint rotation; dual-publishing for graceful key cutovers.
  • KMS + HSM Hybrid — use cloud KMS for API-scale access to wrapped data keys, with on-prem HSM holding the KEK/root keys (HYOK/CMK patterns).
  • DB TDE — master in HSM, tablespace keys as DEKs; re-wrap on KEK rotate.
  • Object Storage — SSE-KMS, per-bucket/object DEKs; enforce CMK residency by region.
  • CI/CD — signer service that abstracts HSM calls; approvals for production sign; attach attestations to artifacts.
  • TLS Offload — HSM-resident private keys; ACME automation for renewals, mTLS for service-service.

🛡️ Access Controls (No Single Person Can Burn the House Down)

  • RBAC/ABAC — separate Security Officer, Crypto Officer, and Auditor.
  • M-of-N Quorum — export/destroy/zeroize needs multiple key cards + PINs from different people.
  • Dual-Control — two distinct approvers for key rotation & policy edits.
  • JIT & PAM — short-lived elevation with session recording. → PAM
  • Policy Conditions — source IP/ASN, time windows, device posture; break-glass token path with strict logging.

📐 SLO Guardrails (Experience & Safety You Can Prove)

SLOTarget (Recommended)Notes
Sign/verify p95≤ 20–50 msJWT/TLS/code signing throughput
Encrypt/decrypt p95≤ 10–30 msData key ops (with DEK caching)
Cluster availability≥ 99.99%HA pairs; regional fallback
Rotation SLA (KEK)≤ 24–72 h end-to-endRe-wrap only; no data loss
Audit export completeness100% key eventsImmutable/WORM store
Tamper alert to SIEM latency≤ 60 sAlarms stream to SOC → SIEM / SOAR

📜 Compliance Mapping (Examples)

  • PCI DSS 3.5/3.6 — key protection, dual-control, split knowledge, lifecycle docs.
  • ISO/IEC 27001/27002 — cryptographic controls & key management policy.
  • HIPAA — ePHI encryption integrity; custody evidence for keys.
  • NIST SP 800-57 / 800-53 (SC-12/SC-13) — key lifecycles & crypto services.
  • FedRAMP — HSM residency, audit logging, retention.

📊 Observability & Evidence

  • Audit Streams — create/unwrap/destroy, policy/role changes, backup/restore, tamper events.
  • Usage Analytics — op counts by key, latency heatmaps, throttles, unusual spikes.
  • Chain-of-Custody — hash/ID every action; export to SIEM; cases linked to changes. → SIEM / SOAR

🧪 Safety Nets & Drills

  • Game Days — KEK rotation, HSM failover, regional outage; validate end-to-end.
  • Backup/Restore Tests — M-of-N media, off-site storage, cold-start runbooks.
  • Kill-Switch — disable a key quickly (deny decrypt/sign) with documented business impact path.
  • Backout — re-enable prior KEK alias; publish new JWKS; retest clients.

🛠️ Implementation Blueprint (No-Surprise Rollout)

  1. Inventory & classification — which keys exist today; where; for what (encrypt/sign/wrap).
  2. Choose platform — network HSM cluster + (optional) cloud HSM/KMS; HA/DR regions.
  3. Design hierarchy — Root in HSM; KEKs per service/tenant/env; DEKs per dataset/object.
  4. Access policy — RBAC/ABAC, M-of-N quorum, dual-control, break-glass, ITSM approvals.
  5. Integrate apps — SDK/PKCS#11/JCE; CI/CD signing; DB TDE; TLS/mTLS; JWKS rotation.
  6. Observability — send audit to SIEM; SLO dashboards; SOAR playbooks for revoke/disable/rotate.
  7. Compliance packs — policy docs, lifecycle SOPs, rotation calendar, evidence exports.
  8. Drills — rotation, restore, disable; publish RCAs and improvements.

✅ Pre-Engagement Checklist

  • 📦 Data & app inventory (what needs keys; where keys live now).
  • 🗺️ Residency/sovereignty (regions; customer-managed vs provider-managed).
  • 🛡️ FIPS level, cluster size, HA/DR plan; on-prem vs colo vs cloud-adjacent.
  • 👥 Roles (SO/CO/Auditor), quorum thresholds, approval matrix.
  • 🔐 Integrations (PKI, JWT, TDE, SSE-KMS, code signing, TLS/mTLS).
  • 📊 SIEM dashboards & SOAR playbooks; tamper alert plan.
  • 🧾 Compliance targets (PCI/HIPAA/ISO/NIST/FedRAMP) & evidence format.

🔄 Where HSM Fits (Recursive View)

1) Grammar — crypto rails ride Connectivity & the Networks & Data Centers fabric.
2) Syntax — apps and Cloud use HSM/KMS for envelope encryption and signing.
3) Semantics — Cybersecurity preserves truth; HSMs anchor identity and integrity.
4) Pragmatics — SolveForce AI flags key anomalies and assists rotations.
5) Foundation — consistent terms via Primacy of Language.
6) Map — indexed in SolveForce Codex & Knowledge Hub.

📞 Design an HSM Program That Won’t Fail You

Related pages:
Key Management / HSM • PKI • Encryption • IAM / SSO / MFA • SIEM / SOAR • DLP • Cloud • Colocation • Direct Connect • Cybersecurity • Knowledge Hub