1. HSM Overview for Grid Computing
Dave Madden,
Business Development
Safenet Inc.

2. The Foundation of Information Security
Encryption experts with 25 year history of HARDWARE security protection for:
Communications
Intellectual Property Rights
Data and Identities
Global Company with Local Service
Headquartered in Maryland, USA
Regional headquarters in
Camberley, UK
Hong Kong
30 + offices located in more than 20 counties
Encryption technology heritage
43 patents issued, 31 patents pending
Majority of the leading security vendors embed SafeNet’s technology in their offerings
Fastest Growing Networking Company – 2005
1. Not necessarily supported by SafeNet

3. PKI Overview What is a Digital ID? What is a PKI? What is an HSM?
UNCLASSIFIED//FOUO
PKI Overview
27/03/2017
What is a Digital ID?
What is a PKI?
What is an HSM?
How are these used?
SafeNet Confidential

4. What is a Digital Identity?
UNCLASSIFIED//FOUO
What is a Digital Identity?
27/03/2017
An asymmetric key pair assigned to a particular individual
Implemented using a digital certificate
Contains information about you…name etc. plus your public key
Certificate is digitally signed by a trusted source
It’s like issuing a digital passport
Therefore the keys are important to protect – not the locks!
John Smith
Certified & Signed by:
Private
Key
Public
Key
What is Digital Identity?
A Digital Identity is the representation of a human identity that is used in a distributed network interaction with other machines or people. The purpose of the Digital Identity is to restore the ease and security human transactions once had, when we all knew each other and did business face-to-face, to a machine environment where we are often meeting each other for the first time as we enter into transactions over vast distances.
Attributes of a Digital Identity
A Digital Identity only needs to be as complete as a particular transaction requires. That is to say, some transactions require a far more robust Digital Identity than others, since the degree of trust and information required can vary significantly based on the type of transaction. A Digital Identity consists of two parts:
Who one is (identity)
The credentials that one holds (attributes of that identity).
These credentials define a Digital Identity, and they can be quite varied, of widely differing value, and have many different uses. The full Digital Identity is quite intricate and has legal as well as technical implications (here is a MIT white paper on the subject that will give you the idea.) However, the simplest possible Digital Identity consists of an ID (such as a user name) and an authentication secret (such as a password).
In this simplest Digital Identity the user name is the identity while the password is said to be the authentication credential. As computerized systems become more networked and distributed, Digital Identity must become more robust to make complex distributed user interactions easy while achieving the required control and security. Ultimately Digital Identity will become as complex and flexible in use as a real-world human identity. A Digital Identity can facilitate the following operations:
Authentication - Proving the Digital Identity is what it is representing itself to be in the transaction
Authorization - Gaining permission to access certain data or program applications
Confidentiality - Assuring that an unauthorized party cannot usefully intercept the data being transmitted
Data Integrity - Assuring that the data has not been tampered with during transmission
Proof of Source - Using public/private key encryption to assure the origination source of a document
Non-Repudiation - Using public/private key encryption to verify the source and destination entity of a transaction
Reputation - Aggregating signed information from various sources as credentials based on past transaction history
A Digital Identity allows transactions in which the parties are separated in time and space while retaining the ability of these transactions to contain all of the human identity based attributes that transactions between people have always had. The ability to have third party transactions such as power of attorney, agency, and others handled through Digital Identity are just some of the types of attributes that the Digital Identity will grow to have.
(For a complete white paper discussion of these attributes of a Digital Identity, click here.)
The human context must be restored to the impersonal, distributed, networked communications world where transactions arise ad hoc. Often one or more of the parties to such transactions is an automated computerized system that has to operate on a set of rules that require certain identity information, the release of which must be negotiated with its owner. Accomplishing this very personal task in an inherently impersonal setting is the purpose of the Digital Identity. CA
John Smith
How do you use your digital identity?
Use your private key digitally sign documents
Others verify your signature with the public key on your certificate
SafeNet Confidential

5. UNCLASSIFIED//FOUO
What is a PKI?
27/03/2017
A Public Key Infrastructure (PKI) is a system to deploy and manage digital identities
Issue digital identities
Revoke digital identities
Publish public keys via directories
John Smith
John Smith
Certified by:
John Smith
Certified by:
John Smith
Certified by:
A Public Key Infrastructure consists of software and procedures put in place by an organization to support the use of Public Keys for authentication--in identifying users, services, and confirming digital signatures.
Public keys usually conform to the X.509 standard for certificates, and usually are based on the RSA public/private key encryption algorithm--if you encrypt with the public key, you can only decrypt with the private key, or you can encrypt with the private and decrypt only with the public key. You keep your private key a closely guarded secret, but the public key can be given out to anyone whom you want to be able to verify that a message or file really did originate from you. CA
SafeNet Confidential

6. What is a Hardware Security Module (HSM)?
UNCLASSIFIED//FOUO
27/03/2017
What is a Hardware Security Module (HSM)?
Security: A device to keep private keys “close to your chest”
Performance: Accelerate encryption operations to eliminate bottlenecks
Audit: Provides a clear audit trail for all key materials: SAS70 / SOX / PCI / HIPPA / HSPD12 etc.
Wide range of Security, Performance, Scalability & Price
They are devices for keeping keys in hardware- making the keys secure
Since the Keys underpin all the security mechanisms discussed- it is important that they are kept secure
Keeping a Key in Hardware means that you can control when, where, and how it is used
We have models that NEVER allow the key to be exported (sometimes even for backup)
They Perform Cryptographic Operations on those Keys- sometime very fast (acceleration)
Since most of the asymmetric crypto operations are very computationally expensive- the HSM needs to perform them quickly
They come in a variety of form factors
Attached to a network
Embedded in a Server
Portable
Password Authenticated or 2 factor Authenticated
They offer different programming interfaces
PKCS11, JCE, CAPI
Smart Card/USB
Rack mount appliance
PCMCIA/PCI
Client security
Mid-security
High-security
SafeNet Confidential

7. How are Digital IDs, PKI and HSMs Used?
Suppliers,
Partners,
Contractors
Salomon Smith Barney concluded over
80% of Fortune 500 using PKI used
SafeNet HSMs to protect their root key
Signed RFPs
B2B
Internet
Customers,
Employees
Back-end
Systems &
Databases
System Access
Root Certificate Authority
Certificate Issuance
Subordinate CAs
Sub-CA
certificates

8. Types of HSMs Embedded HSMs Network HSMs Application Security Modules
UNCLASSIFIED//FOUO
Types of HSMs
27/03/2017
Embedded HSMs
Network HSMs
Application Security Modules
SafeNet Confidential

9. Embedded HSMs PCI PCMCIA permanently installed removable cartridge
UNCLASSIFIED//FOUO
Embedded HSMs
27/03/2017
PCI
permanently installed
PCMCIA
removable cartridge
FIPS level 2 or 3
Acceleration from 10’s to 1000’s signatures/sec*
Standard APIs
PKCS#11, CAPI, OpenSSL, JCE/JCA
* asymmetric encryptions/second using the industry standard 1024 bit RSA algorithm
SafeNet Confidential

10. Network HSMs Same cryptographic functionality as embedded HSMs
UNCLASSIFIED//FOUO
Network HSMs
27/03/2017
Standard I/F
Network HSM
PKCS#11
MS-CAPI
OpenSSL
Java JCE/JCA
Same cryptographic functionality as embedded HSMs
HSM can be shared by multiple application servers over the network
Keys are stored and managed centrally
Reduced hardware and operations costs
SafeNet Confidential

11. Application Security Modules
UNCLASSIFIED//FOUO
Application Security Modules
27/03/2017
Application
code
Programmable I/F
HTML
XML
Other…
Protects encryption keys with onboard HSM
Also protects the application code that uses the keys
Programmable custom interfaces e.g. HTML, XML
Create sealed transaction appliances that integrate application code with cryptographic operations
More secure and easier to deploy
SafeNet Confidential

12. What is a High Assurance HSM?
UNCLASSIFIED//FOUO
What is a High Assurance HSM?
27/03/2017
Keys Always in Hardware
True Trusted Path Authentication
Premium Certifications
SafeNet Confidential

13. SafeNet Advantage: 3 Layers of HW Security
UNCLASSIFIED//FOUO
27/03/2017
SafeNet Advantage: 3 Layers of HW Security
Creation
Tamper Resistant Hardware
Storage
Destruction
Hardware- Secured
Key
Lifecycle 2 1
Multi-Person
Two-Factor
Access
Control 3
Usage 1
Distribution
3DES Key
Encryption
Safenet built its products as the basis for protecting customers vital keys. No other vendor has the ability to protect keys in FIPS validated hardware
SafeNet uses a 3 layer security model as the basis for designing hardware systems
The First layer – is software security which is primarily concerned with maintaining the integrity of the software execution environment. Specifically, the goal of this layer ,via 3DES encryption technology, is to create an isolation barrier around the software environment such that it is difficult or impossible to introduce any rogue code
The Second layer – is the operational security layer which is concerned with the procedures and mechanisms that are used to authenticate and control the access to the system. In particular this layer addresses the problem of legitimate users engaging in illegitimate activity by limiting access control via a Pin Entry Device – which is similar to the procedure to operate a nuclear submarine
The Third layer – hardware security includes a tamper proof hardware device to create a physical isolation barrier required to defend against all forms of physical attack.
In addition, unlike other HSM vendors, SafeNet always stores the private keys in hardware!
Software cannot meet audit requirements for protecting vital corporate root keys
SafeNet Confidential

14. Luna Advantage: Multi-Person Authenticated Access
UNCLASSIFIED//FOUO
Luna Advantage: Multi-Person Authenticated Access
27/03/2017
This is an example of dual access control in grant operation for the keys on a Luna Product. In the real world, we will typically see customers use a minimum of 3 people who have to come together to log into our device to allow access to the keys for using the keys on the HSM.
The Operational Security model
Depends on 2-factor authentication as a minimum
For enhanced security to protect against a single-person attack by someone with legitimate 2-factor credentials, need to use multi-person authentication
In this case, the server will not grant admin access until the the minimum number of security operators have been authenticated
Once the server has granted admin access, every action is logged and signed showing which authenticated operator performed which operation.
These 3 mechanisms: provide a strong combination of access control and deterrent as barriers to would-be attackers.
2-Factor
Authentication
2-Factor
Authentication +
Password
Password + +
Multi-person
Authentication
SafeNet Confidential

15. PC Keyboard is not a Trusted Path
Before
After
Keyboard sniffer costs about $100
Installs in about 10 seconds
Is electronically undetectable
Records 65,000 keystrokes

16. HSM Certifications
NIST FIPS Certificates, see:
Certificates include: 8, 29, 38, 39, 56, 57, 58, 168, 173, 214, 215, 216, 217, 218, 220, 270, 375, 436
Domus is our certification laboratory for FIPS certifications
Common Criteria EAL 4+ Certificate, see:
or u=9&orderindex=1&showcatagories=-33
Electronic Warfare Associates (EWA) Canada was the certification body for Common Criteria
Digital Signature Law Validation

17. How are HSMs Used for PKI?
UNCLASSIFIED//FOUO
27/03/2017
How are HSMs Used for PKI?
Protect Root keys
Issue Keys to Sub CAs, Servers and Users
Sign transactions
Offload crypto operations
A few real world examples…
Keys in HW- Keys in HW
Embedded Java apps …
SafeNet Confidential

18. HSMs: High-Availability and Disaster Recovery
UNCLASSIFIED//FOUO
27/03/2017
HSMs: High-Availability and Disaster Recovery
Operational
Disaster Recovery
PKI CA
PKI CA
Online
Hot Standby
Online
Hot Standby
In this example, Luna CA3 is used as the HSM for PKI root key protection in a High Availability configuration with Disaster Recovery and additional keys stored securely in a safe.
The customer would require several systems for hardware security throughout the infrastructure. We do have many joint customer today using this exact configuration.
Physical Backup
Physical Backup
SafeNet Confidential

19. Securing Banking Transactions
UNCLASSIFIED//FOUO
27/03/2017
Securing Banking Transactions
Large
Banks
SafeNet HSM
SafeNet HSM
Small
Banks
Applications
Financial Transaction
Infrastructure
Payments & Cash Mgt
Treasury & Derivatives
Trade services
Pre-Settlement/trade
Clearing services
Custody services
Certificate
Authority
No matter the organizations size, there is a security solution that will work…
Access Control
via 2 or 3 factor
Applications
SafeNet HSM
Key Management
SSL Acceleration
FIPS certified
Directory
SafeNet Confidential

20. Example - Manufacturing with PKI- IP Phones
Manufacturing CA
Luna HSM 1 2 3 4
IP Phone
The IP phone requests a certificate from the manufacturing certificate authority. (1) The certificate authority generates a new certificate that the Luna HSM signs with the root key. (2) The certificate is sent to the IP phone. (3) The IP phone now has a unique digital identity that is stamped into the phone by Cisco’s. (4)
Revised 5/9/2007 SafeNet, Inc. Company Confidential 4 of 5
HSM SSK

21. secure sensitive code or place applications in untrusted environments
Toolkits
3rd Party or Customer Developed Host Application
PKCS#11, Java, CAPI, OpenSSL, Custom, XML WSDL, Payments API’s
Windows, Solaris, Linux, HP UX, AIX, Solaris
Networked to single or multiple
SSM
smart card
Write your own applications and load them directly onto the device
secure sensitive code or place applications in untrusted environments
Early-stage development all in Software

22. What to look for in an HSM?
UNCLASSIFIED//FOUO
27/03/2017
What to look for in an HSM?
Certified by Standards Bodies
Performance
Level of security
Auditability
Ease of integration
Ease of management
Flexibility in use
Scalability (multiple partitions)
High Availability & Disaster Recovery
Keys in always in hardware
Keys in HW- Keys in HW
Embedded Java apps …
SafeNet Confidential

23. Best Practices for Hardware Security Modules
UNCLASSIFIED//FOUO
27/03/2017
Best Practices for Hardware Security Modules ü
Hardware-secured key generation
Controlled physical access
Hardware-secured key storage
Host independent 2-factor authentication
Hardware-secured key backup
Enforced operational roles
Hardware-secured digital signing
Independent Audit
PKI authenticated software
FIPS & Common Criteria validation
SafeNet Confidential

24. SafeNet – Strongest HSM Offering
Global and Stable organization: 25 years in security
Broadest HSM product Suite from USB to Network Attached
Best Toolkit offering featuring:
Well documented API’s: OpenSSL, XML, PKCS#11, Java, CAPI
A Software Emulation “HSM” for development
PPO and Java environments to host and secure code as well as Keys
Global F1000 trust SafeNet HSM to:
Secure their 3rd Party Applications
Develop on for their own security applications
Deploy in house and in untrusted environments

25. Contact Details Dave Madden, Business Development Safenet Inc.