DOCSEARCHbyAlgolia
Submit Docs

Securosys HSM Documentation

website·Indexed 35 days ago

https://docs.securosys.com/

Documentation for Securosys Primus HSM and CloudHSM, featuring integration guides for AWS KMS (XKS), Azure EKM, HashiCorp Vault, MongoDB, Veeam, Salesforce BYOK, and other cloud, API, and application compatibility standards including PKCS#11 and KMIP.

Tokens
317.3K
Snippets
1.2K
Records
2.4K
Agent score
66%

What's inside Securosys

  1. Overview of Securosys VaultCode

    Securosys VaultCode is a secure runtime environment that executes custom business logic within the trusted boundaries of a Primus HSM. It allows developers to load JAR executables (compiled to JVM bytecode) to perform sensitive operations, such as automated key usage approvals, ensuring that the logic cannot be altered without authorization from Security Officers (SOs). VaultCode generates signed evidence (attestations) covering the environment, timestamp, executed code, and the resulting output.

  2. Overview of Fireblocks Key Link architecture with Securosys

    To link a Primus HSM to a Fireblocks workspace, two types of keys are used:

    1. Validation Key: A single key onboarded once to the Fireblocks workspace. Onboarding requires approval by a quorum of workspace administrators. It is used to sign certificates for signing keys.
    2. Signing Keys (referred to as Asset Keys in the Securosys Custom Server): Keys linked to Fireblocks Vaults and wallets. To onboard a signing key, you must provide a certificate signed by the validation key and a proof of ownership (a signature over a specific message) to prove control of the key. No quorum approval is needed for signing keys once the validation key is established.

  3. Overview of Securosys CloudHSM

    Securosys CloudHSM is a managed Hardware Security Module (HSM) service providing cloud-based HSMs for generating and managing encryption and signing keys. It utilizes geo-redundant clusters of Primus HSMs, removing the need for users to manage hardware hosting, backups, Security Officer (SO) credentials, or firmware updates.

  4. Overview of Securosys Primus HSM capabilities

    The Securosys Primus HSM is a high-assurance Hardware Security Module used to generate, manage, and protect cryptographic keys. It supports encryption, decryption, digital signing, and authentication. Key capabilities include:

    • Scalable Performance: From a few TPS up to 50,000+ TPS per unit, scaling to millions of TPS in clustered configurations.
    • Key Storage: Scalable storage from 10 MB (cloud) up to 30 GB internally, with optional external storage for nearly limitless capacity.
    • Multi-Tenancy: Support for up to 1,000 isolated partitions, each with independent keys, policies, user roles, and Decanus Terminal access.
    • High Availability: Native clustering support for fault tolerance and load distribution without additional software.
    • Remote Administration: Role-based management via the Decanus Terminal with enforced two-factor authentication (2FA).

  5. Overview of Securosys Primus Tools for HSM Management

    The Primus Tools collection (primus-tools.jar) is a Java-based, platform-independent set of tools designed for common key management and HSM management tasks. They are compatible with both on-premise Primus HSMs and CloudHSMs, communicating with the hardware via the JCE API. To use these tools, a Java Runtime Environment (JRE) must be installed.

  6. Overview of CloudHSM Sandbox (SBX) capabilities

    The CloudHSM Sandbox (SBX) is a non-productive environment designed exclusively for integration and testing. It allows developers to experiment with features, configurations, and workflows without affecting production systems. It features dual HSM synchronization and provides detailed device log access for users and Securosys Support to facilitate troubleshooting. SBX typically receives HSM firmware updates first, allowing users to pre-test updates before they are rolled out to Economy or Platinum tiers.

  7. Overview of ksputilcons utility

    The ksputilcons.exe utility (version 1.50.2 or newer) is a command-line tool used to test the Securosys CNG/KSP provider, manage specific keys (creation and deletion), and resolve key accessibility issues (such as changing key owners during domain transfers or upgrades). It is automatically installed with the Primus CNG/KSP provider.
    # Default installation path
"%ProgramFiles%\Securosys\PrimusHsmKsp\ksputilcons.exe"

  8. Overview of CloudHSM Economy Certified (ECO CC) features

    CloudHSM Economy Certified (ECO CC) is designed for users requiring an HSM compliant with Common Criteria (CC) and eIDAS (QSCD). Key characteristics include:

    • Uses CC-certified Primus HSM firmware.
    • Operates in strict FIPS mode, restricting functionality to FIPS-approved algorithms.
    • Operates within a CC-compliant environment.
    • Partitions are mirrored to a secure backup data center for protection.

  9. Overview of Smart Key Attributes (SKAs)

    Smart Key Attributes (SKAs) allow developers to define fine-grained authorization and usage rules directly on private keys stored within Securosys HSMs (CloudHSM and on-premise Primus HSMs). Unlike traditional HSMs where authorization is handled by the application, SKAs ensure that authorization rules are enforced inside the HSM's protected environment. This prevents unauthorized key usage even if an attacker has access to the HSM interface. Supported authorization mechanisms include:

    • Quorums: Requiring n-of-m approvers to authorize key usage.
    • Timelocks and Timeouts: Restricting usage based on time constraints.
    • Traditional Attributes: Limiting keys to specific operations such as sign, decrypt, or unwrap.

  10. Overview of Securosys EKM Proxy for Azure Managed HSM

    The Securosys EKM Proxy is a mediation layer that implements the Azure EKM Proxy API, allowing Azure Managed HSM to use a Securosys Primus HSM (on-premise) or Securosys CloudHSM as an external keystore. Unlike BYOK, EKM ensures cryptographic keys never leave the secure boundary of the HSM and are never imported into the cloud; Azure services call the external HSM for cryptographic operations via the proxy.

  11. Overview of Securosys Secret Engine for HashiCorp Vault

    The Securosys Secret Engine is a plugin that integrates Hardware Security Modules (HSMs) with HashiCorp Vault (Enterprise and Community Edition). It provides a platform-agnostic REST-based HSM interface using secure TLS connections, eliminating the need for local library installations and simplifying deployment in clustered or multi-cloud environments. Key capabilities include:

    • Securely managing keys stored on the HSM.
    • Performing cryptographic operations directly on the HSM.
    • Utilizing Primus HSM features such as high-performance encryption (ECIES, AES-GCM) and hardware-enforced multi-authorization workflows for compliance, signatures, or blockchain transactions.

  12. Overview of Securosys CloudHSM services

    CloudHSM is a managed Hardware Security Module (HSM) service that allows subscribers to perform cryptographic operations via API over the internet. It consists of three primary service components:

    1. HSM as a Service (HSMaaS): Provides access to HSMs, which can be shared, dedicated (owned/operated by Securosys), customer-owned (operated by Securosys), or shared for Bring Your Own Key (BYOKaaS) purposes.
    2. Transaction Security Broker as a Service (TSBaaS): A supplementary service providing a workflow engine for multi-authorization schemes based on the HSM's Smart Key Attribute (SKA) feature.
    3. REST API as a Service (RESTaaS): A RESTful API middleware managed by Securosys, built upon TSBaaS, providing an alternative to native HSM APIs.