15.2.8 HSM Servers
(Ask a Question)This section provides information about User and Manufacturer HSM servers: purpose, deployment scenarios, and the key management scheme.
HSM servers provide a protected security environment that allows SPPS to:
- Generate and protect user encryption and pass
keys, base keys, random nonces, and so on.
- Application keys and their associated metadata are stored as encrypted key tokens on the HSM-server mass storage device (for example, hard drive)
- Execute cryptographic algorithms and protocols making use of the protected keys:
- Generate protocol data (For example, Authorization Code bitstream components (see Authorization Code Protocol), and so on.)
- Verify validators generated by other HSMs or devices (For example, CoC (see Device Certificate of Conformance (CoC), Job End certifier (see Job End Certifier Protocol), and so on)
- Securely transmit information between HSM servers (see HSM Security Environment)
Secured key handling and protocol execution is done by the SEE firmware running inside the HSM hardware module (see Use of Hardware Security Modules (HSM)).