Answers: <p>So having gone backwards and forward over this for a couple of weeks, Azure has confirmed to me in-person that the only way to utilise FIPS-140 Level 2 certified hardware security modules in Microsoft Azure is to use <a href="https://azure.microsoft.com/en-gb/services/key-vault/" rel="nofollow noreferrer">Azure Key Vault</a>.</p>
  
Answers: CC BY-SA 3.0
Answers: 2018-01-29T17:13:17.747Z
Answers: 2018-01-29T17:13:17.747Z
Answers: Richard Slater
Answers: <p>Richard, you are right that Cloud and HSMs are two contradictory concepts.</p>
  
  <p>To fulfill availability and elasticity requirements for key management and cryptographic operations a middleware is needed controlling all the hardware. This is basically done by the cloud KMS available now.</p>
  
  <p>With AWS Cloud HSM, there is no fully managed availability and elasticity any longer. Instead, you can add HSMs to the cluster if needed (scalability) and if they are located in different availability zones you achieve a certain level of availability as well (but there is no guaranteed SLA as opposed to KMS). Moreover, AWS is doing backups. However, you have to trust AWS and Cavium that they never collaborate and calculate the Backup Encryption Key from the AKBK and MKBK (see page 10 of the <a href="https://d1.awsstatic.com/whitepapers/Security/security-of-aws-cloudhsm-backups.pdf" rel="nofollow noreferrer">AWS whitepaper</a>) outside of the HSM.</p>
  
  <p>When you really want to have full control over the HSM, you have to host the HSM yourself and connect it to the cloud using VPN. However, depending on the Internet connection of your data center you might suffer from low latency and your external Internet connection could be vulnerable to DoS attacks. Therefore, solutions like <a href="https://hsm.utimaco.com/products/dedicated-purpose-hsm/cryptoserver-cloud/" rel="nofollow noreferrer">Utimaco CryptoServer Cloud</a> include private connections from their data centers to your cloud. Depending on the location of the data center and the cloud region, these connections can have very low latency. Since the HSMs do not belong to any cloud service provider you are able to switch CSPs more easily since you don't have to move keys (which can be quite hard to impossible with KMS). Moreover, multi-cloud scenarios are possible. On the other hand, you have to bear all the management tasks like backups or firmware upgrades. Also, to achieve high availability you have to rent at least two of the HSMs, and scaling granularity is a full HSM only. But that's the price for being very secure by having full control over the HSM.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-07-26T16:10:23.137Z
Answers: 2018-07-26T16:10:23.137Z
Answers: dannyM
Answers: <p>I just wanted to point to you that there are solutions out there to benefit from HSM aaS dedicated. We are piloting this at Interxion (colocation provider Europe) : <a href="https://www.interxion.com/products/key-guardian/" rel="nofollow noreferrer">https://www.interxion.com/products/key-guardian/</a></p>
  
Answers: CC BY-SA 3.0
Answers: 2018-03-01T08:24:51.997Z
Answers: While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes
Answers: Romeo Ninov
Answers: CC BY-SA 3.0
Answers: 2018-02-28T10:17:57.243Z
Answers: 2018-02-28T10:17:57.243Z
Answers: Patrick Lastennet
Body: <p>I have to admit to never having asked, or been asked, the question if it is possible to have a Hardware Security Module in a public cloud, by which I mean Google, Amazon or Azure.  <em>Has anyone found any techniques for enabling organizations to use HSMs that they fully manage?</em></p>
  
  <p>It seems to me that the two concepts, Cloud and HSMs, are fundamentally at odds with each other - because cloud generally involves "outsourcing" or transferring the risk of operating hardware to the cloud service provider.</p>
  
  <p>There is clearly a middle ground in terms of fully managed HSMs as you find in Azure and AWS:</p>
  
  <ul>
  <li><a href="https://azure.microsoft.com/en-gb/services/key-vault/" rel="noreferrer">Azure KeyVault</a>: Use Key Vault and you don’t need to provision, configure, patch and maintain HSMs and key management software. Provision new vaults and keys (or import keys from your own HSMs) in minutes and centrally manage keys, secrets and policies.</li>
  <li><a href="https://aws.amazon.com/cloudhsm/" rel="noreferrer">AWS CloudHSM</a>: AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud. With CloudHSM, you can manage your own encryption keys using FIPS 140-2 Level 3 validated HSMs.</li>
  </ul>
  
  <p>In addition there are some non-HSM based solutions to key management:</p>
  
  <ul>
  <li><a href="https://cloud.google.com/kms/" rel="noreferrer">Cloud Key Management (Google)</a>: Cloud KMS is a cloud-hosted key management service that lets you manage encryption for your cloud services the same way you do on-premises. You can generate, use, rotate and destroy AES256 encryption keys. Cloud KMS is integrated with IAM and Cloud Audit Logging so that you can manage permissions on individual keys, and monitor how these are used. Use Cloud KMS to protect secrets and other sensitive data which you need to store in Google Cloud Platform.</li>
  <li>Various Security Appliances available in all of the cloud marketplaces.</li>
  </ul>
  
  <p>Has anyone found any techniques for enabling organizations to use HSMs that they fully manage?</p>
  
Comments: CC BY-SA 3.0
Comments: 2017-12-01T13:14:29.523Z
Comments: I'm unsure to get the question, running on AWs or GCE you can manage your HSM as you'd do on premise using IAAS only... I probably did miss a point in the question but would appreciate a pointer to it.
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-12-01T15:38:17.400Z
Comments: Surely the point of a Hardware Security Module is it is hardware, rather than software so you get the physical protection of the keys.  Cloud abstracts physical tin from the consumer so you no longer have direct access to the hardware, including the HSM.  Most providers seem to be offering key management solutions that build upon HSMs but as far as I can tell you can't rent and manage an HSM outside of the KeyVault/CloudHSM abstraction paradigm.
Comments: Richard Slater
Comments: CC BY-SA 3.0
Comments: 2017-12-01T18:30:46.160Z
Comments: The whole post being turned more on the keys Management than their security holding I have been mistaken. With this comment, obviously not in a cloud provider, you'd have to host it somewhere else where you own the hardware or use a service and be confident on its management. (I personally trust aws to configure and patch Kms more than a hsm appliance on premise)
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-12-02T16:40:08.350Z
Comments: "Fully managed" generally means the service provider manages it, which is the opposite of what you're asking about; I'd call this an *unmanaged* HSM.
Comments: Xiong Chiamiov
Comments: CC BY-SA 3.0
Comments: 2017-12-03T13:40:11.600Z
Comments: @RichardSlater So this issue has been solved? If true, could you post an answer?
Comments: 030
Comments: CC BY-SA 3.0
Comments: 2017-12-04T00:12:25.723Z
Comments: It may have changed, but historically the CloudHSM product involved amazon physically plugging in a USB module on the host your VM is running on. Not very cloudy.
Comments: coderanger
Comments: CC BY-SA 3.0
Comments: 2017-12-04T06:48:52.400Z
Comments: @030 no, not solved. I wish it was.
Comments: Richard Slater
Comments: CC BY-SA 3.0
Comments: 2017-12-20T15:57:52.700Z
Comments: Related: https://github.com/imclab/tscrypto is a project from NIC.CL domain name registry to have distributed HSM capabilities, so running in a cloud. See their presentation here: https://archive.icann.org/meetings/losangeles2014/en/schedule/mon-tech/presentation-cryptography-hsm-13oct14-en.pdf
Comments: Patrick Mevzek
Comments: CC BY-SA 3.0
Comments: 2018-02-13T08:11:10.317Z
Comments: You might want to contact [Utimaco](https://hsm.utimaco.com/) to see if their [cloud HSM](https://hsm.utimaco.com/solutions/industries/cloud-service-provider/) is what you need.
Comments: pitseeker
Tags: <security><cloud><key-management>
Title: Running unmanaged Hardware Security Modules (HSMs) in the Cloud
UserDisplayName: Richard Slater
ThreadText: # Running unmanaged Hardware Security Modules (HSMs) in the Cloud
  
  (Asked by: username_0 on 2017-12-01)
  
  I have to admit to never having asked, or been asked, the question if it is possible to have a Hardware Security Module in a public cloud, by which I mean Google, Amazon or Azure. *Has anyone found any techniques for enabling organizations to use HSMs that they fully manage?*
  
  It seems to me that the two concepts, Cloud and HSMs, are fundamentally at odds with each other - because cloud generally involves "outsourcing" or transferring the risk of operating hardware to the cloud service provider.
  
  There is clearly a middle ground in terms of fully managed HSMs as you find in Azure and AWS:
  
  * [Azure KeyVault](https://azure.microsoft.com/en-gb/services/key-vault/): Use Key Vault and you don’t need to provision, configure, patch and maintain HSMs and key management software. Provision new vaults and keys (or import keys from your own HSMs) in minutes and centrally manage keys, secrets and policies.
  * [AWS CloudHSM](https://aws.amazon.com/cloudhsm/): AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud. With CloudHSM, you can manage your own encryption keys using FIPS 140-2 Level 3 validated HSMs.
  
  In addition there are some non-HSM based solutions to key management:
  
  * [Cloud Key Management (Google)](https://cloud.google.com/kms/): Cloud KMS is a cloud-hosted key management service that lets you manage encryption for your cloud services the same way you do on-premises. You can generate, use, rotate and destroy AES256 encryption keys. Cloud KMS is integrated with IAM and Cloud Audit Logging so that you can manage permissions on individual keys, and monitor how these are used. Use Cloud KMS to protect secrets and other sensitive data which you need to store in Google Cloud Platform.
  * Various Security Appliances available in all of the cloud marketplaces.
  
  Has anyone found any techniques for enabling organizations to use HSMs that they fully manage?
  
  **Tags:** security, cloud, key-management
  
  > **Comments:**
  > **username_1**: I'm unsure to get the question, running on AWs or GCE you can manage your HSM as you'd do on premise using IAAS only... I probably did miss a point in the question but would appreciate a pointer to it.  
  > **username_0**: Surely the point of a Hardware Security Module is it is hardware, rather than software so you get the physical protection of the keys.  Cloud abstracts physical tin from the consumer so you no longer have direct access to the hardware, including the HSM.  Most providers seem to be offering key management solutions that build upon HSMs but as far as I can tell you can't rent and manage an HSM outside of the KeyVault/CloudHSM abstraction paradigm.  
  > **username_1**: The whole post being turned more on the keys Management than their security holding I have been mistaken. With this comment, obviously not in a cloud provider, you'd have to host it somewhere else where you own the hardware or use a service and be confident on its management. (I personally trust aws to configure and patch Kms more than a hsm appliance on premise)  
  > **username_2**: "Fully managed" generally means the service provider manages it, which is the opposite of what you're asking about; I'd call this an *unmanaged* HSM.  
  > **username_3**: @username_0 So this issue has been solved? If true, could you post an answer?  
  > **username_4**: It may have changed, but historically the CloudHSM product involved amazon physically plugging in a USB module on the host your VM is running on. Not very cloudy.  
  > **username_0**: @username_3 no, not solved. I wish it was.  
  > **username_5**: Related: https://github.com/imclab/tscrypto is a project from NIC.CL domain name registry to have distributed HSM capabilities, so running in a cloud. See their presentation here: https://archive.icann.org/meetings/losangeles2014/en/schedule/mon-tech/presentation-cryptography-hsm-13oct14-en.pdf  
  > **username_6**: You might want to contact [Utimaco](https://hsm.utimaco.com/) to see if their [cloud HSM](https://hsm.utimaco.com/solutions/industries/cloud-service-provider/) is what you need.  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2018-01-29. Score: 1 | Accepted answer
  
  So having gone backwards and forward over this for a couple of weeks, Azure has confirmed to me in-person that the only way to utilise FIPS-140 Level 2 certified hardware security modules in Microsoft Azure is to use [Azure Key Vault](https://azure.microsoft.com/en-gb/services/key-vault/).
  
  
  ---
  
  ### Answer by username_7 on 2018-07-26. Score: 1
  
  username_0, you are right that Cloud and HSMs are two contradictory concepts.
  
  To fulfill availability and elasticity requirements for key management and cryptographic operations a middleware is needed controlling all the hardware. This is basically done by the cloud KMS available now.
  
  With AWS Cloud HSM, there is no fully managed availability and elasticity any longer. Instead, you can add HSMs to the cluster if needed (scalability) and if they are located in different availability zones you achieve a certain level of availability as well (but there is no guaranteed SLA as opposed to KMS). Moreover, AWS is doing backups. However, you have to trust AWS and Cavium that they never collaborate and calculate the Backup Encryption Key from the AKBK and MKBK (see page 10 of the [AWS whitepaper](https://d1.awsstatic.com/whitepapers/Security/security-of-aws-cloudhsm-backups.pdf)) outside of the HSM.
  
  When you really want to have full control over the HSM, you have to host the HSM yourself and connect it to the cloud using VPN. However, depending on the Internet connection of your data center you might suffer from low latency and your external Internet connection could be vulnerable to DoS attacks. Therefore, solutions like [Utimaco CryptoServer Cloud](https://hsm.utimaco.com/products/dedicated-purpose-hsm/cryptoserver-cloud/) include private connections from their data centers to your cloud. Depending on the location of the data center and the cloud region, these connections can have very low latency. Since the HSMs do not belong to any cloud service provider you are able to switch CSPs more easily since you don't have to move keys (which can be quite hard to impossible with KMS). Moreover, multi-cloud scenarios are possible. On the other hand, you have to bear all the management tasks like backups or firmware upgrades. Also, to achieve high availability you have to rent at least two of the HSMs, and scaling granularity is a full HSM only. But that's the price for being very secure by having full control over the HSM.
  
  
  ---
  
  ### Answer by username_8 on 2018-02-28. Score: 0
  
  I just wanted to point to you that there are solutions out there to benefit from HSM aaS dedicated. We are piloting this at Interxion (colocation provider Europe) : <https://www.interxion.com/products/key-guardian/>
  
  > **Comments:**
  > **username_9**: While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes  
  
  ---
  
  