A method for integrating a hardware security module device into a running client-server operation and related device and system

Abstract

The invention relates to a method for integrating a hardware security module device (100) into a running client-server operation (130). The method comprises: executing (10) a configuration setup (110) for the hardware security module device (100) to be integrated. The configuration setup (110) includes authentication information (120) for at least one client (200) to be authorized on the hardware security module device (100). Furthermore, the method comprises integrating (20) the hardware security module device (100) into the running client-server operation (130). The operability of the client-server operation (130) remains unaffected.Furthermore, the method comprises modifying (30) a client service (140) by making the hardware security module device (100) known (40) in this client service (140) such that the hardware security module device (100) is addressable for a client (200) executing this service (140). The invention also relates to a corresponding device (100) and a corresponding system (300).

Description

[0001] The present invention relates to a method for integrating a hardware security module device into an ongoing client-server operation, a related device and a related system.

[0002] The access configuration for a hardware security module (HSM) contains several files, including configuration keys and packaged cryptographic keys, as well as access control material. Modifying and distributing this configuration requires stopping, redeploying, and then restarting each service. This is necessary whenever something changes, such as an update or patch, or, in the worst case, the failure of a single instance in an existing HSM cluster. A configuration service dynamically deploys all the required files and specific configuration elements to each client based on its digital identity.

[0003] Currently, each client must manually replace the configuration elements, reconfigure, redeploy, and reboot. Common solutions include network-attached storage devices connected to all servers, which then act as a single point of failure.

[0004] Setting up and manually reconfiguring an HSM access is very time-consuming and leads to downtime, including possible errors that can lead to the failure of several important use cases in the company.

[0005] US 2022 / 0 337 481 A1 describes various approaches for deploying and using configurable edge computing platforms.

[0006] GB 2 579 490 B describes a system comprising a cluster of secure execution platforms communicatively connected to a data store. Each secure execution platform in the cluster is configured to ensure data confidentiality during data processing using a key.

[0007] The aim of the invention is to propose a possibility which avoids or at least reduces at least some of the disadvantages known in the prior art.

[0008] The object is achieved according to the invention by means of a method according to the main claim, as well as by means of a device and a system according to the independent claims.

[0009] The subject matter of the main claim relates to a method for integrating a hardware security module device into a running client-server operation. The method comprises integrating the hardware security module device into the running client-server operation. The operability of the client-server operation remains unaffected. Furthermore, the method comprises modifying a client service by making the hardware security module device known in this client service. This is done in such a way that the hardware security module device is accessible to a client executing this service.

[0010] The process steps can be carried out automatically.

[0011] Integrating a hardware security module device (HSM) within the meaning of the invention means incorporating or rolling out the HSM into the client-server network in such a way that the HSM is available in the network, thus accessible and can exchange data.

[0012] A hardware security module device – also referred to as HSM – within the meaning of the invention refers to a peripheral device (internal or external) for the efficient and secure execution of cryptographic operations and / or applications for sensitive data. This makes it possible, for example, to ensure the trustworthiness and integrity of data and associated information in business-critical IT systems. To ensure trustworthiness, it may be necessary to protect the cryptographic keys used both through software and against physical or side-channel attacks. The HSM is, in particular, a physically existing device, and therefore not a pure software service (called a "service" or "application").

[0013] A device within the meaning of the invention means, for example, a computer or other device with a processor on which a service can run that connects to a network and can exchange data therein.

[0014] A client-server operation in the sense of the invention means a network in which at least one client and one server are integrated.

[0015] A client, as defined by the invention, refers to a terminal device or a service of a terminal device in a network on which a computer program is executed and communicates with a server, i.e., a central computer. However, a server can also be implemented as a cloud service.

[0016] Modification, as defined by the invention, means changing, for example, the configuration of an HSM. However, it can also mean installing an update or patch on the HSM.

[0017] Publication within the meaning of the invention can mean rolling out the corresponding HSM to associated clients in the client-server network. For example, the publicization of the corresponding HSM can only be carried out for those clients that are to be able to access the corresponding HSM. Such publicization may become necessary when a new HSM is integrated into the client-server network. However, it can also occur if an existing HSM has received an update or patch and its configuration needs to be changed as a result.

[0018] The fact that the operability of the client-server operation remains unaffected may mean that the integration of the new HSM can be carried out without stopping or restarting the client-server operation.

[0019] The fact that the HSM should be accessible to the client that runs this service can mean that communication between this client and this HSM is enabled.

[0020] The teaching according to the invention achieves the advantage that a method can be provided to integrate an HSM into an existing and running client-server network without requiring a restart within the client-server network.

[0021] The subject matter of a subordinate claim relates to a hardware security module device for cryptographically securing sensitive data. The hardware security module device comprises cryptography means for cryptographically securing sensitive data of a client. Furthermore, the device comprises integration means for integrating an external configuration setup of the hardware security module device. The integration means is configured to enable the integration of the external configuration setup during ongoing client-server operation, in which the hardware security module device is integrated.

[0022] Cryptographic security within the meaning of the invention means encryption of information and / or the transmission of this information in order to keep messages confidential, for example to protect data against unauthorized access or to transmit messages confidentially.

[0023] Sensitive data, as defined in the invention, refers to confidential data that should not be accessible to the general public. This can include classified data as well as personal data that should or must be treated confidentially, for example, due to a higher-level legal regulation.

[0024] A cryptography means within the meaning of the invention can mean a device, a service and / or an application that is designed or enables the cryptography means to enable cryptographic protection of data and / or the transmission of this data.

[0025] A client, as defined by the invention, refers to a terminal device or a service of a terminal device in a network on which a computer program is executed and communicates with a server, i.e., a central computer. However, a server can also be implemented as a cloud service.

[0026] An integration means within the meaning of the invention enables the rollout of an external configuration setup of the hardware security module device. Thus, an integration means means that a device, a service, and / or an application is provided that is configured to roll out a configuration setup to clients that can access the newly integrated hardware security module (HSM).

[0027] An external configuration setup within the meaning of the invention refers to the setting up, implementation, or provision of a configuration of a hardware security module. External can mean that the configuration setup is stored externally to the client. This can then be transmitted to the corresponding client so that it executes the transmitted configuration setup before accessing the hardware security module, enabling seamless access to the respective hardware security module thereafter.

[0028] The teaching according to the invention achieves the advantage that a hardware security module can be provided as a device for a network which has clients and hardware security modules, whereby the hardware security module can be integrated into the network and made known without the clients accessing this hardware security module having to perform a restart before first accessing it in order to be able to access the hardware security module for the first time.

[0029] This enables uninterrupted operation of such a network.

[0030] The subject matter of another independent claim relates to a system for client-server operation. The system comprises a client that contains sensitive data. Furthermore, according to the invention, the system includes a hardware security module device and a configuration means. The configuration means is configured to execute the method according to the invention.

[0031] The inventive teaching achieves the advantage of easily integrating new HSMs and the associated configuration setups. Furthermore, this process can be designed as an automated system. This saves time and resources without compromising the required security.

[0032] The subject matter of a further independent claim relates to a computer program with a program code which, when executed on a programmable processor, causes a method according to the invention to be carried out.

[0033] The teaching of the invention achieves the advantage that the process can be efficiently automated. This allows further cost savings. Furthermore, it can increase system efficiency.

[0034] Before describing embodiments of the invention in more detail below, it should first be noted that the invention is not limited to the described components or the described method steps. Furthermore, the terminology used does not represent a limitation but is merely exemplary. Where the singular is used in the description and claims, the plural is included unless the context explicitly excludes this. Any method steps can be performed automatically unless the context explicitly excludes this.

[0035] Further exemplary embodiments of the method according to the invention are explained below.

[0036] According to a first exemplary embodiment, the method further comprises that the hardware security module device is accessible to a client executing this service only after the service has been restarted by the client.

[0037] This has the advantage that the client does not have to be completely restarted, thus ensuring the system remains fully available. Another advantage is that access to newly integrated HSMs can be accelerated.

[0038] According to a further exemplary embodiment, the method further comprises that the restart of the service by the client occurs at the time at which the client intends to address the hardware security module device for the first time.

[0039] This design has the advantage that system operation can continue unaffected as long as no client attempts to access the new HSM. This further increases the system's reliability.

[0040] According to a further exemplary embodiment, the method further comprises modifying the client service in such a way that the hardware security module device is made known only to those clients which need to be able to address the hardware security module device.

[0041] This design has the advantage of reducing the effort required to publicize the new HSM. It also increases system security, since only those clients that should or need to access the new HSM know about it.

[0042] According to a further exemplary embodiment, the method further comprises that the client service is a global client service for all clients in client-server operation.

[0043] This design has the advantage of providing a common service for all clients in the network. This further reduces maintenance effort and increases reliability.

[0044] According to another exemplary embodiment, the method further comprises the client service having a client service cluster with a plurality of services. Each service of the client service cluster has a plurality of clients and is configured for these clients. Each service of the client service cluster is individually configurable.

[0045] This design has the advantage of providing a centralized solution for the needs of customizing the configuration service for different clients. This further reduces maintenance effort and increases reliability.

[0046] According to another exemplary embodiment, the method further comprises the client service having a dedicated service for each client in client-server operation. The corresponding service is individually configurable for each client.

[0047] This design has the advantage of providing a configuration setup optimally tailored to each client. This can be particularly advantageous in networks with relatively few clients. It can also be useful to combine the centralized solution with the dedicated solution. This can be particularly useful in networks with a relatively large number of clients, but where some clients assume special roles with correspondingly different configuration setups.

[0048] The invention will be explained in more detail below with reference to the figures, in which: Fig. 1 a schematic representation of a proposed method according to an exemplary embodiment of the invention; Fig. 2 a schematic representation of a proposed device according to a further exemplary embodiment of the invention; Fig. 3 is a schematic representation of a proposed system according to a further exemplary embodiment of the invention; and Fig. 4 a schematic representation of a proposed process according to a further exemplary embodiment of the invention.

[0049] Fig. 1 shows a schematic representation of a proposed method according to an exemplary embodiment of the invention.

[0050] This shows Fig. 1 shows a schematic representation of a method for integrating a hardware security module device 100 into a running client-server operation 130. The method comprises: executing 10 a configuration setup 110 for the hardware security module device 100 to be integrated. The configuration setup 110 comprises authentication information 120 for at least one client 200 to be permitted on the hardware security module device 100. Furthermore, the method comprises integrating 20 the hardware security module device 100 into the running client-server operation 130. The operability of the client-server operation 130 remains unaffected. And further, the method comprises modifying 30 a client service 140 by making known 40 the hardware security module device 100 in this client service 140, such that the hardware security module device 100 is accessible to a client 200 executing this service 140.

[0051] Fig. 2 shows a schematic representation of a proposed device according to a further exemplary embodiment of the invention.

[0052] How Fig. 2, the device is a hardware security module device 100 for cryptographically securing sensitive data. The hardware security module device 100 comprises: cryptography means 170 for cryptographically securing sensitive data 190 of a client 200; and integration means 180 for integrating an external configuration setup 110 of the hardware security module device 100. The integration means 180 is configured such that it enables the integration of the external configuration setup 110 into the ongoing client-server operation 130, in which the hardware security module device 100 is integrated.

[0053] Fig. 3 shows a schematic representation of a proposed system according to another exemplary embodiment of the invention.

[0054] How Fig. 3, the system 300 for a client-server operation 130 comprises: a client 200, comprising sensitive data; a hardware security module device 100 according to the invention (for example according to Fig. 2); and a configuration means 190 which is configured to carry out a method according to the invention (for example according to Fig. 1).

[0055] Fig. 4 shows a schematic representation of a proposed process (for example, a communication or an information exchange) according to a further exemplary embodiment of the invention.

[0056] The inventive idea can be summarized as follows: A method, a related device, and a system are provided, which make it possible to make changes to an HSM without requiring a system reboot.

[0057] The basic idea is to provide dynamic configurations at runtime that can be used immediately. Customers provide their workload identity tokens, which are only valid for a short period of time, and the services deliver the configuration and the packaged key material to the corresponding containers. HSM connectivity is not interrupted, and the crypto logic within the application can execute without interruption.

[0058] For example, a configuration service rolls out a newly integrated HSM to associated clients.

[0059] Thus, only one service is required for the clients to make the new HSM known to the corresponding clients.

[0060] This makes it possible to integrate a new HSM into ongoing client-server operation, and the new HSM is only known to those clients that require the new HSM (e.g. for services).

[0061] The system (cluster / node / network) does not need to be stopped / paused.

[0062] If such a client now wants to access the newly announced HSM, the client simply restarts the configuration service and thus has access to the newly announced HSM without the client itself having to perform a restart / reboot. List of reference symbols 10 Running a configuration setup 20 Integrating the hardware security module device 30 Modifying a Client Service 40 Announcement of the hardware security module device 50 Restart the service 100 hardware security modules device 110 Configuration Setup 120 Authentication information 130 Client-Server Operation 140 Client Service 160 client service clusters 170 cryptographic tools 180 integration resources 190 configuration tools 200 clients 300 system

Claims

[1] A method for integrating a hardware security module device (100) into a running client-server operation (130), the method comprising: - executing (10) a configuration setup (110) for the hardware security module device (100) to be integrated, wherein the configuration setup (110) comprises authentication information (120) of at least one client (200) to be admitted on the hardware security module device (100); - integrating (20) the hardware security module device (100) into the ongoing client-server operation (130), whereby the operability of the client-server operation (130) remains unaffected; and - modifying (30) a client service (140) by making known (40) the hardware security module device (100) in this client service (140) such that the hardware security module device (100) is accessible to a client (200) executing this service (140). [2] The method according to claim 1, wherein the hardware security module device (100) is accessible to a client (200) executing this service only after a restart (50) of the service (140) by the client (200). [3] The method according to claim 2, wherein the restart (50) of the service (140) by the client (200) occurs at the time when the client (200) first intends to address the hardware security module device (100). [4] The method according to any one of the preceding claims, wherein the modifying (30) of the client service (140) is performed such that the notification (40) of the hardware security module device (100) is performed only for those clients (200) which need to be able to address the hardware security module device (100). [5] The method according to any one of the preceding claims, wherein the client service (140) is a global client service for all clients (200) in the client-server operation (130). [6] The method according to any one of the preceding claims, wherein the client service (140) comprises a client service cluster (160) having a plurality of services, each service of the client service cluster (160) having a plurality of clients (200) and being configured for these clients (200), each service of the client service cluster (160) being individually configurable. [7] The method according to any one of the preceding claims, wherein the client service (140) comprises a dedicated service for each client (200) in the client-server mode (130), wherein for each client (200) the corresponding service is individually configurable. [8] A hardware security module device (100) for cryptographically securing sensitive data, the hardware security module device (100) comprising: - Cryptographic means (170) for cryptographically securing sensitive data (190) of a client (200); and - Integration means (180) for integrating an external configuration setup (110) of the hardware security module device (100), wherein the integration means (180) is configured such that it enables the integration of the external configuration setup (110) in the ongoing client-server operation (130) in which the hardware security module device (100) is integrated. [9] A system (300) for a client-server operation (130), the system comprising: - A client (200) having sensitive data; - a hardware security module device (100) according to claim 8; and - a configuration means (190) which is arranged to carry out the method according to one of claims 1 to 7. [10] A computer program comprising program code which, when executed on a programmable processor, causes a method according to any one of claims 1 to 7 to be carried out.

Images