HSM Password Shares for Application-Specific Object Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Hardware Security Modules (HSMs) lack effective mechanisms to secure cryptographic objects from unauthorized access by multiple applications in a multi-tenant environment, as the PKCS#11 standard does not distinguish application-specific objects, leading to potential compromise of stored data.
Innovation Solution
Implementing a Share Management System (SMS) that uses Shamir's Secret Sharing algorithm to split a partition password into multiple shares, assigning each application a unique password share and tag, ensuring each application can only access its own objects without modifying the PKCS#11 standard.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If a single HSM is shared by multiple applications, then cost is reduced and resource utilization is improved, but security is compromised as any authenticated application can access all objects
Solution Approach 1:
The patent segments the HSM's object space by introducing application-specific tags to objects. Each application can only access objects with its own tag, effectively dividing the shared HSM resources into isolated application-specific zones while maintaining physical sharing of the hardware device. This resolves the contradiction by enabling multi-application resource utilization without compromising security through tag-based access control.
2Reliability
If vendor-defined attributes are used to distinguish application-specific objects, then object management security is improved, but application compatibility deteriorates as every PKCS#11 supporting application must be modified
Solution Approach 1:
The patent implements a universal tagging mechanism that works with existing PKCS#11 applications without modification. The system transparently adds application tags to objects and intercepts PKCS#11 function calls to enforce tag-based access control. This allows the security enhancement to be applied universally across all PKCS#11 compliant applications without requiring changes to individual applications, resolving the contradiction between improved security and maintained compatibility.
3Reliability
If the Cryptoki library is re-developed to search token objects based on vendor-defined attributes, then object access control is improved, but device complexity and development effort increase
Solution Approach 1:
The patent introduces an intermediary layer between the application and the HSM that handles tag-based object identification and access control. This intermediary component translates application requests into HSM-specific operations without requiring modifications to the core Cryptoki library or HSM firmware. The intermediary manages the complexity of tag-based searching and access control externally, preserving the simplicity of the underlying HSM implementation while achieving enhanced security.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach provides secure, application-specific access to HSM objects, preventing unauthorized manipulation and maintaining existing application compatibility, thus enhancing security in multi-tenant HSM environments.
Implementation Method 1
generating Share Data (91) for the applications by: splitting the partition (CO or CU) password into multiple shares using Shamir's Secret Sharing algorithm
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Provided is an HSM (10) and methods (400, 450) for object management using an identifiable way to login into a partition (74) using unique password shares (S1, S2). The partition (CO or CU) password is split into multiple shares using Shamir's secret sharing algorithm in 2-of-n fashion, such that any two shares will suffice to reconstruct the partition (CO or CU) password. One share will remain with HSM at the device, and other shares are provided to the applications. The password shares are utilized to create application specific tags, that can be set as an attribute of object. A share data includes a password share and the tag, which is provided to the application for logging into the HSM via PKCS #11 commands. Each application will use its password share to create a session with partition. Object manipulation can be managed as per object tagging, such that applications have access only to their application objects. Other embodiments provided.