Reducing costs in HSM-based data centers

Abstract

Hardware Security Modules (HSM) are special purpose devices designed for cryptographic operations, mostly used for cryptographic keys management. To achieve high security standard, an HSM stores keys internally and never exposes them in plaintext; operations involving the keys are performed internally and only the result is given outside the HSM. Thus an HSM must have storage space to store all the keys that have to be managed. In real-world application this might require a huge amount of space (e.g. millions of keys) resulting in large data centers needed to host many HSMs. Related costs, such as cost of the hardware, energy consumption, hosting, management, etc. are directly proportional to the number of HSMs used. In this paper we present a technique that allows to save space for storing keys in an HSM, thus reducing the number of needed HSMs. While saving space allows to reduce direct costs, it comes at the expense of computation time. We provide a preliminary experimental evaluation of the extra time needed.