What are the common criteria for hardware security modules (HSMs)?

All the critical banking and payment systems incorporate Hardware Security Modules (HSMs) for the protection of user information and business transactions.

HSMs deliver secure management of crypto keys along with encryption/decryption, digital signatures and authentication mechanisms which are frequently used for the security of corporate business applications. A globally certified HSM not only guarantees secure and proficient integration with the existing business workflows but also offers legal and regulatory compliances for the trust of buyers and system evaluators. Common Criteria (CC) is a well-recognized certification and helps in choosing security-appropriate HSMs.

1. Different types of hardware security modules and their importance

Hardware Security Modules (HSMs) are a very critical component of business application because they are responsible for the security of confidential information and transactions. They are either a dedicated hardware machine or a cluster of multiple devices with embedded processors which can swiftly carry on cryptographic operations. HSMs or “Secure Cryptographic Devices” are available in several sizes/types and different security levels such as TPMs / embedded HSMs, software tokens, PCI Cards, Smart Cards, USB tokens, and network-attached HSMs. Every HSM types offer features (performance, standalone/network-attached) as per the requirements of corporate applications.

HSMs not only provide different levels of logical but also physical protection to crypto keying material against unauthorized access by adversaries consequentially acting as security backbone of your business architecture.

So HSMs provide accelerated crypto operations on one end and curtails/lessens the business risks on the other end. The incorporation of HSM in business provides the following plus points.

• Enhanced Security
• Centralized Policy Enforcement
• Augmented Business Efficiency
• Decrease Operational Cost/Complexity
• Legal and Regulatory Compliance

Banking and corporate sectors have a huge clientele and have to serve a large user base securely and efficiently. The risk of failover and downtime is very critical in such organizations and can lead to the huge amount of business loss. Hence, the HSMs are deployed in cluster/redundancy, HA (High Availability) and load-balancing mode to guarantee contingency and ensure business continuity.

2. Advantage of CC certified HSMs

A certification is an immediate and documented benchmark about the features and functionalities of an HSM based on standardized testing procedures. International and globally recognized certifications assure the trust/confidence of all the stakeholders (managers, designers, clients/end users and evaluators etc.) of an architecture. The core intention behind the initiative of Common Criteria was to assure the trust and global acceptance to the security products sold in the international market so that they don’t need to be re-evaluated by each buying client/country.

International and corporate organizations/clients always prefer/recommend HSMs and crypto devices having Common Criteria certifications. Federal Agencies of USA have made it mandatory to procure IT products which are Common Criteria certified. Common Criteria enlists all the certified products on their website. As a whole, the following advantages are offered by a certification:

• Competitive benefit among vendors
• Trust among stakeholders
• Interoperability
• Legal/Regulatory bindings.

3. Common Criteria Certification

Common Criteria (CC) is a globally recognized standard/certification (ISO/IEC 15408) which helps in choosing maximum security and assurance levels of HSMs. It is a joint effort of six (06) countries: US, UK, Canada, France, Germany & Netherlands. It is the cutting edge feature for the procurements of HSM among the competitor vendors and a core requirement of security aware corporations. The latest version (v3.1) was released in April 2017.

4. Common Criteria evaluation of HSMs

Common Criteria Evaluation of an HSM involves the validation that the HSM or crypto module fulfills a particular set of security objectives and requirements. The HSM or crypto module which has to be evaluated is referred to as TOE (Target of Evaluation) and the security requirements are referred to as ST (Security Target). After the evaluation process, an EAL (Evaluation Assurance Level) is assigned to the product. The EAL ranges from 1 (minimum) to 7 (maximum). EAL rating is basically a rating of testing, not the security. Hence it means that if an HSM has a higher EAL rating then it does not mean that it is more secure, it only means that the HSM has been thoroughly tested and evaluated based on the standards. It is highly recommended to procure/deploy HSMs which have an EAL rating of 4 or higher.