HSM, short for Hardware Security Module, is specialized security hardware built to store sensitive cryptographic keys in a physical environment and to carry out cryptographic operations in the most secure way. This hardware enables applications to run securely.
HSMs are used in the following areas:
What are HSMs used for?
- Secure Data Storage
- Secure Data Transfer
- Verification/Authentication
- Audit Trail
- Data Integrity
HSM in payment systems
In payment systems, HSMs are used particularly for the following operations:
- Verifying the PIN entered by the cardholder
- Translating PIN blocks from one encryption key to another
- Generating and verifying CVV, CVV2, and iCVV values
- Verifying cryptograms generated by chip cards
- Generating card keys during card personalization
- Calculating and verifying MAC values
Why is an HSM secure?
The keys inside an HSM never leave the device in plain form. Cryptographic operations are performed inside the device, and only the result of the operation is released. The device is designed to automatically erase the keys it holds if it is physically opened or tampered with.
Key hierarchy
Keys in HSMs are managed in a layered structure. At the top is the HSM's own master key (LMK). All other keys are stored encrypted under this master key. This allows thousands of keys to be kept safely in a database outside the HSM.
Standards
HSMs used in payment systems are expected to comply with security standards such as PCI HSM and FIPS 140. Cloud-based HSM services are also becoming increasingly common today.
