Ever since we published 2 blog posts – here and here, on Aadhaar Data Vault and briefly touched upon the role that Hardware Security Modules (HSMs) play in setting up the Aadhaar Data Vault ecosystem, we received many queries from readers asking for more information on the best-fit HSMs.
In this blog post, we attempt to share our views on the various aspects associated with choosing the best-fit HSM for your organisation’s Aadhaar Data Vault. Let’s begin!
1. What is a HSM device?
A HSM device is a hardened, tamper-resistant, dedicated physical computing device that is built on top of a specialised hardware with the sole objective of safeguarding and managing digital (cryptographic) keys used for data encryption to ensure optimal data security.
Simply put, a HSM is a unique “trusted” device used for performing a host of cryptographic operations like digital key generation, management, exchange / key rotation, encryption, decryption, etc.
By “trusted” we mean no unauthorised access, no viruses, no malwares and no exploits. The specialised hardware used to build a HSM is rigorously tested and certified in special laboratories, has an independent Operating System highly focused on security, and a limited (need-to-have) access via a network interface that is strictly controlled by internal rules.
Due to the critical role they play in securing confidential information associated with mission critical business applications, HSM devices are typically certified to internationally recognised security standards such as Common Criteria or FIPS 140.
Since a crypto (digital) key passes through multiple phases during its lifetime – like generation, storage, distribution, backup, and destruction, HSMs play a pivotal role in guarding the crypto keys at every juncture of their lifecycle.
2. What are the types of HSMs?
There are 4 broad types of HSM devices:
1) USB HSMs: These are USB-attached devices that are ideal for storing root cryptographic keys in an offline key storage device. The advantage of USB HSMs is their low cost but the flip side is that they can’t handle more than 2 concurrent transactions.
2) Network HSMs: These are network-attached devices used for safeguarding encryption keys used by applications in on-premises, virtual, and cloud environments. Network HSMs are not machine dependent and are ideal for implementations that need high availability and support for higher number of Transactions Per Second (TPS) requests.
3) PCI HSMs: These are embedded directly in an appliance or application servers and primarily used for safeguarding cryptographic keys and accelerating sensitive cryptographic operations. While PCI HSMs can also support higher TPS requests, they are machine dependent devices which means that if the servers on which these are installed go down, the HSM device shall also cease to function.
4) Backup HSMs: As the name suggests, these are used for backups by securely duplicating cryptographic keys in case of emergency, failure or disaster.
3. What is the exact role of HSM devices in Aadhaar Data Vault?
As seen in our earlier blog post, UIDAI has mandated all AUAs / KUAs and Sub-AUAs to compulsorily store all Aadhaar-related data only in their Aadhaar Data Vault, which is to be setup in a highly restricted network zone that is isolated from any untrusted access zones.
Since the Aadhaar number and any connected data maintained on the Aadhaar Data Vault has to be always kept encrypted with strict access controls, UIDAI has mandated usage of HSM devices to achieve the objective of storing the encryption keys in a completely secure environment to ensure foolproof data security.
4. What are the security parameters to be looked for when procuring HSM devices for implementing an Aadhaar Data Vault?
Cryptographic devices like HSMs are certified for security on 4 levels of the Federal Information Processing Standards (FIPS). The 140 series of FIPS are the U.S. Government’s computer security standards that specify requirements for cryptography modules. At present, FIPS 140-2 is the most widely considered parameter for HSM devices.
While the UIDAI has not mandated FIPS 140-2 Level 2 or FIPS 140-2 Level 3 certified HSM devices for Aadhaar Data Vault, we recommend you to go for HSM devices with the highest security certification to ensure optimal security of the sensitive information in your Aadhaar Data Vault.
5. Who are the leading HSM Vendors in India?
Gemalto and Thales are the market leaders in the HSM segment. Other prominent vendors in India are Ultimaco, KEMP, Kryptoagile and Futurex.
6. How much do HSM devices cost?
The cost of HSM devices vary as per the usage requirement. Since the performance of a HSM device is evaluated basis Transactions Per Second (TPS), higher the TPS, higher the cost.
Below is an indicative pricing for the various types of HSMs:
1) USB HSMs: Approximately Rs. 2,000/-
2) Network HSMs: Between Rs. 15 – 16 lacs
3) PCI HSMs: Between Rs. 5 – 6 lacs.
7. How to choose the right HSM Vendor?
As there is no stark difference in the functionalities of HSM devices of various brands, we suggest you choose a vendor who provides local support in India. As per our knowledge, Gemalto and Thales are the two vendors that provide the best support in India so far.
We hope we have answered your questions on HSMs for your Aadhaar Data Vault implementation. If you have any further questions, please feel free to get in touch with our colleague Amit Joshi on 09820875525 / 07208155528 or email him on amit@eastcs.com.