Own the keys, not the HSM
nShield as a Service is a subscription-based solution for generating, accessing, and protecting cryptographic key material, separately from sensitive data, using dedicated FIPS 140-2 Level 3 certified nShield Connect HSMs. The solution delivers the same functionality as on-premises HSMs and the benefits of a cloud service deployment, without the need to host and maintain the appliances.
Ready for migration or a mixed approach
Because nShield as a Service benefits from the same unique Security World architecture as on-prem nShield deployments, you can easily migrate your cryptographic operations from on-prem to the cloud or use a hybrid approach, mixing both cloud-based and on-prem nShield HSMs.
nShield as a Service Benefits
Advance your cloud-centric strategies with FIPS 140-2 Level 3 protection for your business-critical apps and data.
Our Security World architecture lets you scale HSM operations and access secure crypto functionality from anywhere.
The CodeSafe secure execution capability provides on-demand access to your organization's secure, sensitive code protected inside the HSM.
Tech Specs
Connectivity
- IPsec tunnel w/ pre-shared keys
- Between customer Cloud IP space(s) and dedicated, managed nShield HSM environment
- Transparent to client hosts
- Takes entire path out of control scope
Certified Hardware Solutions
nShield as a Service is built with nShield Connect XC HSMs, which help our customers to demonstrate compliance while also giving them the assurance that their HSMs meet stringent industry standards.
nShield Features
nShield as a Service delivers the same features as on-premises nShield HSMs, including CodeSafe, Web Services Option Pack, and Database Option Pack.
Security Compliance
- FIPS 140-2 Level 3
- Common Criteria Certification against EN 419 221-5 Cryptographic Module for Trust Services
Safety and Environmental Standards Compliance:
- UL, CE, FCC, RCM, Canada ICES
- RoHS2, WEEE
Data Center Certifications
Cloud Security Alliance (CSA) Security Trust Assurance and Risk (STAR) - Level 1
High Transaction Rates
nShield as a Service features high elliptic curve cryptography (ECC) and RSA transaction rates. ECC, one of the most efficient cryptographic algorithms, is particularly favored where high speed and lower processing power are important.
RSA Signing Performance for NIST Recommended Key Lengths
- 2048
- 8600 tps
- 4096
- 2025 tps
ECC Prime Curve Signing Performance for NIST Recommended Key Lengths
- 256 bit
- Up to 14,400 tps
Wide Support for APIs, Cryptographic Algorithms and Platforms
Supported APIs
- PKCS#11, OpenSSL, Java (JCE), Microsoft CAPI/CNG and Web Services
Supported Cryptographic Algorithms
- Asymmetric public key algorithms: RSA, Diffie-Hellman, ECMQV, DSA, KCDSA, ECDSA, ECDH, Edwards (X25519, Ed25519ph), Secp256k1,
- Symmetric algorithms: AES, AES-GCM, ARIA, Camellia, CAST, RIPEMD160 HMAC, SEED, Triple DES
- Hash/message digest: SHA-1, SHA-2 (224, 256, 384, 512 bit), HAS-160
- Full Suite B implementation with fully licensed ECC including Brainpool and custom curves
nShield HSMs offers support for the majority of these cryptographic algorithms as part of the standard feature set. For organizations wishing to use ECC or South Korean algorithms, optional activation licenses are needed.
Supported Platforms
Microsoft Windows and Linux operating systems including distributions from RedHat, SUSE, and major cloud service providers running as virtual machines or in containers.