Want a Faster Payment HSM(Hardware Security Module)?

HSMs are primarily focused on security but they also need to be fast. Crypto operations are very demanding operations and require important processing power.

Crypto processors used by the HSMs are fast because the cryptographic routines are implemented in the hardware directly but they need to cope with an eventual high-volume of requests.

Here we look at the AT1000 and check what it takes to be a fast payment HSM.

The Factors to Consider for an HSM to be Fast

HSMs are modern digital computers so the factors that impact their speeds will be generally the factors that impact a modern digital computer speed plus other factors related to cryptography.

Fast Operating System

An HSM has no ‘ordinary’ operating system. There must be a guarantee that it cannot be infected by computer viruses, trojans, or malware.

This prevents the usage of operating systems such as Windows, Linux, or OsX – at least in their “normal” versions.

An operating system may slow down a computer. For instance, if many services are launched at startup or if some module from the OS needs to perform some costly background tasks like backups, updates, etc.

Many ATMs for instance are equipped with windows embedded or Windows XPE. Usually, these OS will run from a read-only media and copy themselves in a RAM drive, to get maximal speed.

A very fast Operating System is an operating system that is built from sources so as to prevent performance issues. That way everything can be tailored and only what is needed by the HSM can be kept.

There are several ways to do this such as using the Platform builder and similar tools to build a Windows Embedded OS or to use the “Linux From Scratch” project to make a dedicated distribution of Linux.

The HSM may have no operating system at all but a firmware (e.g a BIOS) loaded in ROM.

When buying a new HSM, one may want to question the vendor about the nature of the operating system (or firmware).

Important Amount of RAM

Ram is a key factor for an HSM to work fast. Ideally, only physical RAM should be used. HSMs typically use different sorts of RAM such as Non-volatile RAM, DDRAM, etc.

These memory modules should have enough capacity to handle a large number of operations.

Again, make sure the HSM has important RAM because with the years coming, HSM may have to act with more demand and may have to process more operations and so it may be adequate to make sure the amount of RAM will be enough.

CPU Power

As we mentioned, an HSM is a digital computer like the others. If it is equipped with a “weak” CPU it will perform poorly.

Also, recall that the CPU must perform well – same as with the RAM – during all the lifetime of the HSM and eventually having to support the increasing demand for operations.

Therefore make sure the CPU is adequate and do not hesitate to question the vendor about this. What kind of CPU is it? What kind of architecture? (X86, ARM, Risc-V, etc.)

Does the CPU need a fan or a cooling device in general?

Crypto-CPU Power

The crypto-processor of HSMs allows a significant offload when it comes to ciphering/deciphering and especially for asymmetric cryptography.

The crypto-processors are performing RSA or Elliptic curves encryption/decryption in the processor itself. Crypto-processors are generally perceived as accelerating cryptographic operations.

These processors can also come with various architectures: MIPS or ARM for instance and they can use either FPGA or ASIC hardware.

Their power is measured by the quantity of ciphering/deciphering that they can perform by seconds, for a given algorithm of course.

It is a good idea to ask for a benchmark of the capacities of the crypto-processor of the HSM.

Here is a typical example of such a benchmark.

In general, you should not ‘only’ look at the amount of RSA 2048 bits signature power seconds which is, sometimes, considered as the norm for computing HSM performances but you should ask for detailed speeds about a wide range of cryptographic operations such as:

Also keep in mind that the Transactions per second are theoretical ones, e.g. without any ‘external’ latency, so you have to find independent benchmarking studies of HSM (which is not so easy to find) in real-use cases.

Network and I/O

Finally, the speed of the HSM depends also greatly on the I/O operations and especially the network speed. An HSM should be ideally configured with a network latency of 0.5 ms.

Ask also the vendor about the type of disk storage used, SSD or Flash for instance, and the overall I/O performances.

Make sure you buy a “beast” and not a weak HSM which will not perform fast enough for your ever-increasing demanding operations.

Are you using TLS or IPSEC to access the HSM? TLS will increase dramatically the time needed to access the HSM while IPSEC will provide extremely fast and secure access.

Of course, only one of these two methods may be used since access to HSM must be done securely unless you consider proprietary accesses with custom ciphers which are extremely rare among HSM vendors.

A Comparison Among HSM Vendors

Keyblocks are fundamental for HSm in general, in the banking context.

The measurement of the speed of such translation is done in terms of PTS (PIN translation per second). It reveals how much an HSM can translate such key blocks from others by second.

Of course, speed is essential in the context of payment networks, and financial organizations operating a network of ATMs must care for the right speed.

For example, a bank operating 500 ATMs and financial terminals connected to an HSM must care that the HSM has enough PTS speed in case all the 500 devices are used by customers at the same time.

A financial transaction will not generally be limited to one translation.

If that HSM has a PTS of – say – 100 translation per second, then it will take up to 5 seconds for customers to receive an answer from their issuing bank.

When added to other time-consuming processing operations, typically the answer/response authorization mechanism from the issuing bank, this may create inordinate transaction times.

If V is the PTS then a PIN translation is done in a time of T=1/V seconds. Hence, the bigger the PTS is, the faster the translation will be. For example with the AT-1000 and a PTS of 10,000 PIN translate per second, a PIN can be translated in less than a millisecond!

Here are some comparison among HSM vendors regarding the pin translation per second.

Here we see some of the main HSM providers on the market. The Pin translation per second varies between the model they offer.

Of course in general the greater the pin translation per second is, the greater the price is.

Conclusion

We aimed here at giving some tips for those who wish to acquire a modern and fast HSM. It is a good practice to enquire about hardware specifications of the HSM and make sure it is fast and will stay fast during its lifetime.

You are buying an expensive product, you have the right and should enquire about its detailed specifications so to make sure that you’re buying a fast HSM.

Acodez is a renowned  website design company in India , offering Emerging Technology Services to our clients across the globe. We offer all kinds of web design and web development services to our clients using the latest technologies. We are also a leading digital marketing company providing SEO, SMM, SEM, Inbound marketing services, etc at affordable prices. For further information, please contact us.