Cloud Hardware Security Module (HSM) is a cloud-based hardware encryption service built on hardware security modules certified by the State Cryptography Administration or validated to FIPS 140-3 Level 3. You can manage cryptographic keys, perform encryption and decryption, and meet regulatory compliance requirements without maintaining physical HSM hardware.
Overview
Cloud HSM is built on hardware security modules certified by the State Cryptography Administration or validated to FIPS 140-3 Level 3. By using virtualization technology, Cloud HSM helps you meet regulatory compliance requirements for data security and protect the privacy of your cloud business data. With Cloud HSM, you can securely manage keys and use various encryption algorithms to perform reliable encryption and decryption operations. Cloud HSM can help you perform the following cryptographic operations:
Generate, store, import, export, and manage symmetric keys and asymmetric key pairs.
Encrypt and decrypt data using symmetric and asymmetric algorithms.
Compute message digests and hash-based message authentication codes (HMACs) using hash functions.
Digitally sign data and verify signatures.
Generate cryptographically secure random data.
Cloud HSM provides technical consulting services for device initialization, cluster configuration, monitoring, and SDK integration, and supplies commercial cryptography product certification certificates for HSM devices. It does not provide detailed documentation from third-party commercial cryptography application security assessment agencies. For more information, contact Alibaba Cloud public cloud commercial cryptography assessment service.
HSM devices
Cloud HSM is a virtualized resource provisioned from the hardware cryptographic module of an HSM device. Cloud HSM has the same compliance as the hardware cryptographic module and can encrypt and decrypt data. Cloud HSM provides virtual security modules (VSMs) and dedicated HSMs. For detailed parameters of HSM devices, see Performance data of virtual cryptographic machines.
Virtual security module (VSM)
Deployed in a multi-tenant environment where hardware resources are shared among multiple users. VSMs meet the requirements of the PRC Cryptography Law and the FIPS 140-3 Level 3 certification. Suitable for small and medium-sized businesses or scenarios with moderate performance requirements. Supported VSM types:
Chinese mainland VSMs: General SM-compliant VSM.
Outside the Chinese mainland: General FIPS-compliant VSM.
Dedicated HSM
Hardware resources are exclusively used by a single tenant. Dedicated hardware resources ensure high throughput and low latency. Provides the highest level of physical security with tamper-resistant design, compliant with FIPS 140-3. Suitable for large enterprises, financial institutions, or scenarios that require the highest level of security and performance. Provides physically dedicated HSMs certified by authoritative organizations (State Cryptography Administration/NIST (FIPS 140-3 Level 3)/PCI HSM v3).
Use cases
Migrate on-premises HSM workloads to cloud
When migrating data center HSM workloads to Elastic Compute Service (ECS), replace on-premises hardware with Cloud HSM for encryption, decryption, signing, and signature verification to protect your cloud data.
Provide compliant encryption and decryption for encryption applications
For example, you can use Cloud HSM with Alibaba Cloud Dedicated KMS to encrypt and decrypt sensitive application data, with database encryption applications to encrypt and decrypt database data, and with file encryption applications to encrypt and decrypt file storage.
SSL offloading for HTTPS websites
GVSMs in the Chinese mainland support SSL offloading, reducing server CPU load and improving client response times. Cloud HSM also generates certificate private keys, strengthening private key protection and preventing private key leakage from servers.
Protect certificate private keys
For digital certificates issued by certification authorities (CAs), you can store certificate private keys in HSMs and use HSMs for signing operations to protect your certificate private keys.
Oracle TDE integration
Cloud HSM integrates with Oracle databases to provide Transparent Data Encryption (TDE). TDE stores encryption keys in HSMs outside the database and uses the keys to encrypt sensitive data in database files, ensuring the security of sensitive data.
Encrypt sensitive data
In public services, e-commerce, and financial industries, you can integrate Cloud HSM with your applications to encrypt or store sensitive user data to meet security and compliance requirements.
Benefits
Regulatory compliance
VSMs in the Chinese mainland are certified by the State Cryptography Administration and comply with cryptographic industry technical specifications, including GM/T 0028-2014 (Security Requirements for Cryptographic Modules) and GM/T 0030-2014 (Specification for Server Cryptographic Machine).
VSMs outside the Chinese mainland are validated to FIPS 140-3 Level 3.
Industry-standard interfaces and encryption algorithms
Cloud HSM supports a wide range of industry-standard interfaces and encryption algorithms. For more information about the interfaces and algorithms supported by Cloud HSM, see Performance data of virtual cryptographic machines.
Secure key management
Device management and key management are separated. Alibaba Cloud can only manage HSM hardware devices, including monitoring device availability metrics and enabling services. Keys are entirely managed by customers. Alibaba Cloud has no way to access customer keys.
Elastic scaling
When using Cloud HSM, you can flexibly adjust the number of HSMs deployed based on actual needs, and use load balancing to meet different encryption and decryption requirements.
Cluster high availability
Cloud HSM supports cluster management. You can add multiple HSMs to a cluster to quickly increase the high availability of HSMs, reducing the risk of service interruption and core data loss.
Convenient cloud usage
With Cloud HSM, you can deploy HSMs in your specified VPC and manage and access them through private IP addresses, seamlessly integrating with your business on cloud servers.
Supported regions and zones
The Chinese mainland
Region
Region ID
Zone
China (Hangzhou)
cn-hangzhou
Zone A, Zone G
China (Shanghai)
cn-shanghai
Zone A, Zone B, Zone F
China (Beijing)
cn-beijing
Zone A, Zone F, Zone K
China (Shenzhen)
cn-shenzhen
Zone A, Zone E
China (Chengdu)
cn-chengdu
Zone A, Zone B
China (Heyuan)
cn-heyuan
Zone A, Zone B
Outside the Chinese mainland
Region
Region ID
Zone
China (Hong Kong)
cn-hongkong
Zone B, Zone C
Singapore
ap-southeast-1
Zone A, Zone B
Malaysia (Kuala Lumpur)
ap-southeast-3
Zone A, Zone B
SAU (Riyadh - Partner Region)
me-central-1
Zone A, Zone B
Indonesia (Jakarta)
ap-southeast-5
Zone A, Zone B
Key concepts
HSM instance
An HSM instance is a virtualized resource provisioned from the hardware cryptographic module of an HSM device. HSM instances have the same compliance as the hardware cryptographic module and can implement all features of Cloud HSM, including data encryption and decryption.
Authentication card (USB Key)
A unique identifier for a Cloud HSM instance, used with the HSM client management tool to manage keys. Available only for HSMs in the Chinese mainland.
Cluster service
Cloud HSM provides cluster services. By grouping HSM instances across zones in the same region that serve the same application, you can centrally manage them and provide high availability, load balancing, and horizontal scalability for cryptographic operations. A cluster includes one master HSM instance and multiple non-master HSM instances. HSM instances in the same zone share the same subnet.