{"id":19034,"date":"2023-03-23T18:31:27","date_gmt":"2023-03-23T13:01:27","guid":{"rendered":"https:\/\/www.cigniti.com\/blog\/?p=19034"},"modified":"2023-03-23T22:15:27","modified_gmt":"2023-03-23T16:45:27","slug":"cloud-hardware-security-module-payment-applications","status":"publish","type":"post","link":"https:\/\/www.cigniti.com\/blog\/cloud-hardware-security-module-payment-applications\/","title":{"rendered":"Overview of Cloud Hardware Security Module for Payment Applications"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><p>[vc_row][vc_column][vc_column_text css=&#8221;&#8221;]A hardware security module (HSM) is a tamper-resistant physical computing device that safeguards and manages digital keys, performs encryption and decryption functions for digital signatures, and provides strong authentication and other cryptographic functions. HSM has mature technology that is highly available, scalable, and usable. These modules traditionally come as a plug-in card or an external device that attaches directly to a computer or a network server.<\/p>\n<p>For payment applications, HSMs&#8217; functionality can be classified into three categories: acquiring, issuing, and Point-to-point encryption (P2PE).<\/p>\n<h4><strong>For acquiring, which is carried out between merchants and banks, the functions of the Payment Hardware Security Module are<\/strong>:<\/h4>\n<ul>\n<li>Personal Identification Number (PIN) translation, verification, and validation<\/li>\n<li>Card Verification Value (CVV) generation and validation as per card brands (Visa, Mastercard, AMEX, Discover, and so on)<\/li>\n<li>EMV \u2013 Authorization Request Cryptogram (ARQC) Validation and Authorization Response Cryptogram (ARPC) generation<\/li>\n<li>Message Authentication Code (MAC) and Cipher-based message authentication code (CMAC) generation and verification<\/li>\n<li>Network Key Exchange and key management using essential derivation methods \u2013 DUKPT, ISO 800-108<\/li>\n<li>Data encryption for <a href=\"https:\/\/www.cigniti.com\/blog\/mobile-payment-revolution-test\/\"  data-wpil-monitor-id=\"134\">Mobile payment<\/a> acceptance \u2013 Google Pay, Apple Pay, Samsung Pay<\/li>\n<\/ul>\n<h4><strong>On the issuing side, where the focus is on issuing cards and tokens, the Payment Hardware Security Modulefunctionality includes<\/strong>:<\/h4>\n<ul>\n<li>PIN generation<\/li>\n<li>Online and mobile PIN translation and management<\/li>\n<li>EMV key generation and derivation for card personalization<\/li>\n<li>Generating data (PVV, CVV) for a magnetic stripe card<\/li>\n<li>Mobile payment token issuance for Google Pay, Apple Pay, and Samsung Pay<\/li>\n<li>Verify that a user-entered PIN matches the reference PIN known to the card issuer<\/li>\n<li>Card, cardholder, and cryptogram validation during chip payment transaction processing<\/li>\n<li>Payment credential issuance for payment cards, wearables used for payments, and <a href=\"https:\/\/www.cigniti.com\/blog\/implementing-the-right-mobile-application-testing-strategy-2\/\"  data-wpil-monitor-id=\"135\">mobile applications<\/a><\/li>\n<li>Tokenization of EMV payment transaction data<\/li>\n<\/ul>\n<h4><strong>For P2PE, that is, Point-to-Point Encryption, to transmit cardholder data securely from the point of sale to the merchant host, the Payment Hardware Security Module is used for<\/strong>:<\/h4>\n<ul>\n<li>Point-to-point essential management lifecycle<\/li>\n<li>Sharing keys securely with third parties to facilitate secure communication<\/li>\n<li>Cardholder data decryption<\/li>\n<li>Cardholder data translation to processor-specific data formats<\/li>\n<\/ul>\n<p>Cloud HSM is a cloud-hosted hardware security module (HSM) service that allows hosting encryption keys and performing cryptographic operations in a Federal Information Processing Standard (FIPS) 140-2 Level 3 certified hardware cluster. Cloud hardware security modules (HSMs) deliver the same functionality as on-premises HSMs with the benefit of a cloud service deployment. It removes the need to host and maintain on-premises appliances.<\/p>\n<h3><strong>Cloud HSMs allow organizations to<\/strong>:<\/h3>\n<ul>\n<li>Align crypto security requirements with the organization\u2019s cloud strategy<\/li>\n<li>Support finance and procurement preference to shift from a capital expenditure to an operational expenditure model<\/li>\n<li>Meet high assurance security and compliance mandates for FIPS 140-2 and Common Criteria Evaluation Assurance Level (EAL)4+<\/li>\n<\/ul>\n<p>Payment HSMs are certified to meet stringent security and compliance requirements established by the Payment Card Industry Security Standards Council (PCI SSC), including PCI Data Security Standards (PCI DSS), PCI 3DS, PCI PIN, FIPS 40-2 Level 3, and PCI HSM v3.<\/p>\n<p>Payment Applications, whether running on-premises or in a cloud services environment, can securely connect to cloud payment HSMs; that is, they can operate in a hybrid or full cloud model, respectively.<\/p>\n<p>The benefits of hosting HSM in the cloud include complete flexibility, customizability, and reduced cost, as well as maintaining a high standard of hardware security and encryption capabilities.<\/p>\n<p>A few cons of using a cloud HSM include network latency, the cloud&#8217;s immaturity, and the difficulty of ensuring physical security.<\/p>\n<h3>Are Cloud HSMs as secure as on-premises HSMs?<\/h3>\n<p>Security in the cloud is different from security on-premises, but it is not as bad. The threat model and residual risks are different. With on-premises, the risks are perhaps easier to identify\u2014physical attacks, theft, disruption to utilities, network security considerations, firewall, malware, Distributed Denial-of-Service (DDOS), and so on.<\/p>\n<p>With cloud service providers, security is required for server farms and network infrastructure. The most successful attacks in the public cloud have been due to customer misconfiguration, mistakes, and mismanagement, not due to the service providers providing the cloud HSM.<\/p>\n<p>Companies providing Cloud HSM offer it as a \u201cManaged HSM\u201d or \u201cHSM as a Service.\u201d This allows users to generate encryption keys, use them, and store them securely without worrying about time-consuming things like evaluation, setup, maintenance, and updating their own HSM. Experienced experts take care of it.<\/p>\n<p>Azure, Thales, Securosys, and Google are a few companies that provide Cloud HSM as a Service. These companies are fully responsible for configuring and maintaining the HSM. When the HSM is no longer required, and the device is returned, customer data is erased to ensure privacy and security.<\/p>\n<p>Most companies offer single-tenant HSMs, and full remote management capabilities and administrative control are provided entirely to the payment solution provider.<\/p>\n<p>Infrastructure as a Service provider also offers to host and cloud HSMs based either on their own HSM technology or a third-party vendor\u2019s HSM solution, such as Entrust\/nCipher, Thales, and Utimaco. When using cloud HSMs which are provided by public cloud providers, operational burdens are significantly reduced. Networking infrastructure is simpler, onboarding is fast, establishing multi-cloud and multi-region high availability is immediate, and operational tasks like invoicing and payments can be built on top of the organization\u2019s existing public cloud account management structure.<\/p>\n<p>A comparison of Cloud-based HSM provided by a Cloud Service Provider and On-Premises HSM from the perspective of an organization that wants to implement HSM is tabularized below:<\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"420\"><strong><em>Comparison Criteria<\/em><\/strong><\/td>\n<td width=\"390\"><strong><em>Cloud-based HSM<\/em><\/strong><\/td>\n<td width=\"420\"><strong><em>On-Premises HSM<\/em><\/strong><\/td>\n<\/tr>\n<tr>\n<td width=\"420\">Hardware<\/td>\n<td width=\"420\">No hardware required<\/td>\n<td width=\"420\"># Of hardware required \u2013 for resiliency, high availability, Management<\/td>\n<\/tr>\n<tr>\n<td width=\"420\">Payment Model<\/td>\n<td width=\"420\">Pay as you go<\/td>\n<td width=\"420\">Upfront Cost<\/td>\n<\/tr>\n<tr>\n<td width=\"420\">Setup<\/td>\n<td width=\"420\">Easy<\/td>\n<td width=\"420\">Complex<\/td>\n<\/tr>\n<tr>\n<td width=\"420\">Software Cost<\/td>\n<td width=\"420\">Included in the cost<\/td>\n<td width=\"420\">Licenses may be required for each partition and software<\/td>\n<\/tr>\n<tr>\n<td width=\"420\">Deployment<\/td>\n<td width=\"420\">Easy with Cloud Service Providers documentation<\/td>\n<td width=\"420\">Complex and skill-dependent<\/td>\n<\/tr>\n<tr>\n<td width=\"420\">Compliance<\/td>\n<td width=\"420\">Responsibility of Cloud Service Provider (CSP)<\/td>\n<td width=\"420\">Responsibility of the organization<\/td>\n<\/tr>\n<tr>\n<td width=\"420\">Operational Overhead<\/td>\n<td width=\"420\">Low, as it is provided by CSP<\/td>\n<td width=\"420\">High, as it is managed by the organization<\/td>\n<\/tr>\n<tr>\n<td width=\"420\">Service Level Agreements<\/td>\n<td width=\"420\">Responsibility of CSP<\/td>\n<td width=\"420\">Responsibility of the organization<\/td>\n<\/tr>\n<tr>\n<td width=\"420\">Operational Technical Knowledge<\/td>\n<td width=\"420\">Medium, as available from CSP\u2019s documentation &amp; vendor support<\/td>\n<td width=\"420\">High, as it is managed by the organization<\/td>\n<\/tr>\n<tr>\n<td width=\"420\">Cost of Ownership<\/td>\n<td width=\"420\">Low<\/td>\n<td width=\"420\">High specifically for a low number of partitions<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<h3>How can Cloud HSMs be connected to payment applications?<\/h3>\n<p>Cloud HSMs offer REST API or a wide range of API software\/ libraries installed on the application server to ensure communication with the HSM and provide automatic failover and load balancing. APIs like REST, JCE\/JCA, PKCS#11, and Microsoft CNG are supported by Cloud HSM providers for connecting to payment applications.<\/p>\n<p>One of the most significant hurdles in moving payment systems to the public cloud is payment HSM configuration and support in the public cloud. Connecting to cloud HSM from existing on-premises payment applications also needs proper planning, implementation, and integration.<\/p>\n<p>Cigniti\u2019s certified cloud professionals can provide you with consultancy and advisory services to set up the cloud HSM as per the needs of your application. The Security CoE team can ensure the proper functionality of the setup through their Infra and Network tests and <a href=\"https:\/\/www.cigniti.com\/services\/security-assurance\/\">Security assurance<\/a>.<\/p>\n<p>Need help? Talk to our certified cloud professionals to learn more about <a href=\"https:\/\/www.cigniti.com\/services\/cloud-migration-assurance\/\">cloud migration<\/a> or cloud HSM setup.[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>[vc_row][vc_column][vc_column_text css=&#8221;&#8221;]A hardware security module (HSM) is a tamper-resistant physical computing device that safeguards and manages digital keys, performs encryption and decryption functions for digital signatures, and provides strong authentication and other cryptographic functions. HSM has mature technology that is highly available, scalable, and usable. These modules traditionally come as a plug-in card or an [&hellip;]<\/p>\n","protected":false},"author":20,"featured_media":19038,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4316,136],"tags":[4658,3594,3786,3593,271,4657,2610,4656],"ppma_author":[3966],"authors":[{"term_id":3966,"user_id":0,"is_guest":1,"slug":"payel-ghosh","display_name":"Payel Ghosh","avatar_url":{"url":"https:\/\/www.cigniti.com\/blog\/wp-content\/uploads\/Payel-Ghosh.jpg","url2x":"https:\/\/www.cigniti.com\/blog\/wp-content\/uploads\/Payel-Ghosh.jpg"},"user_url":"","last_name":"Ghosh","first_name":"Payel","job_title":"","description":"Payel Ghosh has 18 years of experience in diverse technology projects in the banking and payments domain. She has rich experience and knowledge in the payments value chain and in-depth subject matter expertise in payment processing. Payel is a consultant with Cigniti's BFSI Practice and Centers of Excellence that focuses on building deep domain competence and developing solutions for the challenges faced by the industry."}],"_links":{"self":[{"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/posts\/19034"}],"collection":[{"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/comments?post=19034"}],"version-history":[{"count":0,"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/posts\/19034\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/media\/19038"}],"wp:attachment":[{"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/media?parent=19034"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/categories?post=19034"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/tags?post=19034"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.cigniti.com\/blog\/wp-json\/wp\/v2\/ppma_author?post=19034"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}