Discovery and attestation of hardware security modules
Approaches presented herein relate to the providing of cryptographic-related functionality using shared computing resources. A fleet of hardware security modules (HSMs) can be similarly configured such that requests to perform cryptography-related tasks can be routed to any of the HSMs in the fleet. Additional HSMs can be connected, and those HSMs can be automatically discovered and authenticated, such as by requesting responses to challenge questions along with identifying information such as an expected serial number. Once a server can attest to the HSM as a trusted resource, a provisioning workflow can be initiated to configure the HSM and provide the appropriate keys so the HSM can be routed requests as part of the fleet. Multiple users may then have requests processed by the fleet as part of a security-related service offering.
1 . A computer-implemented method, comprising:
providing a plurality of hardware security modules to perform a set of cryptographic tasks as part of a secure data processing service, the secure data processing service provided using a network of computing resources;
receiving a discover packet from an additional hardware security module connected to the network of computing resources;
transmitting, in response to receiving the discover packet, a request to the additional hardware security module for attestation information;
receiving, in response to the request and from the additional hardware security module, the attestation information, the attestation information including at least a predetermined identifier and a challenge question response;
determining that the attestation information includes expected values for the predetermined identifier and the challenge question response;
initiating a provisioning workflow for the secure data processing service, the provisioning workflow including configuring the additional hardware security module to satisfy one or more requirements for the set of cryptographic tasks and providing one or more master keys to the additional hardware security module;
assigning a communication address to each of a pair of communication ports of the additional hardware security module; and
providing additional hardware security module as available to perform the set of cryptography tasks using the one or more master keys as part of the secure data processing service, wherein a subsequent request to perform one of the cryptographic tasks is allowed to be routed to either communication address of the additional hardware security module or another hardware security module of the plurality of hardware security modules.
2 . The computer-implemented method of claim 1 , wherein the set of cryptographic tasks relate to electronic payments, and wherein the one or more requirements for the set of cryptographic tasks correspond to requirements for performing tasks relating to the electronic payments.
3 . The computer-implemented method of claim 1 , wherein the attestation information further includes a timestamp, and wherein determining that the attestation information includes expected values includes determining that the timestamp is in a time window between when the request for the attestation information was sent and a time when the response with the attestation information was received.
4 . The computer-implemented method of claim 1 , wherein the communication addresses are Internet protocol (IP) addresses assigned by a dynamic host configuration protocol (DHCP) server of the secure data processing service.
5 . The computer-implemented method of claim 4 , wherein the pair of communication ports are connected to the DHCP server using at least two switches and at least two communication channels, and wherein the DHCP server is allowed to re-route the subsequent request using any of the pair of communication ports, the at least two switches, and the at least two communication channels.
6 . A computer-implemented method, comprising:
receiving a discover packet from secure hardware device connected to a set of hardware resources;
transmitting, in response to receiving the discover packet, a request to the secure hardware device for attestation information;
receiving, in response to the request and from the secure hardware device, the attestation information, including at least a predetermined identifier of the secure hardware device and a challenge question response generated by the secure hardware device in response to the request;
determining that the attestation information includes one or more expected attestation values corresponding to the predetermined identifier and the challenge question response;
assigning at least one communication address to the secure hardware device; and
provisioning the secure hardware device to receive, using the at least one communication address, requests to perform cryptography-related tasks as part of the set of hardware resources.
7 . The computer-implemented method of claim 6 , further comprising:
initiating, in response to determining that the attestation information includes one or more expected attestation values, a provisioning workflow for the secure hardware device, the provisioning workflow including configuring the secure hardware device to satisfy one or more requirements for the cryptography-related tasks and providing one or more master keys to the secure hardware device.
8 . The computer-implemented method of claim 7 , wherein the cryptography-related tasks including at least encrypting, decrypting, or authenticating data using one or more of the master keys scored to the secure hardware device.
9 . The computer-implemented method of claim 6 , wherein the secure hardware device is a hardware security module (HSM).
10 . The computer-implemented method of claim 9 , further comprising:
adding the HSM to an existing fleet of HSMs, wherein requests to perform the cryptography-related tasks are allowed to be directed to any of the HSMs in the fleet.
11 . The computer-implemented method of claim 10 , wherein
the fleet of HSMs is provided to perform the cryptography-related tasks as part of a security-related service provided using a set of shared resources.
12 . The computer-implemented method of claim 6 , wherein the attestation information includes at least one of an expected serial number of the secure hardware device, a challenge question response, or a timestamp within an expected time window.
13 . The computer-implemented method of claim 6 , wherein the at least one communication address is assigned using a dynamic host configuration protocol (DHCP) server.
14 . The computer-implemented method of claim 6 , wherein a load balancer is allowed to balance incoming requests across one or more DHCP servers, a number of the one or more DHCP servers allowed to scale over time.
15 . The computer-implemented method of claim 6 , wherein the secure hardware device includes two communication ports, and wherein a communication address is automatically assigned to each of the two communication ports of the secure hardware device after determining that the attestation information includes one or more expected attestation values.
16 . A system, comprising:
a processor; and
memory including instructions that, when executed by the processor, cause the system to:
receive a discover packet from a secure hardware device connected to a set of hardware resources;
transmit, in response to receiving the discover packet, a request to the secure hardware device for attestation information;
receive, in response to the request and from the secure hardware device, the attestation information, including at least a predetermined identifier of the secure hardware device and a challenge question response generated by the secure hardware device in response to the request;
determine that the attestation information includes one or more expected attestation values corresponding to the predetermined identifier and the challenge question response;
assign at least one communication address to the secure hardware device; and
provision the secure hardware device to receive, using the at least one communication address, requests to perform cryptography-related tasks as part of the set of hardware resources.
17 . The system of claim 16 , wherein the instructions when executed further cause the system to:
initiate, in response to determining that the attestation information includes one or more expected attestation values, a provisioning workflow for the secure hardware device, the provisioning workflow including configuring the secure hardware device to satisfy one or more requirements for the cryptography-related tasks and providing one or more master keys to the secure hardware device.
18 . The system of claim 16 , wherein the secure hardware device is a hardware security module (HSM), and wherein the instructions when executed further cause the system to:
adding the HSM to an existing fleet of HSMs, wherein requests to perform the cryptography-related tasks are allowed to be directed to any of the HSMs in the fleet.
19 . The system of claim 18 , wherein the fleet of HSMs is provided to perform the cryptography-related tasks as part of a security-related service provided using a set of shared resources.
20 . The system of claim 16 , wherein the attestation information includes at least one of an expected serial number of the secure hardware device, a challenge question response, or a timestamp within an expected time window.