Hardware blockchain acceleration

1. A method comprising:

in a hardware security system:

establishing a communication connection with a hardware security module (HSM) of each of a plurality of respective nodes;

responsively invoking security controller circuitry to process chaincodes supporting implementation of a data storage layer for each of the respective nodes, the security controller circuitry comprising:

an HSM interface that includes:

a security circuitry application programming interface (API); and

an API-to-API mapping;

receiving, at the security controller circuitry, a security function call made to the security circuitry API of each of the respective nodes;

calling the chaincodes to update respective nodes identified with the security function call, the identified respective nodes comprising a sender node and a receiver node;

mapping the security function call to an HSM specific function call for a respective HSM of each of the sender node and the receiver node, the mapping performed via the API-to-API mapping;

transmitting the HSM specific function call to the respective HSM of each of the sender node and the receiver node; and

receiving a security response from the respective HSM of each of the sender node and the receiver node, the security response received over the communication connection, and the security response received in response to the HSM specific function call.

2. The method of claim 1 , further comprising:

exposing, with the security function call, a respective security function in the security circuitry API of the sender node and the receiver node.

3. The method of claim 1 , further comprising:

exposing, with multiple security function calls, multiple respective security functions in the security circuitry API of the sender node and the receiver node;

the multiple respective security functions within a predetermined set of security functions for each of the sender node and the receiver node; and

the multiple security function calls including:

a data encryption function call; and

a data decryption function call.

4. The method of claim 1 , further comprising:

exposing, with multiple security function calls, multiple respective security functions in the security circuitry API for each of the sender node and the receiver node;

the multiple respective security functions within a predetermined set of security functions; and

the multiple security function calls including:

a signature application function call; and

a signature verification function call.

5. The method of claim 1 , further comprising:

exposing, with multiple security function calls, multiple respective security functions in the security circuitry API for each of the sender node and the receiver node;

the multiple respective security functions within a predetermined set of security functions; and

the multiple security function calls including:

a key pair generation function call.

6. The method of claim 1 , where:

the API-to-API mapping implements a redirection of the security function call to the HSM specific function call for the respective HSM of each of the sender node and the receiver node.

7. The method of claim 1 , where:

the API-to-API mapping implements redirection of the security function call to the HSM specific function call for the respective HSM of each of the sender node and the receiver node; and

the API-to-API mapping also implements redirection of a different security function call to a software process.

8. The method of claim 1 , where:

the respective HSM is one of multiple different HSMs of each of the sender node and the receiver node, the multiple different HSMs in communication with the security controller circuitry of the respective sender node and the receiver node; and

the HSM interface is one of multiple HSM interfaces assigned to the different HSMs.

9. The method 1 , further comprising:

loading a configuration file that defines the API-to-API mapping for the respective HSM of each of the sender node and the receiver node.

10. The method of claim 1 , wherein transmitting the HSM specific function call comprises requesting the sender node and the receiver node to each independently execute predetermined security functions based on the HSM specific function call.

11. A security system comprising:

a communication interface configured to connect to a hardware security module (HSM) of each of a plurality of respective nodes;

an HSM interface of each of the respective nodes, the HSM interface comprising:

a security circuitry programming interface (API); and

an API-to-API mapping; and

security controller circuitry configured to:

receive, at the security controller circuitry, a security function call made to the security circuitry API of each of the respective nodes;

dynamically invoke chaincodes to update respective nodes identified with the security function call, the chaincodes supporting implementation of a data storage layer, and the identified respective nodes comprising a sender node and a receiver node;

map the security function call to an HSM specific function call for the HSM of each of the sender node and the receiver node, the mapping performed via the API-to-API mapping;

transmit the HSM specific function call to the HSM of each of the sender node and the receiver node; and

receive a security response from the HSM of each of the sender node and the receiver node, the security response received over the communication interface, and the security response received in response to the HSM specific function call.

12. The system of claim 11 , where:

the security circuitry API of the sender node and the receiver node is configured to expose the security function call to each of the sender node and the receiver node.

13. The system of claim 11 , where:

the security function call comprises multiple security function calls received at the security circuitry API of the sender node and the receiver node, the multiple security function calls corresponding to security functions within a predetermined set of security functions, the multiple security function calls including:

a data encryption function call; and

a data decryption function call.

14. The system of claim 11 , where:

the security function call comprises multiple security function calls received at the security circuitry API of the sender node and the receiver node, the multiple security function calls corresponding to security functions within a predetermined set of security functions, the multiple security function calls including:

a signature application function call; and

a signature verification function call.

15. The system of claim 11 , where:

the security function call comprises multiple security function calls received at the security circuitry API of the sender node and the receiver node, the multiple security function calls corresponding to security functions within a predetermined set of security functions, the multiple security function calls including:

a key pair generation function call.

16. The system of claim 11 , where:

the API-to-API mapping comprises a redirection of the security function call to the HSM specific function call of the HSM of each of the sender node and the receiver node.

17. The system of claim 11 , where:

the API-to-API mapping comprises:

a redirection of the security function call to the HSM specific function call of the HSM of each of the sender node and the receiver node; and

a redirection of a different security function call to a software process.

18. The system of claim 11 , where:

the HSM interface of each of the sender node and the receiver node is one of multiple HSM interfaces assigned to different HSMs of each of the sender node and the receiver node.

19. The system 11 , where:

the security controller circuitry is further configured to load a configuration file that defines the API-to-API mapping for the HSM of each of the sender node and the receiver node.

20. A security system comprising:

a hardware support interface to a hardware security module (HSM) of each of a plurality of respective nodes, the hardware support interface defining an HSM application programming interface (API) that exposes HSM functions;

a security controller interface configured to receive a security request function call directed to each of the respective nodes; and

security controller circuitry in communication with the security controller interface and the hardware support interface of each of the respective nodes, the security controller circuitry of each of the respective nodes responsively invoked to process chaincodes supporting implementation of a data storage layer, and comprising an HSM function interface including:

a security circuitry API that exposes security circuitry functions; and

an API-to-API mapping between the security circuitry functions and the HSM functions;

the security controller circuitry configured to:

receive, at the security controller interface, a security function call made via the security circuitry API in response to the security request function call;

call the chaincodes to update respective nodes identified with the security function call, the identified respective nodes comprising at least one of a sender node or a receiver node;

translate, via the API-to-API mapping, the security function call to an HSM specific function call for the HSM of each of the respective nodes identified with the security function call;

transmit the HSM specific function call to the HSM of each of the respective nodes identified with the security function call; and

receive a security response from the HSM of each of the respective nodes over the hardware support interface in response to the HSM specific function call.

21. The system of claim 20 , where:

the security circuitry functions include an encryption request function and a decryption request function;

the API-to-API mapping is configured to redirect the encryption request function to an HSM specific hardware implemented encryption function of the HSM of each of the respective nodes identified with the security function call; and

the API-to-API mapping is configured to redirect the encryption request function to an HSM specific hardware implemented decryption function of the HSM of each of the respective nodes identified with the security function call.