Granted Patent B2

US 12,333,023 · App. 18/073,808 · Granted Jun 17, 2025

Inventors: Ranga Anumulapally (Pembroke Pines, FL); Wayne Reed (Kemptville, CA); Marc Boillot (Plantation, FL)

Assignee: THALES DIS CPL USA, INC.

G06F21/602G06F21/604G06F21/85

Abstract

Claims (50)

1. A Hardware Security Module (HSM) exposing an API to establish a Class of Service (CoS) on cryptographic transactions requested from at least one Crypto API Client, the HSM 101 comprising:

a Main Processor hosting an HSM app exposing said API to said at least one Crypto API Client, the API providing:

a first API method to handle a Class of Service (CoS) attribute of the at least one Crypto API Client via in-band signaling for a desired cryptographic service;

wherein the CoS attribute signals a higher level of service for time-sensitive and high priority requests processing the cryptographic transactions on the HSM; and

a Security Processor specialized to accelerate processing of said cryptographic transactions on the HSM 101 based on the Class of Service (CoS) attribute;

wherein the Main Processor comprises a software (SW) CoS Manager to logically

prioritize and queue the API requests from the connection threads in the Connection Thread Pool that terminate TCP/TLS connections to API processing threads in an API processing thread pool, whereby

each API processing thread is assigned to handle the cryptographic transactions associated with said desired cryptographic service, and determine from the CoS attribute and the cryptographic transactions whether to fulfill the cryptographic transactions in software on the main processor or via hardware prioritization via the Security Processor,

wherein the at least one Crypto API Client is communicatively coupled to the HSM over the TCP/TLS secure communication channel to an internet protocol (IP) address and port.

2. The HSM of claim 1 , wherein the Security Processor comprises a hardware (HW) CoS Manager at a hardware crypto transaction level to dispatch said hardware prioritization to one or more Crypto Units thereby providing a HW Crypto Engine pool to fulfill the cryptographic transactions in hardware on the Security Processor,

wherein the Security Processor is communicatively coupled to the Main Processor over a secure PCle communication channel internal to the HSM.

3. The HSM of claim 1 , is one of a general purpose (GP) HSM and a Payment HSM,

wherein the GP HSM provides for digital signatures, encryption, decryption and verification & validation of a digital identify;

wherein the Payment HSM provides for PIN management, key management, card services, card validation, credentials, and payment processing transactions.

4. The HSM of claim 1 , wherein the main processor is virtualized to provide multiple virtual HSMs (vHSMs) each with their own HSM app for handling cryptographic transactions for multiple Crypto API Clients.

5. An Application Programming Interface (API) for establishing an in-band Class of Service (CoS) on cryptographic transactions in a Hardware Security Module (HSM) that exposes the API to establish a Class of Service (CoS) on cryptographic transactions requested from at least one Crypto API Client, the API comprising:

a first API method to handle a Class of Service (CoS) attribute on said at least one Crypto API Client via in-band signaling for a desired cryptographic service;

wherein the CoS attribute signals a higher level of service for time-sensitive and high priority requests processing the cryptographic transactions on the HSM;

wherein the HSM comprises:

a Main Processor hosting an HSM app exposing said API to said at least one Crypto API Client, and

a Security Processor specialized to accelerate processing of said cryptographic transactions on the HSM based on the Class of Service (CoS) attribute;

wherein the Main Processor comprises a software (SW) CoS Manager to logically

prioritize and queue the API requests from the connection threads in the Connection Thread Pool that terminate TCP/TLS connections to API processing threads in an API processing thread pool, whereby

each API processing thread is assigned to handle the cryptographic transactions associated with said desired cryptographic service, and determine from the CoS attribute and the cryptographic transactions whether to fulfill the cryptographic transactions in software on the main processor or via hardware prioritization via the Security Processor,

wherein the at least one Crypto API Client is communicatively coupled to the HSM over the TCP/TLS secure communication channel to an internet protocol (IP) address and port.

6. The API of claim 5 , further comprises a second API method to administer controls of the CoS attribute over the Crypto API Client via in-band signaling,

whereby administrators are authorized to explicitly control the CoS as a feature on a per-client basis for each said at least one Crypto API Client.

7. The API of claim 6 , further comprises a third API method to appropriate pricing and licensing features of the CoS attribute for the at least one Crypto API Client via in-band signaling.

8. The API of claim 6 , further comprises a fourth API method to propagate the CoS attribute for the at least one Crypto API Client to intermediate nodes in a network path involved in processing the cryptographic transactions across multiple HSMs.

9. The API of claim 6 , where the intermediate nodes support a card scheme for a payment network and a node therein is one among: a payments merchant, a payments acquirer, a payments switch, and a payments issuer.

10. The API of claim 6 , further comprises a fifth API method for configuring the CoS attribute on a general purpose (GP) HSM and a Payment HSM,

wherein the GP HSM provides for digital signatures, encryption, decryption and verification & validation of a digital identify;

wherein the Payment HSM provides for PIN management, key management, card services, card validation, credentials, and payment processing transactions.

11. The API of claim 6 , wherein said in-band signaling for said Crypto API Client is by way of a RESTful URI parameter request or a customer header.

12. The API of claim 6 , wherein said in-band signaling for said Crypto API Client is by way of a gRPC field entry.

13. A method of in-band signaling to establish a Class of Service (CoS) on cryptographic transactions of a Hardware Security Module (HSM) that exposes the API to establish a Class of Service (CoS) on cryptographic transactions requested from at least one Crypto API Client, the method comprising the steps of:

by way of an Application Programming Interface (API) 170 exposed on an HSM app on said HSM,

responding to a first API method to handle a Class of Service (CoS) attribute by at least one Crypto API Client via in-band signaling for a desired cryptographic service,

wherein the CoS attribute signals a higher level of service for time-sensitive and high priority requests of the cryptographic transactions processed on the HSM;

wherein the HSM comprises:

a Main Processor hosting an HSM app exposing said API to said at least one Crypto API Client, and

a Security Processor specialized to accelerate processing of said cryptographic transactions on the HSM based on the Class of Service (CoS) attribute;

wherein the Main Processor comprises a software (SW) CoS Manager to logically

prioritize and queue the API requests from the connection threads in the Connection Thread Pool that terminate TCP/TLS connections to API processing threads in an API processing thread pool, whereby

each API processing thread is assigned to handle the cryptographic transactions associated with said desired cryptographic service, and determine from the CoS attribute and the cryptographic transactions whether to fulfill the cryptographic transactions in software on the main processor or via hardware prioritization via the Security Processor,

wherein the at least one Crypto API Client is communicatively coupled to the HSM over the TCP/TLS secure communication channel to an internet protocol (IP) address and port.

14. The method of claim 13 , further comprising:

propagating the CoS attribute for the at least one Crypto API Client to intermediate nodes in a network path involved in processing the cryptographic transactions across multiple HSMs,

where the intermediate nodes support a card scheme for a payment network and a node therein is one among: a payments merchant, a payments acquirer, a payments switch, and a payments issuer,

wherein said propagating includes both passing and setting the CoS attribute on HSMs associated with the intermediate nodes.

Assignments (3)

Continuity (1)

References Cited (12)