System and method supporting data residency requirement in cloud hosted hardware security modules
Provides is a system and method supportive of data residency requirements that includes a Hardware Security Module (HSM) hosted on a cloud environment and a location tracker embedded within or directly connected to the HSM to provide an HSM location, the HSM including one or more processors and memory including computer instructions causing the one or more processors to perform certain operations. The operations can include receiving a request for access to information over a network and obtaining authorized location information where the HSM is authorized to process the request from a source of the request for access, comparing the HSM location with the authorized location information from the source, processing the request for access if the HSM location is within the authorized location information and rejecting the request if the HSM location is not within the authorized location information. Other embodiments disclosed.
1 . A system supportive of data residency requirements, comprising:
a Hardware Security Module (HSM) hosted on a cloud environment and a location tracker embedded within or directly connected to the HSM to provide an HSM location, the HSM comprising one or more processors and memory coupled to the one or more processors, wherein the memory includes computer instructions which when executed by the one or more processors causes the one or more processors to perform the operations of:
receiving a request for access to information associated with a cryptographic operation using a key over a network;
obtaining authorized location information where the HSM is authorized to process the request by:
retrieving, from a secure element associated the HSM, a signed configuration file comprising a set of IP addresses each associated with authorized location information,
configuring the HSM with an IP address from the set only if the HSM location is within the authorized location information associated with the IP address, and
receiving or generating the key with location constraints derived from the authorized location information associated with the configured IP address;
comparing the HSM location with the authorized location information including comparing the HSM location with the authorized location information associated with the configured IP address and with the location constraints of the key;
processing the request for access by performing the cryptographic operation using the key only if the HSM location is within the authorized location information and within the location constraints of the key responsive to comparing; and
rejecting the request including rejecting the cryptographic operation using the key if the HSM location is not within the authorized location information or not within the location constraints of the key,
wherein the location tracker embedded within or directly connected to the HSM is a global navigation satellite system (GNSS) module.
2 . The system of claim 1 , wherein the system further includes computer instructions which causes the one or more processors to obtain the authorized location by generating a user interface in response to the receipt of the request which provides an option for a manual input of a location or locations where the HSM is authorized to process the request as the authorized location information.
3 . The system of claim 1 , wherein the system further includes computer instructions which causes the one or more processors to obtain authorized location information by receiving the key from a source of the request for access, wherein the key is signed and contains the authorized location information from the source.
4 . The system of claim 1 , wherein the system further includes computer instructions, which causes the one or more processors to maintain the HSM location hidden from users.
5 . The system of claim 1 , wherein the system further includes computer instructions, which causes the one or more processors to receive the request to generate the key that can only be used in predetermined countries or locations and responding with the transmission of the key that cannot be used outside the predetermined countries or locations.
6 . The system of claim 1 , wherein the system further includes computer instructions, which causes the one or more processors to receive a request to process the key containing meta data of the location information where the HSM is authorized and processing the key if the HSM location is within the meta data of the location information where the HSM is authorized.
7 . A method supportive of data residency requirements at a Hardware Security Module (HSM) hosted on a cloud environment and further having a location tracker embedded within or directly connected to the HSM to provide an HSM location, the method comprising:
receiving a request for access to information associated with a cryptographic operation using a key over a network;
obtaining authorized location information where the HSM is authorized to process the request by:
retrieving from a secure element associated the HSM, a signed configuration file comprising a set of IP addresses each associated with authorized location information,
configuring the HSM with an IP address from the set only if the HSM location is within the authorized location information associated with the IP address, and
receiving or generating the key with location constraints derived from the authorized location information associated with the configured IP address;
comparing the HSM location with the authorized location information including comparing the HSM location with the authorized location information associated with the configured IP address and with the location constraints of the key;
processing the request for access by performing the cryptographic operation using the key only if the HSM location is within the authorized location information and within the location constraints of the key responsive to comparing; and
rejecting the request including rejecting the cryptographic operation using the key if the HSM location is not within the authorized location information or not within the location constraints of the key,
wherein the location tracker embedded within or directly connected to the HSM is a global navigation satellite system (GNSS) module.
8 . The method of claim 7 , wherein the method further obtains the authorized location by generating a user interface in response to the receipt of the request that provides an option for a manual input of a location or locations where the HSM is authorized to process the request as the authorized location information.
9 . The method of claim 7 , wherein the method further obtains the authorized location information by receiving the key from a source of the request for access, wherein the key contains the authorized location information from the source.
10 . The method of claim 7 , wherein the method further receives a request to generate a key that can only be used by HSMs in predetermined locations or countries and responding with the transmission of a key that cannot be used with HSMs outside the predetermined locations or countries.
11 . The method of claim 10 , wherein the configuration file in the secure element includes the set of unique IP addresses and authorized locations specific to each HSM in a configuration ( 504 ) of multiple HSMs in a protected environment, whereby upon detection of the presence of the secure element, each of the multiple HSMs is automatically configured with a respective set of the unique IP addresses and authorized locations.
12 . The method of claim 7 , wherein the method further receives a request to generate a key and responding with the transmission of a key that cannot be used outside the country of the HSM location.