#cloudhsm

The newest Azure infrastructure silicon updates

Microsoft Azure unveiling its newest in-house security chip, Azure Integrated HSM, strengthens key management to keep encryption and signing keys within the HSM without affecting performance or latency.

Azure also introduced Azure Boost DPU, its first in-house DPU designed for data-centric workloads with high efficiency and low power, capable of absorbing multiple components of a traditional server into a single dedicated silicon.

Azure Integrated HSM

Microsoft Azure is putting a lot of effort into eliminating infrastructure barriers that prevent us from providing customer value, whether they are resource or performance bottlenecks, as part of its all-encompassing strategy to optimize Azure infrastructure. To improve the security, effectiveness, performance, agility, and scale of its infrastructure, it is innovating at every stage of the stack, from silicon to systems to software.

Azure is constructing its infrastructure hardware with several layers of defense and specialized innovations to offer robust protection for Microsoft and its customers. Security is a top concern as part of its systems approach to optimizing every layer in its infrastructure.

Microsoft presented its strategy for Azure Confidential Inferencing and Trustworthy AI in September. The usage of hardware-based Trusted Execution Environments (TEEs) for workload protection and data privacy is emphasized in this vision. Its added new open-source silicon security advancements last month to further this aim. Among these were the announcement of the quantum-resilient accelerator Adams Bridge and its incorporation into Caliptra 2.0, the open-source silicon root of trust (RoT) of the future.

Microsoft’s latest in-house security chip, Azure Integrated HSM, is a dedicated Hardware Security Module (HSM) that enhances key protection by allowing the use of encryption and signing keys while they are contained within an HSM, without incurring the usual network access latencies for HSM access. This is part of Microsoft’s commitment to its Secure Future Initiative (SFI).

Enhancing security capabilities for every new Azure server

The stringent Federal Information Processing Standards (FIPS) 140-3 Level 3 Security Requirements for Cryptographic Modules are met by Azure Integrated HSM. While keys and security assets are in use, Azure Integrated HSM safeguards them. Specialized hardware cryptographic accelerators are available in Azure Integrated HSM to carry out encryption, decryption, signing, and verification tasks inside the integrated HSM’s boundaries.

Common cloud HSM services are network-based centralized resources that cloud tenants might set up to provide essential services for their workloads. Although these models offer strong key protection, scaling them with the same flexibility as other resources, like compute, can be challenging. Workloads can also seek the release of their keys from the HSM and import them into their local environment, if their key policy allows, otherwise they can incur network round-trip latency for calls to the network-attached HSM service. The security protections provided may fall short of FIPS 140-3 Level 3 when keys are exported from the HSM and placed into the workload environment.

The traditional trade-off between requesting the release of keys from the remote HSMs or increasing network round-trip latency to remote HSM services is eliminated with Azure Integrated HSM. Azure Integrated HSM offers locally attached HSM services to both general-purpose and confidential virtual machines and containers, acting as a server-local HSM that securely connects to the workload environments. Without the latency issues with round-trip network-attached HSM calls, this offers the advantage of industry-leading in-use key protection.

Security benefits of Azure Integrated HSM 

For Azure clients who need to safeguard their sensitive data and apps in the cloud, Azure Integrated HSM provides a number of advantages.

Enhanced security and locally deployed

Cryptographic keys can be kept separate from software, including host and guest software, with Azure Integrated HSM. Even while the keys are being used, Azure Integrated HSM allows them to stay completely contained within a specialized, hardware-based HSM that complies with FIPS 140-3 Level 3 security standards. This offers robust isolation, tamper detection, and logical and physical tamper prevention.

Locally deployed with minimum latency

Azure Integrated HSM’s node-integrated connectivity and specialized hardware accelerators allow it to process large volumes of cryptographic requests with the least amount of latency. Dedicated, per-workload HSM partitions are also supported by Azure Integrated HSM. Partitions are isolated by hardware, and keys from the workload environment are only accessible by Oracle.

“Secure by design”, protecting across the Azure hardware fleet

Beginning next year, all new servers in Microsoft’s datacenters will have Azure Integrated HSM deployed to improve security for both general-purpose and confidential applications across Azure’s hardware fleet.

The most recent development in guaranteeing strong and thorough protection of its infrastructure is Azure Integrated HSM. It’s laying the groundwork for the trust and security that Azure offers its clients by including cutting-edge hardware security features like secure control modules and the silicon root of trust. In order to satisfy its clients’ changing needs, Azure is dedicated to constantly improving its cloud hardware security capabilities.

Boosting infrastructure efficiency with Azure Boost DPU

Moving large volumes of data over networks and storing it securely and reliably have become major difficulties in the age of cloud computing and artificial intelligence. In order to overcome these difficulties, a new data-centric processing design that complemented the CPUs and GPUs found in large datacenters was required a few years ago. When it comes to managing highly multiplexed data streams, which correspond to millions of network connections, traditional CPU architectures are inadequate. However, they excel at general-purpose activities. On the other hand, GPUs are less appropriate for data-centric workloads because they are specialized for large-scale vector and matrix calculations that are essential to AI workloads.

Data Processing Units (DPUs) are a new kind of silicon that was developed as a result of these studies. Tasks requiring the handling of large volumes of data at the line rate of the network are best suited for DPUs. For data-centric appliances like storage systems can function as independent processors.

Azure Boost DPU, Microsoft’s first in-house DPU. It is built to execute Azure’s data-centric workloads with low power consumption and excellent efficiency by combining several traditional server components into a single silicon block. Azure Boost DPU is a fully configurable system on a chip that combines network and storage engines, data accelerators, high-speed Ethernet and PCIe interfaces, and security features.

Azure Boost DPU is a hardware-software co-design that was created especially for the Azure infrastructure. It runs a unique, lightweight data-flow operating system to enable flexible platforms that are more efficient, perform better, and use less power than previous implementations. For example, compared to current CPUs, it anticipates that DPUs will operate cloud storage applications at four times the performance and three times the power. Additionally, DPU-based systems raise the bar for security and dependability by incorporating a custom application layer that makes use of the DPU’s tightly integrated data compression, data protection, and cryptography engines.

The newest member of the Azure family of hardware innovations for infrastructure advancements is Azure Boost DPU. It is dedicated to providing innovations that increase the capability, efficiency, and scalability of its infrastructure to satisfy clients’ changing demands as it keep pushing the envelope of what is conceivable.

Cloud KMS

A cloud-based key management system called Google Cloud Key Management Service (KMS) lets you generate, utilize, and maintain cryptographic keys as well as carry out cryptographic activities safely. Your data is safeguarded both in transit and at rest thanks to its unified platform for handling encryption keys.

Advantages

Expand your security worldwide

Expand your application to take advantage of Google’s worldwide reach while delegating to Google the burden of handling important management issues, such as handling redundancy, latency, and data residency.

Assist in fulfilling your compliance obligations

Utilize software-backed encryption keys, FIPS 140-2 Level 3 verified HSMs, customer-supplied keys, or an external key manager to simply encrypt your data in the cloud.

Benefit from Google Cloud product integration

Gain access to extra security features like Google Cloud IAM and audit logs while managing the encryption of data across all Google Cloud products using customer-managed encryption keys (CMEK).

Important characteristics of Cloud KMS

Handle encryption keys centrally

Cloud-based key management that lets you handle symmetric and asymmetric cryptographic keys for your cloud services as on-premises. EC P256, EC P384, AES256, RSA 2048, RSA 3072, and RSA 4096 may be produced, used, rotated, and destroyed.

Use HSM to provide hardware key security

Host encryption keys and carry out cryptographic functions in HSMs verified to FIPS 140-2 Level 3. You can safeguard your most sensitive workloads with this fully managed solution without having to worry about the administrative burden of running an HSM cluster.

Offer EKM support for external keys

Utilize encryption keys that are kept and controlled in an external key management system to encrypt data in Google services that are integrated. You may use the cloud computing and analytics capabilities while keeping your encryption keys and data at rest separate using External Key Manager.

Be the final judge of who may access your data

Key Access Justifications enhances your control over your data significantly when used in conjunction with Cloud EKM. It’s the only solution that allows you to see each request for an encryption key along with the reason behind it and a way to accept or reject decryption inside that request. The integrity promises made by Google extend to these measures.

Cloud KMS Google Use cases

Encourage adherence to regulations

Along with Cloud HSM and Cloud EKM, Cloud KMS Google supports a variety of compliance regulations that need certain key management practices and technology. It does this in a cloud-native, scalable manner without compromising the implementation’s agility. Hardware encryption (HSM), separating keys from data (EKM), and handling keys safely Cloud KMS are all required by various standards. Key management complies with FIPS 140-2 requirements.

Utilize safe hardware to manage encryption keys

Customers may need to store their keys and conduct crypto operations on a device approved by FIPS 140-2 Level 3 if they are subject to compliance rules. Customers may satisfy their regulator’s requirements and maintain compliance in the cloud by letting their keys be stored in an HSM that has undergone FIPS validation. Customers who want a certain degree of security that their important data cannot be seen or exported by the cloud provider must also be aware of this.

Control encryption keys off-cloud

Clients that must adhere to local or regulatory security regulations must use cloud computing while keeping ownership of the encryption keys. They may still use the cloud’s computing and analytics capabilities while keeping data at rest and encryption keys separate thanks to External Key Manager. Complete transparency on who has access to the keys, when they have been used, and where they are stored is maintained throughout this process.

Important Access Reasons and EKM Data Flow

Customers of Google Cloud may see every request for an encryption key, the reasoning behind it, and a way to accept or reject decryption in relation to that request via Key Access Justifications. The use cases center on data access visibility and enforcement.

Pervasive data encryption

Using your external key management system, securely encrypt data as it is transmitted to the cloud so that only a private virtual machine VMs service is able to decode and process it.

The ability to digitally sign code and certify that the software their clients are downloading is authentic and hasn’t been maliciously altered is essential for developers to establish confidence in the software industry. For many companies, keys used to sign code are the crown jewels of cryptography, thus keeping them safe is crucial.

Security features for creating, managing, and limiting access to cryptographic keys are offered by Google Cloud‘s Cloud Key Management System (KMS). Create, store, and carry out cryptographic activities like code signing using keys in its tamper-resistant Cloud hardware security modules (Cloud HSM) with the intuitive interface provided by Cloud KMS.

Cloud HSM Google

What is Cloud HSM?

Hosting encryption keys and conducting cryptographic operations in a cluster of FIPS 140-2 Level 3 certified HSMs is possible with Cloud HSM, a cloud-hosted Hardware Security Module (HSM) service. Clustering, scaling, and patching are not concerns for you because Google looks after the HSM cluster. All the capabilities and advantages that Cloud KMS offers are yours to utilize because Cloud HSM leverages Cloud KMS as its front end.

Create a key ring

In a specific Google Cloud location, you add a key that you have created to a key ring. A new key ring can be made, or an old one can be used.

In a Google Cloud location that is compatible with Cloud HSM, create a key chain.

Navigate to the Key Management section within the Google Cloud dashboard.

Press the Generate key ring button.

Enter your key ring’s name in the “Key ring name” field.

Choose an address such as “us-east1” for the Key Ring location.

Click “Create.”

Create a key

For the designated key ring and location, follow these steps to produce a Cloud HSM key.

Navigate to the Key Management section within the Google Cloud dashboard.

In order to create a key, click the name of the key ring.

To create a key, click Create.

Select Generated key under the What kind of key do you want to create? field.

Name your key by entering its name in the Key name field.

To select HSM, click the dropdown menu for Protection level.

Choose “Symmetric encrypt/decrypt” from the drop-down menu.

Take the Rotation period and Starting on as given by default.

Click “Create.”

Bare Metal Rack HSM

Additional HSM features, such single-tenancy, are available through Google Cloud. Customers can host their own HSMs in the space given by Google with the help of Bare Metal Rack HSM. If you need further details, ask your account representative.

Provider for Microsoft Cryptography API: Next Generation (CNG)

An application programming interface called Microsoft Cryptography API: Next Generation (CNG) enables programmers to include encryption, encoding, and authentication into Windows-based applications. With CNG providers installed on the system, you may also use tools like Windows signtool to conduct crypto operations. To work with current apps that make use of the CNG API, Cloud KMS provides a provider that complies with this standard.

The provider is licensed under the Apache 2.0 license and is run as an open source project on GitHub. The Google Cloud Terms of Service apply to release binaries obtained from the GitHub releases page, and Cloud Customer Care offers support.

For Microsoft’s Cryptography API: Next Generation (CNG) provider, Google Cloud just released support for Cloud KMS signing. This feature allows you to secure your keys using Cloud HSM and SignTool to sign code on Microsoft assets.

As to the Cyber Safety Review Board of the U.S. government, hardware security modules are regarded as an optimal approach for cloud security since they keep keys in isolated and segmented systems. Threat actors have been observed to compromise and use legitimate signing keys to access data and systems inside the key’s domain when HSMs and other recommended practices are not followed.

In Cloud HSM, the servers housing the HSM hardware are shielded from illegal operations, the signature keys are designated as non-extractable, and the hardware is not directly connected to any network. It is more difficult to unintentionally reveal or steal the signing keys thanks to these security hardening methods.

In the past, you had to lock the keys to your Windows artifacts using hardware that wasn’t hosted by Google Cloud. With FIPS 140-2 Level 3 guarantees, cloud HSM safeguards your signature keys. Additionally, by only charging for the keys you use, it can lower your infrastructure and operating expenses. To suit your workload needs, Cloud HSM is offered in many locations.

You may distribute your software to your clients more quickly by using Google Cloud KMS CNG provider to expedite the signing procedure and save significant time.

Starting a Cloud KMS CNG provider: A Guide

Its cloud-based KMS CNG provider has four primary purposes. Apply it as necessary:

Verify firmware using a private key secured by a FIPS 140-2 Level 3 HSM.

Use the standard SignTool executable on Windows to sign Microsoft Windows artifacts.

transfer the burden of managing keys, which includes access control, rotation, and creation;

Use logging and auditing capabilities to gain visibility and attribution.

These crucial results can be attained by following these steps:

Install the CNG provider

Create your signing key

Get your certificate

Sign your artifact

Install the CNG provider 

In the Google Cloud GitHub repository, it has uploaded the CNG provider’s released binaries. The.msi installer that is given can be used to install these on your Windows PC. Once that’s done, setup your provider according to the user manual.

Use Cloud HSM to generate your signing key

Make a signature key that is Cloud HSM hardware protected when you’ve finished making your key ring. Depending on your security needs, choose the asymmetric signature algorithm.

Install your signing certificate

Access Cloud HSM by importing your signing certificate. This provides robust hardware-based protection for your signing key.

Create a signature key that is encrypted using Cloud HSM and generate a certificate signing request (CSR) if you don’t already have one. Next, give the certificate authority the CSR to obtain a fresh code signing certificate.

Sign your artifacts

SignTool can be used to cryptographically sign your artifact once you have installed your CNG provider, generated a key in Cloud HSM, and obtained your certificate. Ascertain that the appropriate flags are provided, such as the key URI from Cloud HSM and the provider name Google Cloud KMS Provider.

What is Cloud HSM?

Using AWS KMS Custom Key Store with CloudHSM to Encrypt Your Data

I tend to follow cloud security news closely these days, particularly anything related to data encryption. That’s why one of the AWS re:Invent announcements that was of most interest to me actually occurred at the beginning of the conference, before the first keynote. Amazon Web Services announced the general availability of KMS custom key store, allowing users of AWS CloudHSM to take advantage…