Confidential Key Management as a Service: Enhancing Availability and Isolation in Key Protection

Abstract

: Key management is paramount to security concerns in cloud system. Key protection is vital to avoid data breaches due to the inadvertent or intentional disclosure of cryptographic keys. Hardware security modules (HSM) have been considered as a trustworthy entity to store keys and certificates. However, the systems using HSMs are difficult to achieve scalability because of the heavy workload of cryptographic operations, as well as the cost of the dedicated hardware. Based on the idea of key isolation by HSM, we introduce a confidential software-based HSM ( ccHSM ) designed to provide strong isolation and scalable key management without the need for dedicated hardware. ccHSM delivers cryptographic operations and secure secret storage to cloud-native services throughout lifecycle. To enable this, ccHSM adopts Intel SGX for a trusted execution environment and implementation of HSM features, PKCS#11-compliant key management. Furthermore, ccHSM is able to establish a secure, intra-host PKCS#11 communication with the target application to ensure low-latency and tamper-resistant interaction. Finally, we apply ccHSM for TLS key offloading, JSON Web Token authentication. Our evaluation shows that ccHSM doesn’t suffer substantial performance trade-offs while significantly reducing cost relative to conventional hardware and cloud-based solutions.