nShield Solo

nShield Solo
 
 

nShield Solo

Cost-Effective Server-Embedded HSM

FIPS 140-2   Common Criteria

nShield Solo from Thales e-Security is a cost-effective, high assurance security solution delivered as a PCI or PCIe card designed for embedding in stand-alone servers or appliances. This server-embedded hardware security module (HSM) delivers dedicated cryptographic offload and acceleration capability to satisfy the highest performance requirements. nShield Solo provides dedicated physical and logical controls where software-based cryptography is inadequate. Because it utilizes the Security World architecture, nShield Solo provides an ideal combination of high assurance and operational ease. This makes it easier for you to define and enforce security policies such as dual controls while also automating burdensome and risk-prone administrative tasks.  

nShield Solo is fully compatible with the rest of the nShield HSM family, enabling mixed deployments and easy migration as performance requirements increase.  This independently-certified security platform, including a model optimized for high performance elliptic curve cryptography (ECC), performs key management and cryptographic operations such as encryption and digital signing on behalf of a wide range of commercial and custom-built business applications, protecting critical systems including public key infrastructures (PKIs), identity management systems, databases, web fabric, domain name system security extension (DNSSEC) deployments and code signing. nShield Solo is also ideal for use within security appliances to achieve FIPS grade security hardening. The security boundary of the nShield Solo family is certified up to FIPS 140-2 Level 3 and Common Criteria EAL4+.  

Benefits of nShield Solo

  • HSMs overcome the inherent vulnerabilities of software-based cryptography.
  • Powerful key management architecture minimizes operational costs including compliance reporting.
  • Embedded form factor for dedicated performance enhancement.
  • Isolates critical security functions and minimizes IT interdependencies.
  • Provides FIPS 140-2 certification for appliance vendors with high assurance requirements.

    nShield Solo Features

    Security Features  

    The primary purpose of a hardware security module (HSM) is to provide enhanced security for cryptographic operations that would otherwise be performed by software applications, operating systems, or unprotected server hardware—the majority of which are vulnerable to eavesdropping, misconfiguration, or modification. This additional protection arises from the use of a number of proven technologies that combine in a multi-layered approach. Some of those technologies include:

    Physical security measures 

    • A dedicated, card based security module (PCI and PCIe form factor) that isolates cryptographic processes and keys from applications and host operating systems – accessible only through tightly controlled cryptographic APIs.
    • Optional capability, through the use of the CodeSafe feature, to migrate security-critical portions of application code from the host and to execute that code securely within a tamper-resistant application ‘sandbox’ that is protected by the HSM’s physical security.
    • Custom built hardware to guard against physical attack including the use of epoxy potting to shield internal circuitry from attack by probing.
    • Monitoring of environmental conditions including the integrity of power supplies and temperature to detect potential attack.

    Logical security measures

    • All administrators and users that directly access the HSM are strongly and individually authenticated using smart cards that are issued and managed by the HSM itself—avoiding the need to rely on weak and often shared passwords managed within other systems or exposed to other applications.
    • Clear separation of duties that distinguish between HSM administrators and key custodians that approve the use of HSM protected keys in contrast to software based systems where application ‘super-users’ or root level administrators might enjoy widespread entitlements.
    • Dual controls where multiple administrators or operators might be required to operate as a quorum to perform particularly sensitive tasks such as key recovery. This approach to mutual supervision is common as a way to minimize the threat of malicious insiders and is highly configurable and strongly enforced within the HSM. 
    • Strong integrity validation and policy enforcement for CodeSafe-protected applications (option).

    Operational Features 

    In the past, high-security features tended to be cumbersome, adding effort and affecting performance. As a result, administrators were forced to make unfortunate tradeoffs between security on the one hand and performance and efficiency on the other. The nShield family of HSMs, with its Security World key management architecture, delivers both security and convenience by automating a number of important key management tasks and removing restrictions that would otherwise limit capacity or performance. These include:

    • The power to utilize existing data backup, replication and file sharing practices to safely and automatically perform application key sharing, distribution, and back up—dramatically simplifying HSM deployment and management tasks by minimizing the need to establish costly HSM specific practices.
    • Standard application interfaces to support the widest range of applications and systems and an extensive pre-testing program with leading application vendors to minimize deployment risk.
    • Cryptographic acceleration and off-load to remove resource intensive operations from the host CPU, boosting overall performance and maximizing capacity.
    • Unlimited capacity for protected key storage, increasing overall scalability.
    • Back up techniques that avoid the need to archive keys in dedicated hardware or costly backup HSMs.
    • The ability to combine multiple HSMs within a single host or groups of host machines to create a highly resilient resource pool for load balancing and failover.
    • Remote control to enable key custodians and administrators to perform duties in a secure fashion, reducing cost and inconvenience.
    • Remote provisioning of CodeSafe protected applications (option).

    nShield Solo Options and Accessories


    QUICK LINKS

    Developer Software & Options

    Accessories


    Developer Software & Options

    Form Factors

    The nShield Solo is available in PCI and PCIe form factors.

    Performance

    The nShield Solo is available in multiple performance variants: the 500, 2000, 4000, and 6000, which indicate their signing transactions per second for 1024 bit RSA.  Additionally, model PCIe 6000+ is optimized for high performance elliptic curve cryptography (ECC).  Please consult the nShield Solo data sheet for additional performance data.

    Certification

    The nShield Solo is available in FIPS 140-2 Level 2 and FIPS 140-2 Level 3 variants.

    CipherTools Developer Toolkit

    With the CipherTools Developer Toolkit, you can take full advantage of the advanced capabilities offered by the nShield HSM family as you integrate HSMs with your applications. It includes detailed tutorials and reference documentation, sample programs written in a range of high level languages, and additional versions of libraries to expand capabilities for integration with business applications beyond those that can be achieved by the standard application program interfaces (APIs).

    CodeSafe 

    CodeSafe enables application developers to write programs that are securely loaded within the certified environment of an nShield HSM, protecting them from insider attacks, malware and Trojans on host systems. CodeSafe provides a “glass box” setting where code can be checked in a virtual secure execution environment. Because the security depends on access control rather than secrecy of operation, it is possible to debug application code without destroying its integrity. The secure execution capability provides additional security features to enable fine-grained access control and authorization for the use of security critical resources that are protected on the device, such as private keys, non-volatile user memory, and hardware-secured time. Examples include digital meters, authentication agents, time-stamps, audit loggers, digital signature agents, and custom encryption processes. CodeSafe is available for nShield Solo FIPS 140-2 Level 3 certified HSMs only (not for nShield Solo FIPS 140-2 Level 2 certified HSMs). 

     
     
       
     CodeSafe
    Activation
    Organizations wishing to leverage the power of CodeSafe will need one license of CodeSafe Developer Software per developer and one CodeSafe Activation license for each HSM executing the code.
       
    CodeSafe SSL 
    Activation
    An optional CodeSafe SSL Activation feature enables nShield Solo units to terminate encrypted SSL sessions within the HSM and then re-encrypt the data for applications running in the HSM, so that clear text data is never exposed on the host server. Unlike typical SSL host-based termination, which exposes sensitive clear text data, CodeSafe SSL enables sensitive personal account numbers (PANs) and personal identification numbers (PINs) that are vital for electronic commerce transactions to be distributed across systems with full end-to-end encryption.

    Elliptic Curve Cryptography (ECC) Activation

    nShield HSMs offer a large number of cryptographic algorithms as part of the standard feature set, including AES, DSA and RSA. For organizations wishing to use elliptic curve cryptography (ECC), an ECC Activation license is available. The optional activation license enables ECC operation on all nShield Solo and Connect models. For organizations that require significantly accelerated ECC, two additional nShield models are also available. The nShield Solo PCIe 6000+ and nShield Connect 6000+ deliver hardware-optimized ECC performance and come bundled with the ECC Activation license.

    Database Security Option Pack

    Databases often contain an organization's most sensitive data. As a result, the large database vendors have implemented native encryption in their database server products. Database Security Option Pack adds support for Microsoft’s Extensible Key Management (EKM). It enables organizations to better protect keys that protect sensitive data in Microsoft SQL Server 2008, manage keys across databases and systems, and separate security and database administration. Users of Oracle 11g can take advantage of these features without requiring an option pack.

    Time Stamp Option Pack

    Secure time stamps help organizations verify that certain data existed at a certain point in time and has not been manipulated since that time. This is critical for applications including digital archives, public key infrastructures, code signing, notary services, patent applications, lottery, as well as betting and gaming. The Time Stamp Server from Thales is a turnkey solution for organizations that want a ready-to-use time stamping solution. For organizations looking for an OEM solution or who want to combine time stamping with other HSM functionality, the Time Stamp Option Pack enhances nShield Solo 500 to support standardized time stamps. The Time Stamp Option Pack is available for nShield Solo FIPS 140-2 Level 3 certified HSMs only (not for nShield Solo FIPS 140-2 Level 2 certified HSMs). Organizations looking to add time-stamping features in custom applications can benefit from the Time Stamping Developer Software. 

     
     
       
     Time Stamping Developer Toolkit
    Time Stamping Developer Toolkit is an easy-to-use API that enables applications to request and verify time stamps from the Time Stamp Server or a server featuring an nShield HSM and the Time Stamping Option Pack. It is available for nShield Solo FIPS 140-2 Level 3 certified HSMs only (not for nShield Solo FIPS 140-2 Level 2 certified HSMs).

    payShield Cardholder Authentication for nShield

    To protect against credit card and online banking fraud, many financial institutions have implemented additional security measures for card-not-present transactions. payShield Cardholder Authentication for nShield complements other Thales payments products by enabling organizations to authenticate the cardholder through various means, such as Chip and PIN (CAP) authentication for online banking transactions and 3-D Secure, also known as Verified by Visa and MasterCard SecureCode. This option integrates with cardholder authentication solutions including ActivIdentity, Arcot, Bell ID, and Gemalto. Organizations with advanced requirements can also use the payShield Developer Software to produce custom solutions. payShield Cardholder Authentication for nShield is available for nShield Solo FIPS 140-2 Level 3 certified HSMs only (not for nShield Solo FIPS 140-2 Level 2 certified HSMs). 

     
     
       
     Key Loading Device
    Keys are typically generated inside an HSM to ensure that the key has never left the secure platform. However, some organizations receive tamper-proof envelopes containing keys from partners they are doing business with, or need to securely exchange sensitive data between systems from different vendors. The Key Loading Device enables organizations to load symmetric encryption key fragments into nShield HSMs by entering them on a PIN pad and loading them onto smart cards that can be read by nShield HSMs. The Key Loading Device requires the use of payShield Cardholder Authentication for nShield.

    Remote Operator

    HSMs typically run in physically secure, lights-out data centers, often in several, redundant sites. Many organizations therefore find it impractical to gain physical access to the HSM for day-to-day operations. Remote Operator saves time and reduces travel costs by enabling users to present credentials to a remote HSM in a secure manner directly from their workstation.

    KCDSA Activation

    Highly sensitive areas of government and enterprises with a strong interest in national security sometimes prefer to use proprietary, national cryptographic algorithms to protect their most sensitive information. Given these security concerns, it is advantageous to run such algorithms on a secure HSM platform. The KCDSA Activation enables South Korean agencies to use the Korean Certificate-based Digital Signature Algorithm (KCDSA) on an nShield HSM. Thales recommends CodeSafe technology to organizations that wish to implement their own national algorithms on the protected HSM platform. 

     

    Accessories

    Smart Card Reader Rackmount

    For organizations deploying one or more nShield Solo modules in a 19" rack, the optional nShield Smart Card Reader Rackmount provides a practical and tidy solution to attach card readers in the data center. The nShield Smart Card Reader Rackmount is 1U in height and can be equipped with up to four smart card readers, which are shipped as standard with nShield Solo cards. Each unit is shipped with three blanking plates to cover any unused slots. 

    Compatibility Overview

     

    nShield Solo FIPS 140-2 Level 2 nShield Solo FIPS 140-2 Level 3 nShield Edge netHSM (legacy) nShield Connect
    CipherTools Developer Software O O O O O
    CodeSafe / SEE Activation* O O O
    Database Security Option Pack O O   O O
    payShield Cardholder Authentication for nShield* O O O
    payShield Key Loading Device  O O O
    Time Stamping Option Pack* O
    Time Stamping Developer Software O
    Remote Operator Activation O O O O O
    Elliptic Curve (ECC) Activation O O O O O
    KCDSA Activation O O O O O
    nShield Smart Card Reader Rackmount O O
    Additional Client License O O
    nToken  O O
    Replacement PSU for nShield Connect O
    Replacement Fan Tray for nShield Connect O
    Keyboard for nShield Connect O
    Slide rails for nShield Connect O
    S = standard; O = optional

    *No more than one of these CodeSafe applications can be run on a single HSM.

    nShield Solo Specifications

    Cryptographic algorithms supported:

    • Symmetric
      • AES (128, 192, and 256 bit)
      • Aria (128, 192, and 256 bit)
      • Camelia (128, 192, and 256 bit)
      • Triple DES (112, 168 bit)
    • Asymmetric
      • RSA (1024, 2048, 4096, 8192 bit)
      • Diffie-Hellman
      • DSA
      • ECC Suite B
    • Hashing
      • SHA-1, SHA-2 (224, 256, 384, and 512 bit)

    Certifications:

    • FIPS 140-2 Level 3
    • Common Criteria EAL 4+
    • UL, CE, FCC
    • RoHS, WEEE

    Operating systems supported:

    • Windows
    • Linux
    • Solaris
    • IBM AIX
    • HP-UX
    • AIX LPARs

    APIs supported:

    • PKCS#11
    • Open SSL
    • Java (JCE)
    • Microsoft CAPI and CNG

    Below is a non-exhaustive list of applications that utilize these APIs and have been tested by Thales partners and/or customers.

    • Aconite Affina
    • ActivIdentity Card Management System, 4Tress, Validations Authority
    • Apache
    • Axway Validation Authority
    • Bell ID Token Manager, EMV Data Preparation
    • CA Application Performance Manager
    • CyberArk Digital Vault
    • EfficientIP SolidServer
    • Entrust Authority Security Manager
    • IBM Tivoli Access Manager, Websphere
    • Imperva SecureSphere
    • Infoblox IPAM Appliance
    • Insta Certifier Certificate Authority
    • Intercede MyID
    • ISC BIND
    • Lieberman Software Enterprise Random Password Manager
    • Keynectis OpenTrust PKI
    • McAfee Iron Mail, Web Gateway
    • Microsoft Active Directory Federated Services (ADFS), Active Directory Certificate Services (ADCS), Forefront Identity Manager (FIM), Internet Services Accelerator (ISA), Rights Management Services (RMS), Internet Information Services (IIS), BizTalk Server, Authenticode, Hyper-V, SQL Server, Mediaroom
    • nuBridges Protect
    • PingIdentity PingFederate
    • Prime Factors EncryptRIGHT
    • PrimeKey EJBCA
    • Protegrity Data Security Platform
    • Red Hat Certificate System
    • Riverbed Stingray
    • RSA Certificate Manager, Data Protection Manager
    • Totemo Trustmail
    • Vasco Vacman
    • Verisec Hnossa
    • Voltage SecureData
    • Insta Certifier Certificate Authority

    nShield Solo Data Sheet

    nShield Solo

    Related Products