The selection criteria for the HSM within the context of PKI implementations, can be broadly grouped into the following categories: Operational Quality, Scalability, Functionality and Vendor Health. A description of the selection criteria follows:
Operational Quality:
Resiliency & reliability: The large capacity HSM customers will expect months of continuous operations and the ability to deploy resilient configurations of HSM(s) where a single HSM failure does not result in an application failure.
Product lifecycle: Selected HSM(s) should have a product lifecycle compatible with your organization’ needs with the actual lifecycle dependent on the cost of acquiring, distributing and upgrading the customer premises technology.
Durability: Customers should be able to subject HSM to continuous duty cycle for extended periods each day.
Operational support: Vendors should be able to provide service level agreements in line with your 24x7 support model. The large capacity HSM(s) should provide the necessary audit and trace information to enable effective helpdesk & operational support procedures.
Scalability:
Performance: A small capacity HSM supporting 0.25 TPS and a large capacity HSM supporting 40+ TPS.
Capacity: The large capacity HSM needs to support storage of multiple PKI identities.
Scalable footprint: The large capacity HSM(s) should be able to scale both vertically and horizontally
Functionality:
PKI support: HSM must offer the following security features - 2048-bit (the expected key length size necessary for proper security of PKI) key pair generation, private key storage, and private cryptographic operations. The HSM must be compatible with the Public-Key Cryptography Standards #11 (PKCS#11) standard and certified for usage with Entrust PKI software.
Security level: Vendors that verify their security implementations by subjecting them to government and industry driven security validation programs are preferred. Compatibility with FIPS level-2 or higher is required.
OS certification: Vendors should be capable of certifying their products on your supported Operating Systems.
Connectivity: Large capacity HSM(s) should be LAN connected and multi-server shareable. The small capacity HSM(s) should allow for USB connectivity.
Vendor Health & Focus:
Vendor size: Large publicly held vendors are preferred as they would have substantial resources to support our needs and it is easier to monitor their financial health.
Existing relationship: Vendors with existing relationship are preferred as the organization already has worked out commercial and legal contract terms and conditions with them and has experience working with them.
Mission-critical deployments: Vendors with mission critical customer deployments are preferred.
Status as a ‘top account’: Any new commercial technology needs to be supported by a strong vendor relationship. Being a top account gives us sufficient leverage to ensure timely resolution of problems.






Recent Comments