Overview of Hardware Security Modules (HSM)
A Hardware Security Module (HSM) is a physical device designed to generate, store, and manage cryptographic keys securely. HSMs are tamper-resistant and provide a robust mechanism for safeguarding sensitive cryptographic data, including private keys, digital certificates, and authentication tokens.
Some of the key features of an HSM include:
Tamper resistance: HSMs are built to prevent unauthorized access and to wipe keys in case of physical tampering attempts.
Secure key generation and storage: Keys are generated within the HSM ensuring that they never leave the device in unencrypted form.
High-performance encryption: HSMs are optimized for performing cryptographic operations at high speed without compromising security.
To start with HSM usage in NetBackup, security artefacts of host ID credentials can be protected by HSM.
NetBackup leverages PKCS#11 version 2.40 to communicate with the HSM. This abstracts NetBackup from the HSM type that is being used and its hardware bindings (Software based HSM, USB, PCIe or networked) as long as the module (HSM) supports PKCS#11 version 2.40 for communication needs. NetBackup expects an HSM vendor to provide a dynamic library that provides PKCS#11 interface for interacting with HSM.
NetBackup leverages symmetric encryption algorithm that is exposed by HSM. Provisioning of such symmetry key in HSM module should be performed using methods and tools as recommended by HSM vendor.