Next-Gen Financial Cloud HSM

Next-Gen Financial Cloud HSM

Cloud-friendly Encryption & Key Management

Rapidly provision & deploy Next-Gen Financial Cloud Hardware Security Module (HSM) to protect & translate financial data in different PCI zones, reduce PCI compliance scope, and increase redundancy in the cloud with the same high performance and dependability of physical hardware.
  • Core-to-Cloud Architecture & Automation
  • Cloud HSM Snapshot Technology
  • Native Omni-Cloud Integration
  • Streamlined Deployment & Self-Service Capabilities

Schedule Next-Gen Demo Sign Up Today!

The Next Evolution of Cloud HSM Has Arrived

As financial organizations continue their strategic digital transformation initiatives, the dependence on public clouds and associated services has decision makers looking to move critical infrastructure into the cloud without suffering negative impacts to performance & cost. The payment & financial servicing industry can now utilize the next evolution of encryption and key management, Next-Gen Financial Cloud Hardware Security Modules (HSM). Experience the same high performance & functionality of physical PCI-compliant HSMs but deployed & configured like typical cloud services.

The Next-Gen Financial Cloud HSM is the 2.0 evolution of the world’s first financial cloud HSM presented by VirtuCrypt back in 2015. The Next-Gen Hardware Security Module is primed with functionality and features specialized for PCI zones including financial acquiring, financial issuing and Point-to-Point Encryption (P2PE) processing.

Benefits of Next-Gen Financial Cloud HSMs

Core-to-Cloud Digital Transformation

Enable core-to-cloud digital transformation and instantly add resilience to your security profile. In mere seconds, your team can be connecting HSMs to payment applications & cloud instances through TLS-secured Cryptotunnels via the Cryptoverse.

STREAMLINED DEPLOYMENT & SELF-SERVICE

Rapidly provision cloud HSMs on-demand in different PCI zones including acquiring/P2PE, issuance or test. Connection whitelisting ensures only trusted applications can access cloud HSM services.

HIGH AVAILABILITY & DISASTER RECOVERY

Ensure high fault tolerance by configuring cloud HSMs to be highly available and have full disaster recovery capabilities. Cloud HSMs can be configured and automated as failover devices in the event regional processing resources are unavailable.

CUSTOM SCALABILITY & ORCHESTRATION

Experience user-controlled clustering of cloud HSMs with automated key & settings syncing, flexible throughput and high availability options.

Core-to-Cloud Architecture & Automation

Instantly provision Next-Gen HSMs with the VirtuCrypt Intelligence Portal (VIP). The VIP is an intuitive dashboard that allows for secure management and monitoring of your entire cloud HSM environment, audit logs, and tracking account activity from a single location. Easily migrate from on-premises to cloud HSMs with a single click on the VIP. With our Cloud HSM Software Development Kit (SDK), your team can natively integrate cloud crypto processing & key management into your own applications.

Native Omni-Cloud & Hybrid Integration

Next-Gen Financial Cloud HSMs are specialized devices built to support critical financial cryptographic and key management services, but can be implemented in a variety of ways best fit for any security architecture. Through VirtuCrypt Access Points (VAPs), a single set of Next-Gen Financial Cloud HSMs can be utilized across multiple regions within a single cloud provider. Virtucrypt CryptoTunnels allow for turnkey connection security ensuring communications between on-premise apps, cloud HSMs and cloud-hosted applications.

CRYPTOVERSE

Utilizing a PKI managed by VirtuCrypt, a Cryptoverse isolates which services the public cloud applications have access to. A Cryptoverse is used to ensure mutual authentication and strong encryption with all endpoints, whether those are cloud HSM services, incoming connections to VirtuCrypt, access points like load balancers and edge systems, or client applications.

VIRTUCRYPT ACCESS POINT (VAP)

A VirtuCrypt Access Point (VAP) is a VirtuCrypt-owned Virtual Private Cloud. Virtual Private Clouds allow for a logically separated section of the public cloud where an organization, in this case VirtuCrypt, defines its own virtual network. The VAP enables access to VirtuCrypt from a public cloud in a secure manner without directly transiting the Internet, and it also offers connectivity for a range of other access methods.

CRYPTOTUNNEL

A CryptoTunnel defines the connection parameters to VirtuCrypt. It consists of a name, the Cryptoverse used to authenticate incoming clients, the service that the tunnel will be routed to (the cloud HSM), the incoming channel (Internet, public cloud, etc.), the public cloud provider, the region of the public cloud that will be operated in, and any information that must be whitelisted.

END POINTS / PRIVATE LINK

The endpoint allows your organization to access VirtuCrypt in the public cloud. An endpoint must be designated on the VirtuCrypt Access Point to create the communication channel between the public cloud and the VirtuCrypt cloud HSM.

Cloud HSM Snapshot Technology

Easily scale & backup Next-Gen Financial Cloud HSMs with the new Snapshot feature. Administrators can save or “snapshot” any Next-Gen Cloud HSM for future replication or store snapshot as a backup service to re-provision production HSMs on-demand. With the Snapshot feature, establishing new environments is simple with no configuration headaches.

Use Cases

  1. Seamlessly backup active cloud HSMs
  2. Create cloud HSM templates to avoid repetitive configuration activities
  3. Store snapshots on VirtuCrypt backup service for provisioning on-demand
  4. Enable and disable cloud HSMs with the click of a button for both testing and production environments

 

Key Management Methods

 

Key Agent Services

For organizations requiring key management assistance, VirtuCrypt’s CTGA-accredited key agent team can compliantly load keys into HSMs. With this service, VirtuCrypt handles the generation, handling, and storing of key components, but the ownership of the keys remains with the customer throughout this process.

When keys need to be accessed, VirtuCrypt securely generates and prints key components in tamper-evident envelopes before mailing them to the customer. This convenient option ensures customers have access to keys at any point in time, without the responsibility of generating and loading them into the HSM.

Bring Your Own Key (BYOK)

Organizations requiring self-management of encryption keys to protect their most sensitive data through the Bring Your Own Key (BYOK) methodology can confidently manage keys in VirtuCrypt cloud HSMs. The Excrypt Touch is Futurex’s FIPS 140-2 Level 3 and PCI HSM validated tablet that allows organizations to securely manage their own encryption keys from anywhere in the world. With the Excrypt Touch, administrators can securely establish a remote TLS connection with mutual authentication and load clear master keys to VirtuCrypt cloud HSMs.

Hardware Security Module Generation

Administrators can randomly generate major keys using the random number generator of their cloud HSMs, although this method of key management is very rarely used in financial environments. This is due to key exchange requirements between various stakeholders in the transaction processing workflow. Without sharing keys, these entities would not be able to communicate with each other.

 

Download Financial Cloud HSM Whitepaper

Integrate Financial Cloud HSMs with Public Clouds

As the demand for cloud services increases and many financial acquiring, issuing, and Point-to-Point Encryption application providers take a cloud-native approach, organizations are also starting to look to their financial hardware security module vendors for native cloud solutions. You can learn more about financial cloud HSMs utilization and integration by downloading our white paper or book a personalized product demo with a VirtuCrypt Solution Architect.

Topics: {Payment processing} {PIN & PAN validation} {Vaultless tokenization} {Mobile payment acceptance}