1 Getting Started with HSM

Release 12.2 Bundle Patch 1 introduced Hardware Security Module (HSM) integration with Oracle Key Vault, where the HSM acts as a “Root of Trust” by storing a top-level encryption key for Oracle Key Vault.

Note:

• HSM integration is limited to Oracle Key Vault 12.2 BP1 and later. The latest release is the recommended path as it contains the latest enhancements.

• If you have an existing Oracle Key Vault installation with HSM and you want to upgrade to a later release of Oracle Key Vault with HSM, you must contact Oracle support.

• Why HSM?
  
• Install HSM Client Software on Oracle Key Vault Server
  
• Enroll Oracle Key Vault as a Client of HSM
  

1.1 Why HSM?

Oracle Key Vault is a full-stack software appliance that contains an operating system, database, and key-management application to help organizations store and manage their keys and credentials. Administrators should deploy Oracle Key Vault in a secure location and typically do not need to access the internal components of the appliance for day-to-day operations. However, there are patching and "break glass" scenarios where administrators might need to physically access the machine, or directly connect to the internal operating system via SSH. When an HSM is deployed with Oracle Key Vault, the Root of Trust (RoT) remains in the HSM. The HSM RoT protects the wallet password, which protects the TDE master key, which in turn protects all the encryption keys, certificates, and other security artifacts managed by the Oracle Key Vault server. This three tier hierarchy greatly mitigates the risk of administrators potentially extracting keys and credentials from systems they can physically access. Note that HSM in this RoT usage scenario does not store any customer encryption keys. Customer keys are stored and managed directly by the Oracle Key Vault server.

Enabling HSM in your Oracle Key Vault installation will not disrupt existing features. You can continue to work with Oracle Key Vault features like high availability, backup, and restore in HSM mode.

HSMs contain tamper-resistant, specialized hardware which is harder to access than normal server memory. Oracle Key Vault can use HSMs to generate and store a Root of Trust (RoT) that protects encryption keys used by Oracle Key Vault to safeguard users' keys and credentials. When using Oracle Key Vault with an HSM, keys and credentials can be read if the RoT stored in the HSM is available. Since HSMs are designed to make the RoT very difficult to extract, this significantly mitigates the risk of compromise of users' keys and credentials. In addition, the HSM can be used in FIPS 140-2 Level 2 or Level 3 mode which can help meet certain compliance requirements.

Note:

Oracle Key Vault can function only if the RoT stored in the HSM is available.

The HSM vendors currently integrated with Oracle Key Vault are: SafeNet Luna SA 7000 and nCipher nShield Connect 6000+.

1.2 Install HSM Client Software on Oracle Key Vault Server

You must first install Oracle Key Vault, then install the HSM client software on the Oracle Key Vault server. You will need to refer to the HSM documentation from the HSM vendor for more information.

To install an HSM on an Oracle Key Vault server:

1. Install the HSM vendor's client software on the Oracle Key Vault server.
2. Ensure that the vendor's software includes a PKCS#11 library.

1.3 Enroll Oracle Key Vault as a Client of HSM

You must enroll Oracle Key Vault as a client of HSM and ensure connectivity between the HSM client and the HSM. You must refer to your specific HSM documentation to complete enrolling Oracle Key Vault as an HSM client.

In general you must:

1. Install the HSM vendor's client software on the Oracle Key Vault server.
2. Ensure that the HSM client software can communicate from Oracle Key Vault to the HSM.