We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Security Architecture
Free preview: the first 2 parts of this 6-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Architecture
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
A cloud KMS encrypts your keys at rest and controls access through IAM policies. But the keys still exist in software, on servers managed by the cloud provider. For most applications, this is sufficient. But for certain use cases, regulators and risk profiles demand that keys never exist in extractable form, even in the cloud provider's memory.
Payment card processing under PCI-DSS requires that PIN encryption keys be stored in tamper-resistant hardware. Certificate Authority root keys must be in FIPS 140-2 Level 3 hardware to be trusted by browser root programs. Cryptocurrency exchanges holding billions in customer funds use HSMs so that even a complete server compromise cannot extract the signing keys.
Visa processes 65,000 transactions per second globally. Every one of those transactions involves PIN translation and verification that happens inside HSMs. The HSM performs the operation and returns the result, but the key itself is never extracted, never copied, never visible to any software running on any server.
AWS CloudHSM costs $1.50/hour per HSM instance (roughly $1,100/month). Azure Dedicated HSM runs $4,000 to $5,000/month. Compare that to AWS KMS at $1/key/month. The price difference reflects the physical security guarantee.
An HSM is a physical appliance (or a cloud-dedicated one) that generates cryptographic keys inside itself and performs sign, verify, encrypt, and decrypt operations without ever exposing the key material. You send data in, get results out. The key stays inside.
FIPS 140-2 validation levels:
| Level | Protection | Who Uses It |
|---|---|---|
| Level 1 | Basic software security. No physical protection | Software crypto libraries (OpenSSL). Cheapest, weakest |
| Level 2 | Tamper evidence. Seals show if the device was opened | Low-security applications. You know someone tampered, but they got in |
| Level 3 | Tamper resistance. Active defense: detects tampering and zeroizes keys immediately | Payment processors, CAs, most production HSMs. AWS CloudHSM, Thales Luna |
| Level 4 | Envelope of protection against all physical penetration. Temperature, voltage, radiation sensors | Rare. Military, nuclear, and specific government applications |
Most production HSMs are FIPS 140-2 Level 3. The device continuously monitors for physical intrusion. Drill the case, pull the battery, exceed temperature thresholds, or apply abnormal voltage, the HSM detects the tamper attempt and zeroes all key material before the attacker can read anything. The keys are physically destroyed.
Cloud HSM options:
| Provider | Service | Certification | Cost |
|---|---|---|---|
| AWS | CloudHSM | FIPS 140-2 Level 3 | ~$1,100/month per instance |
| Google Cloud | Cloud HSM | FIPS 140-2 Level 3 | Included in Cloud KMS pricing for HSM-backed keys |
| Azure | Dedicated HSM (Thales Luna) | FIPS 140-2 Level 3 | ~$4,000-5,000/month |
| Azure | Managed HSM | FIPS 140-2 Level 3 | ~$3,200/month |
Key ceremonies. When an HSM is initialized or a root CA key is created, a formal key ceremony takes place. Multiple trusted individuals (key custodians) each hold a smart card containing one share of the HSM's master key. A (e.g., 3 of 5 custodians) must be physically present to activate the HSM. The ceremony is videotaped, witnessed, and documented. This is how the root CAs that your browser trusts were created.