Security Features & Benefits

FIPS 140 – 2 level 3 certification

(in evaluation, expected completion 2006)

The FIPS 140 - 2 level 3 certification confirms that the ProtectServer Gold is qualified to detect and protect against attempted physical and logical attacks, as well as perform secure cryptographic processing including correct implementations of several commercially significant and approved cryptographic algorithms.

Tamper-protected physical security

Tamper-protected physical security, incorporating tamper-responsive circuitry, ensures that all information stored within the secure memory is cleared in the event of a break-in attempt to the device.

Secure, battery-backed memory for key storage

4Mb of battery-backed secure key storage is available to safely store and maintain the integrity of symmetric cipher keys, asymmetric keys, certificates, and sensitive data. The battery provides back-up power to the tamper-sensing electronics when no system power is available. Any detected tamper event, including removing the battery from the HSM, or the HSM from the PCI bus slot, will immediately activate key memory erasure.

True Random Number Generator (RNG)

ProtectServer Gold allows the generation of truly random cryptographic keys that ensure the required level of entropy essential for the highest levels of security. This is achieved using true Random Number Generator (RNG) meeting ANSI X9.31 requirements and certified to the requirements of FIPS 140.

Smart Card key transfer

Storage of cryptographic keys on smart cards minimizes human error when entering keys into multiple HSMs and significantly speeds up the process of configuring a pool of identically-keyed HSMs in a high-availability production environment. Additionally, the storage of keys on smart cards delivers secure key back-up in the event of tamper-activated memory erasure, upgrade, maintenance, or key transfer from one HSM to another.

Direct connection of smart card reader and PIN pad

Secure PIN pad entry devices can be connected to the HSM for direct entry of PINs and key components. This eliminates insecure data entry paths via keyboards, operating system processes and memory.