TryTRY
BuyBUY
  • newsletter
  • contact
  • corporate
  • careers
Utimaco
TRYour free HSM simulator
BUYget a quote
  • home
  • solutions
  • products
  • services
  • blog
  • downloads
  • partners
  • company

Utimaco Portal

Here you will find everything you need as a partner and customerLogin required

  • home
  • solutions
    • industries
      • banking and financial services
        • acquirer
        • card scheme
        • issuer
        • hsm-as-a-service
      • government
        • federal government
      • cloud
        • cloud-based innovation
        • multi-cloud agility
      • connected car (V2V)
      • automotive solutions
      • road infrastructure (V2I), toll collection & ITS
      • industrial IoT & manufacturing
      • energy & utilities
      • lottery & gaming
      • media & entertainment
      • telecommunications
    • applications
      • authentication
      • blockchain
      • code signing
      • database encryption
      • document signing
      • key injection
      • post-quantum crypto agility
      • public key infrastructure (PKI)
        • EJBCA
      • random number generator (RNG)
    • compliance
      • certifications & approvals
        • Common Criteria (CC)
        • FIPS 140-2
      • compliance & standardization
        • FISMA, FedRAMP, and FICAM
        • Certificate Policy of the Smart Metering PKI
        • eIDAS
        • GDPR
        • PCI DSS
        • Privacy Shield
  • products
    • general purpose HSM
      • SecurityServer Se Gen2
      • SecurityServer CSe
      • Block-safe
      • CryptoServer CP5 (eIDAS & CC)
      • CryptoServer Cloud
      • TimestampServer
      • Q-safe
    • payment HSM
      • Atalla AT1000
      • PaymentServer Se Gen2
      • PaymentServer CSe
      • Secure Configuration Assistance (SCA)
      • QuickStart Services
      • u.cloud – Atalla PaymentHSMaaS
      • u.trust 360
    • key management
      • Enterprise Key Management
    • Software Development Kit (SDK)
      • CryptoServer SDK
      • CryptoScript SDK
    • HSM simulators
      • Block-safe HSM simulator
      • CryptoServer CP5 simulator (eIDAS & CC)
      • SecurityServer simulator
      • Q-safe HSM simulator
    • form factor
      • LAN appliance
      • PCIe card
      • cloud, “HSM as a Service”
    • KeyBRIDGE
      • KeyBRIDGE POI
      • KeyBRIDGE RKD
      • KeyBRIDGE eKMS
      • TokenBRIDGE™
    • u.trust Anchor
      • u.trust Anchor CSAR
      • u.trust Anchor High Performance HSM
  • services
    • consultancy
      • PQC consultancy
    • support
    • managed services
      • Key Exchange & Escrow Service (KEES™)
    • professional services
    • Utimaco Academy
  • blog
  • downloads
    • brochures
    • data sheets
    • case studies
    • white papers
    • webinars
    • e-books
      • PQC for Dummies e-book
      • HSM for Dummies e-book
    • Utimaco Portal
      • integration guides
      • knowledge base
  • partners
    • Partner Program
      • technology partner
    • Partner Locator
  • company
    • about Utimaco
      • legal
      • terms & conditions
      • privacy
        • cookie-policy
    • locations
    • news
      • newsletter
    • events
    • contact
    • careers
    • investors
    • utimaco management
    • business ethics
    • memberships and certifications
    • engagement in research
  • home
  • solutions
    • industries
      • banking and financial services
        • acquirer
        • card scheme
        • issuer
        • hsm-as-a-service
      • government
        • federal government
      • cloud
        • cloud-based innovation
        • multi-cloud agility
      • connected car (V2V)
      • automotive solutions
      • road infrastructure (V2I), toll collection & ITS
      • industrial IoT & manufacturing
      • energy & utilities
      • lottery & gaming
      • media & entertainment
      • telecommunications
    • applications
      • authentication
      • blockchain
      • code signing
      • database encryption
      • document signing
      • key injection
      • post-quantum crypto agility
      • public key infrastructure (PKI)
        • EJBCA
      • random number generator (RNG)
    • compliance
      • certifications & approvals
        • Common Criteria (CC)
        • FIPS 140-2
      • compliance & standardization
        • FISMA, FedRAMP, and FICAM
        • Certificate Policy of the Smart Metering PKI
        • eIDAS
        • GDPR
        • PCI DSS
        • Privacy Shield
  • products
    • general purpose HSM
      • SecurityServer Se Gen2
      • SecurityServer CSe
      • Block-safe
      • CryptoServer CP5 (eIDAS & CC)
      • CryptoServer Cloud
      • TimestampServer
      • Q-safe
    • payment HSM
      • Atalla AT1000
      • PaymentServer Se Gen2
      • PaymentServer CSe
      • Secure Configuration Assistance (SCA)
      • QuickStart Services
      • u.cloud – Atalla PaymentHSMaaS
      • u.trust 360
    • key management
      • Enterprise Key Management
    • Software Development Kit (SDK)
      • CryptoServer SDK
      • CryptoScript SDK
    • HSM simulators
      • Block-safe HSM simulator
      • CryptoServer CP5 simulator (eIDAS & CC)
      • SecurityServer simulator
      • Q-safe HSM simulator
    • form factor
      • LAN appliance
      • PCIe card
      • cloud, “HSM as a Service”
    • KeyBRIDGE
      • KeyBRIDGE POI
      • KeyBRIDGE RKD
      • KeyBRIDGE eKMS
      • TokenBRIDGE™
    • u.trust Anchor
      • u.trust Anchor CSAR
      • u.trust Anchor High Performance HSM
  • services
    • consultancy
      • PQC consultancy
    • support
    • managed services
      • Key Exchange & Escrow Service (KEES™)
    • professional services
    • Utimaco Academy
  • blog
  • downloads
    • brochures
    • data sheets
    • case studies
    • white papers
    • webinars
    • e-books
      • PQC for Dummies e-book
      • HSM for Dummies e-book
    • Utimaco Portal
      • integration guides
      • knowledge base
  • partners
    • Partner Program
      • technology partner
    • Partner Locator
  • company
    • about Utimaco
      • legal
      • terms & conditions
      • privacy
        • cookie-policy
    • locations
    • news
      • newsletter
    • events
    • contact
    • careers
    • investors
    • utimaco management
    • business ethics
    • memberships and certifications
    • engagement in research

Home / Blogs / Managing Millions of Keys with the Utimaco Enterprise Secure Key Management system (ESKM)

Managing Millions of Keys with the Utimaco Enterprise Secure Key Management system (ESKM)

November 09, 2020

This article introduces the Utimaco Enterprise Secure Key Management system (ESKM). It explains how the ESKM server can comfortably interact with cryptographic and storage devices from various vendors.

A Bit of History

On October 16, 2018, a US branch of the German-based company Utimaco GmbH was cleared to acquire the Utimaco HSM product line, the Enterprise Security Manager (“ESKM”) product line, and related supporting assets, including applicable patents and other IP. Atalla was sold to Utimaco by Micro Focus International plc, an infrastructure software company.

Utimaco CEO, Malte Pollmann, described the acquisition as: “This is a significant milestone, and we look forward to bringing the Atalla team under the information security umbrella of Utimaco. After several changes of ownership, we are happy to offer Atalla a long-term home in our HSM and information security business.”

What is an ESKM Made for?

ESKM is an Enterprise Secure Key Management system. Its role is to store and maintain general purpose cryptographic keys in a secure and flexible way.

An Enterprise Key Management server is a centralized key management hardware-based system for unifying and automating an organization’s encryption key controls by creating, protecting, serving, and auditing access to encryption keys for secure, reliable administration. So in a nutshell, ESKM is all about key management.

Key Management, a Difficult Challenge

Key management requires dealing with the generation, exchange, storage, use, crypto-shredding (destruction usually via zeroization), and replacement of keys. It is difficult to maintain central controls: If users lose access to keys locally then they lose access to the data.

Key management also needs to enforce a consistent policy such as who manages keys, and with what authorization? Regulatory mandates also require evidence auditing and compliance for protecting keys.

Indeed, it is challenging to coordinate and automate controls that protect access to keys across storage encrypted data while remaining transparent to operations.

Good key management solutions like Utimaco ESKM must be able to:

  • List all certificates with their properties, including the location they are deployed, which is difficult because they can be deployed in a wide range of various sites, and not from a single certificate authority;
  • Keep private keys secure from unauthorized personnel and from any tamperization attempts;
  • Have a strategy ready in case of a system breach and/or compromise of the certificate authority;
  • Exchange keys in a secure way;
  • Change/update keys frequently;
  • Perform key generation, distribution, and replacement;
  • Solve the “Who guards the guards?” problem, e.g. being at least as secure as the encryption system that is handled.

Data-at-Rest or Data-in-Motion Encryption and Key Management

Data-at-rest refers to data that are being stored in “static“ destination systems such as Enterprise Assets/ Encrypted Backups/ Storage Media. Data-at-rest often refers to data that does not travel “frequently” between endpoints in a network.

Conversely, data-in-motion relates to dynamic, transient data that is often transferred from one site to another in a network. This can be data in a secure chat, a VPN, etc.

A third “state of data” is usually referred to as data-in-use. However, we will not be discussing that type at this time.

Data-at-rest and data-in-Motion are encrypted and processed very differently and therefore, the management of their encryption keys by the key management server is critical.

Usually,one might understand data-at-rest encryption at a symmetric key and data-in-motion encryption as an asymmetric key (PKI).

Data-at-rest will be generally be encrypted by a DEK – Data Encryption Key, generated by the Key Management system and encrypted by a KEK – Key Encryption Key. The lifecycle of the DEK must be also be monitored and controlled by the Key Manager.

  1. The key is created using the encryption engine.
  2. The key is then provided to a key vault (Key Manager), and to various other encryption engines.
  3. This key is used for encrypting and deciphering data.
  4. The key is then terminated (or suspended)

Data-in-Motion is generally encrypted by public keys and then decrypted by private keys. For instance, in a VPN, data-at-rest are encrypted by AES. The AES key is considered as data-in-motion and is encrypted by the public key of the receiver by the sender. Then the AES key is deciphered by the recipient using its private key and then the data-at-rest are deciphered using the AES key.

For such a case, the Key Management System must maintain and manage securely these two sets of keys (DEK and private/public keys) so that they could be used in a single process like here with a VPN.

An Overview of Key Management Principles

Here we will review the main principle ruling a Key Management Server, such as the Utimaco ESKM.

Cryptoperiod, Key Lifecycle Policy and Management

A crypto period is the time span during which a specific key is authorized for use. The span could range from 1 to 3 years (asymmetric cryptography) or 1 to 7 days (symmetric traffic keys). At the end of a cryptoperiod a key change occurs, which is a critical protocol where keys will be updated.

Here we present the general computation of a cryptoperiod as the sum of the data  encryption period (the initial time when data I encrypted and loaded) and the usage period (the time during which the keys will be actively used in the system).

Computation of a crypto period

Other considerations can mitigate that computation, including:

  • How long will the data be used?
  • How is the data being used?
  • How much data are there?
  • How sensitive is the data?
  • How much damage will be done if the data are exposed or the keys are lost?

This refers to the fact that the more sensitive a key is, the shorter crypto-period it will have.

The following is a typical Key Lifecycle as managed by an ESKM:

Key-Life-Cycles-Utimaco

Access Control

A good Key management system will usually provide ways to implement the following access control strategies:

  • Separation of duties. E.g. different roles are streamed along different individuals (administrators, developers,…) so that critical functions are divided, and that a single individual does not hold all the power.
  • Dual Control. Two or more individuals are needed to control a single process (e.g. the opposite of separation of duties)
  • Split Knowledge. A passphrase is needed to create encryption and duties are split between two individuals. This is a combination of separation of duties and Dual Control.

Domains, Access Controls, and Platforms

Physical security is required to protect the key manager itself is naturally achieved with an HSM.

A FIPS 140-2 certified HSM should be used. For instance, this can be done by using an Utimaco HSM combined with an Utimaco ESKM.

While HSMs can obviously store keys in very secure ways, they cannot manage and search among millions of keys in the same way as a Key Management server can. Protected memory is expensive and has limited storage capacity. Hence, the right combination is HSM+ESKM.

Keys should be physically separated by roles and nature. For example, DEKs and KEKs should not be stored in the same location. As a general rule, keys of different nature, encrypted data, and other components should be separated in partitioned zones.

ESKM and the Key Management Interoperability Protocol (KMIP)

The OASIS Key Management Interoperability Protocol is a very important concept that allows interoperability in key management. Utimaco ESKM implements KMIP.

The KMIP protocol allows all sorts of operations to exchange keys with other key managers from different vendors while using the KMIP as well. Operations include:

Create Keys, register keys, generate replacement keys, derive key, recertify search keys, activate, backup, revoke, destroy, etc.

Here we show how the Utimaco ESKM server can interact with different cryptographic and storage devices from different vendors through OASIS KMIP.

Here we show how the Utimaco ESKM server can interact with different cryptographic and storage devices from different vendors through OASIS KMIP.

Other Key Management Component Vendors

There are several other vendors that provide Key Management tools. For your general information, here is a list of the ones that are KMIP compliant and are able to interact with Utimaco ESKM:

  • Bloombase
  • Cryptsoft
  • ETI-Net
  • Fornetix
  • Hitachi / HDS
  • NetApp
  • OpenStack com
  • Project 6
  • ZettaSet

Summary

An organization that uses cryptography should deploy key management systems to securely control the keys it uses instead of “leaving the keys on the dashboard.”

The Utimaco ESKM is a versatile, powerful, and secure Key Management System that allows such tasks to be fulfilled, and can securely interact with other KMIP devices.

New call-to-action

Some Further References

NIST has published a complete guide of best practices and recommendations for using a key management system. Two parts of the guide that contain useful information that is relevant to the selection and deployment of a Key Management System, such as the Utimaco ESKM are:

  • SP 800-57 Part 1 Rev. 4 – Recommendation for Key Management, Part 1: General (Revision 4) (January 2016), by Elaine Barker, NIST
  • NIST Special Publication 800-57 Part 2 Revision 1- Recommendation for Key Management: Part 2 – Best Practices for Key Management Organizations (May 2019), by Elaine Barker; William C. Barker
Back to overview

Stay on top of our news
Don’t miss out on any Utimaco updates

Subscribe to Utimaco Newsletter

We will keep you posted with news from Utimaco and the industries we protect, as well as information on upcoming events and webinars.

Subscribe now

Partners

PKI Solutions Inc. Compumatica secure networks GmbH Altacom UAB Cyber Armor Pte Ltd Nexus - Utimaco Hardware Security Modules Partner Rohde & Schwarz Cybersecurity GmbH CertiSur S.A. CewTec S.A. cv cryptovision GmbH Safesoft Kft. Telegrupp AS Astel (UK) Ltd. - Utimaco Hardware Security Modules Partner Fornetix - Utimaco Hardware Security Modules Partner Abrantix AG Utimaco HSM - InfoGuard Swiss Cyber Security MALKOM D.Malińska i Wspólnicy s.j. Nexus Technology GmbH Compumatica secure networks B.V. CREA plus d.o.o. SecureMetric Technology Sdn. Bhd. Synergy Computers (Pvt.) Ltd. - Utimaco Hardware Security Modules Partner Komar Consulting Inc. - Utimaco Hardware Security Modules Partner AKEA S.A. - Utimaco Hardware Security Modules Partner Macroseguridad Nexus - Utimaco Hardware Security Modules Partner Cogito Group Pty Ltd CREAplus Italia S.r.l E-Sign S.A. JJNet International Co., Limited - Utimaco Hardware Security Modules Partner Cryptomathic Inc. Baas Control s.r.o. intarsys AG ESYSCO Sp. z o.o. Fortiedge Pte Ltd. CEGA Security Perceptus-sp.-z-o.-o. Softline Solutions GmbH Versasec Ascertia - Utimaco Hardware Security Modules Partner Cryptomathic GmbH Thomas-Krenn.AG EUROPEAN DYNAMICS SA. MTG - Utimaco Hardware Security Modules Partner Skytech Computing Solutions Limited. - Utimaco Hardware Security Modules Partner Primekey Solutions AB MIcrosec Real security d.o.o. PETA (Thailand) Co., Ltd. VAR Group SpA - Utimaco Hardware Security Modules Partner IQuantics Corp Utimaco HSM - PTESA_profesionales en transacciones electronicas Secure Source Distribution (M) Sdn Bhd - Utimaco Hardware Security Modules Partner Encryption Consulting LLC PrimeKey Labs GmbH Throughwave (Thailand) Co.,Ltd - Utimaco Hardware Security Modules Partner Utimaco HSM - QuintessenceLabs Clearkey Consulting - Utimaco Hardware Security Modules Partner Envoy Data Corporation - Utimaco Hardware Security Modules Partner Microexpert Limited Cryptomathic A/S
Find a partner

Share this page

EMEA

Utimaco IS GmbH
Germanusstraße 4
52080 Aachen
Germany
Phone: + 49 241 1696 200

Americas

Utimaco Inc.
900 E Hamilton Ave., Suite 400
Campbell, CA 95008
USA
Phone: +1 844 UTIMACO

APAC

Utimaco IS Pte Limited
80 Raffles Place,
#32-01, UOB Plaza
Singapore 048624
Phone: +65 6622 5347

Utimaco

  • support
  • corporate
  • careers
  • legal
  • terms & conditions
  • privacy
  • cookie-policy
© 2021
to top
  • home
  • solutions
    • industries
      • banking and financial services
        • acquirer
        • card scheme
        • issuer
        • hsm-as-a-service
      • government
        • federal government
      • cloud
        • cloud-based innovation
        • multi-cloud agility
      • connected car (V2V)
      • automotive solutions
      • road infrastructure (V2I), toll collection & ITS
      • industrial IoT & manufacturing
      • energy & utilities
      • lottery & gaming
      • media & entertainment
      • telecommunications
    • applications
      • authentication
      • blockchain
      • code signing
      • database encryption
      • document signing
      • key injection
      • post-quantum crypto agility
      • public key infrastructure (PKI)
        • EJBCA
      • random number generator (RNG)
    • compliance
      • certifications & approvals
        • Common Criteria (CC)
        • FIPS 140-2
      • compliance & standardization
        • FISMA, FedRAMP, and FICAM
        • Certificate Policy of the Smart Metering PKI
        • eIDAS
        • GDPR
        • PCI DSS
        • Privacy Shield
  • products
    • general purpose HSM
      • SecurityServer Se Gen2
      • SecurityServer CSe
      • Block-safe
      • CryptoServer CP5 (eIDAS & CC)
      • CryptoServer Cloud
      • TimestampServer
      • Q-safe
    • payment HSM
      • Atalla AT1000
      • PaymentServer Se Gen2
      • PaymentServer CSe
      • Secure Configuration Assistance (SCA)
      • QuickStart Services
      • u.cloud – Atalla PaymentHSMaaS
      • u.trust 360
    • key management
      • Enterprise Key Management
    • Software Development Kit (SDK)
      • CryptoServer SDK
      • CryptoScript SDK
    • HSM simulators
      • Block-safe HSM simulator
      • CryptoServer CP5 simulator (eIDAS & CC)
      • SecurityServer simulator
      • Q-safe HSM simulator
    • form factor
      • LAN appliance
      • PCIe card
      • cloud, “HSM as a Service”
    • KeyBRIDGE
      • KeyBRIDGE POI
      • KeyBRIDGE RKD
      • KeyBRIDGE eKMS
      • TokenBRIDGE™
    • u.trust Anchor
      • u.trust Anchor CSAR
      • u.trust Anchor High Performance HSM
  • services
    • consultancy
      • PQC consultancy
    • support
    • managed services
      • Key Exchange & Escrow Service (KEES™)
    • professional services
    • Utimaco Academy
  • blog
  • downloads
    • brochures
    • data sheets
    • case studies
    • white papers
    • webinars
    • e-books
      • PQC for Dummies e-book
      • HSM for Dummies e-book
    • Utimaco Portal
      • integration guides
      • knowledge base
  • partners
    • Partner Program
      • technology partner
    • Partner Locator
  • company
    • about Utimaco
      • legal
      • terms & conditions
      • privacy
        • cookie-policy
    • locations
    • news
      • newsletter
    • events
    • contact
    • careers
    • investors
    • utimaco management
    • business ethics
    • memberships and certifications
    • engagement in research