HSM Attest – Market Position

HSM Attest - Market Position

Back to Documentation Map

This page describes where HSM Attest fits into the existing market dominating ecosystem.

Existing Marketplace

The marketplace for tools supporting security in cloud deployed IT Systems currently includes the following main elements:

Cloud Hosters

These can be

• Hyperscalers such as AWS, Google, Azure.
• Regional organisations, offering some degree of control over the location and management of the host data centers. ("Sovereign", local,... ). May be sub-divisions of hyperscalers.
• Cloud software stack providers (red hat, ...) allowing self-hosting by an IT System Owner or other third party operator. ("on-premise")

HSM Attest aims to work in all these environments. The main factor determining this will be the availability of confidential computing platforms and the ability to host/supply HSMs.

HSM Suppliers

HSMs can be bought and operated on premise, but it is becoming more common for them to be installed in a data centre belonging to someone other than the System Owner, either as a directly managed hardware installation or, increasingly as virtual HSMs consisting of a secure partition on a physical HSM and made available to a system Owner/Operator as a managed and hosted service. e.g. Thales Slots, Utimaco cHSMs.

HSM Attest is limited to running on HSMs allowing installation of the CCHSM custom HSM firmware. At the moment this is only available for Utimaco General Purpose HSMs, but the goal is to implement it for other HSM Vendors too. HSM Attest will work on any system making HSM instances available on which the custom firmware can be installed and on which basic HSM Governance is passed to the System Owner/Operator.

Confidential Computing Suppliers

These are companies selling frameworks to build applications into confidential workloads for different hardware architectures (SGX, AMD/SEV, etc.) and often include a module that manages security by provisioning,, i.e. allows specification of provisioning secrets that will only be supplied to workloads following successful attestation and validation against workload whitelists. e.g. Scontain, Edgeless, Enclaive etc. Open Source standards and source codebases are often used, e.g. KAtA/CoCo.

These companies' products do a very similar job to HSM Attest, but do not provide the level of protection against side channel and supply chain attacks that HSM Attest can. They do however offer powerful High Availability support, especially scalability through containerised delivery on Kubernetes or similar platforms. The main vulnerabilities of these frameworks are due to the complexity and opaqueness of their implementations.

HSM Attest is positioned as a cooperation with these products where the workload of an application, including the potentially CPU-intensive use of derived and temporary secrets supplied by an HSM is carried out in confidential computing workloads built and running using one of these frameworks, but where root secrets are kept and remain only inside HSMs and may only be used by workloads that have successfully attested themselves against the HSM Attest Governance for those HSM artefacts.

See HSM Solution for more details.