Skip to main content
Image
purple hex pattern
Image
illustration of person in front of cloud with rainbow

Own the keys, not the HSM

nShield as a Service is a subscription-based solution for generating, accessing, and protecting cryptographic key material, separately from sensitive data, using dedicated FIPS 140-2 Level 3 certified nShield Connect HSMs. The solution delivers the same functionality as on-premises HSMs and the benefits of a cloud service deployment, without the need to host and maintain the appliances.

Ready for migration or a mixed approach

Because nShield as a Service benefits from the same unique Security World architecture as on-prem nShield deployments, you can easily migrate your cryptographic operations from on-prem to the cloud, or use a hybrid approach, mixing both cloud-based and on-prem nShield HSMs for increased redundancy and reliability.

Image
man smiling while looking at mobile phone
Image
man on headset talking with hand gestures

Simplify your migration

Looking for a pain-free migration without the hassle? The Entrust Cloud Concierge service delivers a seamless transition from your on-premises nShield HSM estate to nShield as a Service. Our Professional Services team will work with you to plan and execute the smooth migration of your existing keys, clients, and applications.

Adopt cloud-based RESTful APIs

Developing new cloud native applications and wishing to take advantage of efficient and dynamic scalability? Our nSaaS Web option allows you to easily access cryptographic resources with the flexibility that web services provide.

Image
woman at laptop with coffee
Beyond Security

nShield as a Service Benefits

Image
map marker icon

Geo-fencing

Regional data centers facilitate geo-fencing to meet cloud data security and data sovereignty mandates.

Image
icon of cloud with padlock

Crypto Security + Cloud Strategy

Advance your cloud-centric strategies with FIPS 140-2 Level 3 protection for your business-critical apps and data.

Image
interlinking hoops icon

Maintain Full Control of Your Keys

Supports multi-cloud/hybrid deployments with the same consistent toolset. Flexibility to migrate workloads on premises or to another CSP.

Image
icon of laptop and mobile phone

Secure Code Execution

The CodeSafe secure execution capability provides on-demand access to your organization's secure, sensitive code protected inside the HSM.

Choose the service and level that’s right for you

Basic, Standard, Premium or Enterprise as Self Managed or Fully Managed to meet your needs.

Service Options

Features

Signatures/sec (2K RSA)
Number of HSM Instances
High-Availability - Multi Geo location
Committed SLA
Number of Application Integrations
Fully Managed Option

BASIC

150
1 x HSM
no
99%
3
no

STANDARD

300
2 x HSM
yes
99.9%
10
yes

PREMIUM

6,000
2 x HSM
yes
99.9%
100
yes

ENTERPRISE

16,000
2 x HSM
yes
99.9%
1,000
yes

Service Level

Service Features

Access to dedicated nShield Connect hardware hosted in secure data center
Use nShield Remote Administration kit to securely connect to and interact with your hosted nShield HSM(s)
Maintenance & Support
Service monitoring
Pre-tested upgrades/patches applied during annual or emergency maintenance
24/7 Support
Full management of Security World installation by Entrust
Security Officer role fulfilled by trusted Entrust personnel
Policy and process development under ISO 27001 compliant policies & procedures
Security World creation
HSM enrollment
Signing ceremonies

Self Managed

yes
yes
yes
yes
yes
yes
no
no
no
no
no
no

Fully Managed

yes
yes
yes
yes
yes
yes
yes
yes
yes
yes
yes
yes

Tech Specs

Connectivity

  • IPsec tunnel w/pre-shared keys
  • Between customer Cloud IP space(s) and dedicated, managed nShield HSM environment
  • TLS tunnel to Web Services hosted on AWS (nSaaS Web Option)
  • Transparent to client hosts
  • Takes entire path out of control scope

Certified Hardware Solutions

nShield as a Service is built with nShield Connect HSMs, which help our customers to demonstrate compliance while also giving them the assurance that their HSMs meet stringent industry standards.

nShield Features

nShield as a Service delivers the same features as on-premises nShield HSMs, including CodeSafe, Web Services Option Pack, Container Option Pack and Database Option Pack.

Security Compliance:

  • FIPS 140-2 Level 3

Safety and Environmental Standards Compliance:

  • UL, CE, FCC, RCM, Canada ICES
  • RoHS2, WEEE

Data Center Certifications

Cloud Security Alliance (CSA) Security Trust Assurance and Risk (STAR) - Level 1

Cloud Security Alliance (CSA) Security Trust Assurance and Risk (STAR) logos

 

Wide Support for APIs, Cryptographic Algorithms and Platforms

Supported APIs

  • PKCS#11, OpenSSL, Java (JCE), Microsoft CAPI/CNG and Web Services

Supported Cryptographic Algorithms

  • Asymmetric public key algorithms: RSA, Diffie-Hellman, ECMQV, DSA, KCDSA, ECDSA, ECDH, Edwards (X25519, Ed25519ph), Secp256k1,
  • Symmetric algorithms: AES, AES-GCM, ARIA, Camellia, CAST, RIPEMD160 HMAC, SEED, Triple DES
  • Hash/message digest: SHA-1, SHA-2 (224, 256, 384, 512 bit), HAS-160
  • Full Suite B implementation with fully licensed ECC including Brainpool and custom curves

nShield HSMs offers support for the majority of these cryptographic algorithms as part of the standard feature set. For organizations wishing to use ECC or South Korean algorithms, optional activation licenses are needed.

Supported Platforms

Microsoft Windows and Linux operating systems including distributions from RedHat, SUSE, and major cloud service providers running as virtual machines or in containers.

Deployment Options

nShield as a Service is available in a range of options to meet the needs of your organization. For price sensitive customers a self-managed single HSM instantiation is available in the customer’s preferred location. Standard, Premium and Enterprise customers can specify preferred HSM locations to meet their operational, DR and data sovereignty needs while choosing the optimum performance and price point.

Self-Managed and Fully-Managed Features

Customer has remote access to dedicated nShield Connect hardware hosted in secure data centers

The nShield Remote Administration kit lets you securely connect to and interact with your cloud-based nShield HSM(s)

Maintenance & Support

  • Service monitoring
  • Pre-tested upgrades/patches applied during annual or emergency maintenance windows
  • 24/7 support

Features Exclusive to Fully-Managed Service

  • Full Management of installation
  • Security Officer role fulfilled by trusted Entrust personnel
    • Security World creation
    • HSM enrollment
    • Signing ceremonies
  • Policy and process development
  • Under ISO 27001 compliant policies & procedures
  • All operational staff BS7858 cleared (non-US data centers only)
  • Firmware upgrades, completed with customer consent

Cloud Disaster Recovery

Increase redundancy and reliability of on-premises deployments.

  • Subscription-based service
  • Adds off-site HSM resources
  • Convenient and cost-effective