Virtual HSM

Virtual HSM (VHSM) is a software suite for storing and manipulating secret data outside the virtualized application environment. While HSM is a physical device connected to the computer, this software provides HSM functionality in virtual environment based on OpenVZ container technology.

Structure

The project consists of the following key components:

VHSM virtual environment

VHSM VE is the isolated environment that contains the VHSM server and secure storage. The server performs operations on secret data and storage keeps encrypted user data

Transport layer

transport exchanges data between client and server virtual environments; based on Netlink

Client virtual environment

client API and accompanying utilities for accessing the VHSM server from a client environment

Details

VHSM virtual environment

The VHSM VE contains the secure storage which is the database that stores the sensitive data in the encrypted form while other data (import date, purpose, etc) are stored unencrypted. The encryption key (master key) is generated from the user password using PBKDF2, and the salt that is used in the function is stored unencrypted in database. Thereby the VHSM doesn't keep the encryption key and utilizing PBKDF2 reduces the brute-force attack rate significantly if the database is compromised. The VHSM server is responsible for user authentication, interaction with the secure storage, and performing cryptographic operations. A client must be registered in the system to work with VHSM, so it reports its credentials to the VHSM admin. When the client is registered in the system a 256-bit authentication key is generated and encrypted in GCM mode using the master key. The GCM mode guarantees integrity and confidentiality of the user data and therefore makes it possible to authenticate the encryption key derived from the user password. The VHSM uses this feature for user authentication. A user is authenticated using the login/password pair and the container ID (VEID) where authentication request is received from. When a user is registered it's bound to the set of containers where one can get access to the VHSM from. If the user attempts to access to the VHSM from a non-authorized container the request is refused.

Transport

The data exchanging protocol between clients and the VHSM is written in the Protocol Buffers language. On the one hand, it allows to easily extend the protocol, on the other it's more space efficient compared to XML. In general, a protocol message contains parameters of the API function being called and some service information as well. As mentioned above, inter-container communication is based on Netlink, so the OS kernel contains the module that passes messages between virtual environments while VEs contain the transport API library which interacts with this module via Netlink sockets. The kernel module identifies containers by their VEIDs that are provided by OpenVZ. The VHSM environment ID is passed as a parameter to the module. Messages from other containers are routed to that VEID. The passed message contains serialized protobuf data and the header with the message type, container VEID and process PID. Meaning of these parameters depends on the transfer direction. If the message comes from a client container then the module checks its VEID and forwards the message to the VHSM VE if the container is allowed to send requests to the VHSM. When the kernel module forwards the message it sets the VEID in the message header to the sender VEID and the PID to the sender process PID derived from the Netlink message header. So the VHSM can address the response to the client. If the message is transferred from the VHSM then the VEID and PID in the message header are set by the VHSM itself. It's possible because the VHSM sends responses to the client requests only and never initiates communication with a client.

Client virtual environment

The client part of the VHSM consists from the API-library and some auxiliary tools (such as OpenSSL engines). The VHSM API library provides PKCS#11-like functions for managing sessions and user keys and for digital signing. Client applications may directly call library functions or may use OpenSSL extensions. The VHSM API allows the user to import or generate some secret data (keys). These data is encrypted by AES-GCM algorithm using the user master key and then stored in the database. Then the user gets the data id which allows to use these data in the future. If the user wants to perform a cryptographic operation then one tells key id for this operation to the VHSM. The VHSM extracts the key from the storage, decrypts it and performs computations in its isolated virtual environment while the user gets the result of the operation only. OpenSSL can act as a layer between a client application and the VHSM API library. To achieve that OpenSSL engines can be used. Engines extend the functionality of the OpenSSL and allow to override implementation of some cryptographic algorithms. For example, OpenSSL engines make it possible to use a physical cryptographic device without modifying the code of the client program.

Building

Install the following packages to build the project on your system. On CentOS use EPEL repositories

Package	Debian	CentOS
CMake 2.8	cmake	cmake28
OpenVZ kernel headers	linux-headers-2.6.32-5-openvz	vzkernel-headers
Google protobuf compiler	protobuf-compiler	protobuf-compiler
libprotobuf	libprotobuf-dev	protobuf-devel
crypto++ 5.6.2	libcrypto++-dev	cryptopp-devel
SQLite 3	libsqlite3-dev	sqlite-devel
cppunit (optional)	libcppunit-dev	cppunit-devel

To build the project just run cmake and then make. You may build binary packages with the command make pkg.

Installation

You may use binary packages or install manually:

• VHSM VE: vhsm, vhsm_admin
• Client VE: libvhsmapi.so, vhsm_user_admin
• Host: vhsm_transport.ko

Usage

To run VHSM perform the following steps:

1. insert transport module: insmod vhsm_transport.ko vhsm_veid=%veid% where %veid% is VEID of the VHSM container
2. create secure storage in the VHSM VE: vhsm_admin i /path/to/storage
3. add VHSM user: vhsm_admin c /path/to/storage login password
4. start VHSM in the VHSM container. You can specify the path to the secure storage in program arguments
5. run vhsm_user_admin from client VE