enclaive vHSM Certified

A virtual HSM combines enclaive Vault key, identity and access management with Nitride workload identity access management in a single service with hardware graded security and confidential buckypaper virtualization tailored to the private, hybrid multi-cloud settings.

Buckypaper Virtualization

In the cloud context, the atomic execution environment is considered to be a Virtual Machine (VM). A VM is an isolated, self-contained environment that provides the abstraction of a full-fledged physical machine. It runs on top of a hypervisor, which virtualizes the underlying hardware resources. VMs offer strong isolation, as each VM has its own operating system, file system, and network stack. This makes them an atomic unit of execution because they encapsulate everything needed for an application to run, independent of other VMs on the same physical server.

Buckypaper VMs shield the workload in an execution environment and ensure both confidentiality and integrity of the execution. This means that at all times, the data and code must remain encrypted and safeguarded from unauthorized modifications, whether in memory, on a storage volume, or during network communication. The service can only be fully protected from threats if these measures are consistently applied throughout the entire lifecycle of key management, identity management, and access control.

Deploying cloud-native applications introduces new challenges in key, identity, and access management, as well as key protection mechanisms such as Hardware Security Modules and Bring Your Own Key. These challenges become particularly pronounced in multi-cloud environments, where traditional solutions often fall short.

Some of the key problems include:

Single Point of Trust: Single Point of Trust: Organizations must ultimately trust the cloud service provider (CSP) to securely manage their keys and identity systems in a "take-it-or-leave-it" approach. This trust extends to the CSP’s internal personnel, including engineers, DevOps, and DevSecOps teams, who may have access to these systems. As a result, organizations must accept the potential risks associated with having multiple, often unknown, individuals who might gain access to their sensitive data and services.

Single Point of Attack: CSPs handle a vast number of clients, making them attractive targets for attacks, espionage, or compromise. In the past, targeting individual businesses required substantial effort and resources, but with the shift to cloud services, the economics of attacks have changed. Once attackers find vulnerabilities in a CSP's infrastructure, they can potentially gain access to multiple organizations at once.