On Line Secure Elements: Deploying High Security Keystores and Personal HSMs

This paper presents innovative approach to deploy secure elements providing cryptographic resources in TCP/IP environment. The main idea is to execute in secure element, TLS1.3 server, secured by 256 bits pre-shared-key. All cryptographic resources are protected by TLS-PSK sessions. In the user plane the secure element is a TLS server, what enables to define uniform resource identifier (URI) for embedded resources. The user is optionally equipped with access card (TLS identity module) that stores procedures working with PSK. The security level may be increased by the use of dedicated terminal, similar to payment terminal, which protects dual factor authentication. We present two open platforms: keystore devices hosting preconfigured TLS-SE secure elements, and personal HSM supporting on-demand TLS-SE applications. Finally we detail some performance elements.