Skip to content

Commit e6fa8b0

Browse files
ttorblettorble
authored
Merge pull request #185326 from msmbaldwin/payment-hsm-pubpreview
Payment HSM (Public Preview)
2 parents 7db74ad + c020b69 commit e6fa8b0

File tree

10 files changed

+379
-0
lines changed

10 files changed

+379
-0
lines changed

‎articles/payment-hsm/breadcrumb/toc.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
- name: Azure
2+
tocHref: /azure/
3+
topicHref: /azure/index
4+
items:
5+
- name: Payment HSM
6+
tocHref: /azure/
7+
topicHref: /azure/payment-hsm/index

‎articles/payment-hsm/certification-compliance.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
title: Azure Payment HSM certification and compliance
3+
description: Information on Azure Payment HSM certification and compliance
4+
services: payment-hsm
5+
author: msmbaldwin
6+
7+
tags: azure-resource-manager
8+
ms.service: payment-hsm
9+
ms.workload: security
10+
ms.topic: article
11+
ms.date: 01/25/2022
12+
ms.author: mbaldwin
13+
---
14+
15+
# Certification and compliance
16+
17+
Thales payShield 10K HSMs are certified to FIPS 140-2 Level 3 and PCI HSM v3.
18+
19+
The Azure Payment HSM service is currently undergoing PCI DSS and PCI 3DS audit assessment.
20+
21+
The Azure Payment HSM can be deployed as part of a validated PCI P2PE and PCI PIN component or solution, Microsoft can provide evidence of proof for customer to meet their P2PE and PIN certification requirements.
22+
23+
## Next steps
24+
25+
- Learn more about [Azure Payment HSM](overview.md)
26+
- See some common [deployment scenarios](deployment-scenarios.md)
27+
- Read the [frequently asked questions](faq.yml)

‎articles/payment-hsm/deployment-scenarios.md

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
title: Azure Payment HSM deployment scenarios
3+
description: Azure HSM deployment scenarios for high availability deployment and disaster recovery deployment
4+
services: payment-hsm
5+
author: msmbaldwin
6+
7+
tags: azure-resource-manager
8+
ms.service: payment-hsm
9+
ms.workload: security
10+
ms.topic: article
11+
ms.date: 01/25/2022
12+
ms.author: mbaldwin
13+
14+
15+
---
16+
# Deployment scenarios
17+
18+
Microsoft deploys payment hardware security modules (HSM) in stamps within a region and multi-region to enable high availability (HA) and disaster recovery. In a region, HSMs are deployed across different stamps to prevent single rack failure, and customers must provision two devices in a region from two separate stamps in order to achieve high availability. For disaster recovery, customer must provision HSM devices in an alternative region.
19+
20+
Thales doesn't provide PayShield SDK to customers, which supports HA over a cluster (a collection of HSMs initialized with same LMK). However, the customers usage scenario of the Thales PayShield devices is like a Stateless Server. Thus, no synchronization is required between HSMs during application runtime. Customers handle the HA using their custom client. One implementation would be to load balance between healthy HSMs connected to the application. Customers are responsible for implementing high availability by provisioning multiple devices, load balancing them, and using any kind of available backup mechanism to back up keys.
21+
22+
## Recommended high availability deployment
23+
24+
:::image type="content" source="./media/deployment-1.png" alt-text="Architecture diagram for high availability deployment":::
25+
26+
For High Availability, customer must allocate HSM between stamp 1 and stamp 2 (in other words, no two HSMs from same stamp)
27+
28+
## Recommended disaster recovery deployment
29+
30+
:::image type="content" source="./media/deployment-2.png" alt-text="Architecture diagram for disaster recovery deployment":::
31+
32+
This scenario caters to regional-level failure. The usual strategy is to completely switch the application stack (and its HSMs), rather than trying to reach an HSM in Region 2 from application in Region 1 due to latency.
33+
34+
## Next steps
35+
36+
- Learn more about [Azure Payment HSM](overview.md)
37+
- Find out how to [get started with Azure Payment HSM](getting-started.md)
38+
- Learn about [Certification and compliance](certification-compliance.md)
39+
- Read the [frequently asked questions](faq.yml)

‎articles/payment-hsm/faq.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
### YamlMime:FAQ
2+
metadata:
3+
title: Frequently asked questions - Azure Payment HSM
4+
description: Find answers to common questions about Azure Payment Hardware Security Module, such as basic information, getting started, and support.
5+
services: payment-hsm
6+
author: msmbaldwin
7+
tags: azure-resource-manager
8+
ms.service: payment-hsm
9+
ms.workload: security
10+
ms.topic: conceptual
11+
ms.date: 01/25/2022
12+
ms.author: mbaldwin
13+
14+
15+
title: Frequently asked questions (FAQ)
16+
summary: Find answers to common questions about Microsoft Azure Payment HSM.
17+
18+
sections:
19+
- name: The Basics
20+
questions:
21+
- question: |
22+
Where is Azure Payment HSM preview available?
23+
answer: |
24+
Azure Payment HSM is available for preview in East US and North Europe regions.
25+
26+
- question: |
27+
How does Azure Payment HSM work?
28+
answer: |
29+
After HSMs are provisioned, they’re connected directly to a user’s virtual network, and HSMs are under users’ sole administrative control. HSMs can be provisioned as a pair of devices and configured for high availability. The service uses Thales payShield Manager for secure remote access to the HSM.
30+
31+
- question: |
32+
Which industries might use Azure Payment HSM?
33+
answer: |
34+
Financial institutions and service providers in the payment ecosystem including issuers, service providers, acquirers, processors, and payment networks would benefit from Azure Payment HSM.
35+
36+
- question: |
37+
What are some common use cases for Azure Payment HSM?
38+
answer: |
39+
With benefits including low latency and the ability to quickly add more HSM capacity as required, Azure Payment HSM is a perfect fit for a broad range of use cases, including payment processing, payment credential issuing, securing keys and authentication data, and sensitive data protection. For more, see [Azure Payment HSM: typical use cases](overview.md#typical-use-cases)
40+
41+
- question: |
42+
How do I get started with the service?
43+
answer: |
44+
As Azure Payment HSM is a specialized service, you can request access [via email](mailto:[email protected]).

‎articles/payment-hsm/getting-started.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
title: Getting started with Azure Payment HSM
3+
description: Information to begin using Azure Payment HSM
4+
services: payment-hsm
5+
author: msmbaldwin
6+
7+
tags: azure-resource-manager
8+
ms.service: payment-hsm
9+
ms.workload: security
10+
ms.topic: article
11+
ms.date: 01/25/2022
12+
ms.author: mbaldwin
13+
---
14+
15+
# Getting started with Azure Payment HSM
16+
17+
To get started with Azure Payment HSM (preview), contact your Microsoft sales representative and request access [via email](mailto:[email protected]). Upon approval, you'll be provided with onboarding instructions.
18+
19+
## Availability
20+
21+
The Azure Public Preview is currently available in **East US** and **North Europe**.
22+
23+
## Prerequisites
24+
25+
Azure Payment HSM customers must have:
26+
27+
- Access to the Thales Customer Portal (Customer ID)
28+
- Thales smart cards and card reader for payShield Manager
29+
30+
## Cost
31+
32+
The HSM devices will be charged based on the service pricing page. All other Azure resources for networking and virtual machines will incur regular Azure costs too.
33+
34+
## payShield customization considerations
35+
36+
If you are using payShield on-premise today with a custom firmware, a porting exercise is required to update the firmware to a version compatible with the Azure deployment. Please contact your Thales account manager to request a quote.
37+
38+
Ensure that the following information is provided:
39+
- Customization hardware platform (e.g., payShield 9000 or payShield 10K)
40+
- Customization firmware number
41+
42+
## Support
43+
44+
There is no service-level agreement (SLA) for this public preview. Use of this service for production workloads isn't supported
45+
46+
The HSM base firmware installed in public preview is Thales payShield10K base software version 1.4a 1.8.3.
47+
48+
Microsoft will provide support for hardware issues, networking issues, and provisioning issues. Support tickets can be created from the Azure portal. Select **Dedicated HSM** as the Service Type, and mention "payment HSM" in the summary field, with a severity case of B or C.
49+
50+
Support through engineering escalation is only available during business hours: Monday - Friday, 9 AM - 5 PM PST.
51+
52+
Thales provides application-level support, such as client software, HSM configuration, and backup.
53+
54+
Customers are responsible for applying payShield security patches and upgrading payShield firmware for their provisioned HSMs. Thales payShield10K versions prior to 1.4a 1.8.3. aren't supported
55+
56+
Microsoft will apply payShield security patches to unallocated HSMs.
57+
58+
## Next steps
59+
60+
- Learn more about [Azure Payment HSM](overview.md)
61+
- See some common [deployment scenarios](deployment-scenarios.md)
62+
- Learn about [Certification and compliance](certification-compliance.md)
63+
- Read the [frequently asked questions](faq.yml)
64+
65+

‎articles/payment-hsm/index.yml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
### YamlMime:Landing
2+
3+
title: Azure Payment HSM documentation
4+
summary: Learn how to use Azure Payment HSM to provide cryptographic key operations for real-time, critical payment transactions in the Azure cloud
5+
metadata:
6+
title: Azure Payment HSM documentation
7+
description: Learn how to use Azure Payment HSM to provide cryptographic key operations for real-time, critical payment transactions in the Azure cloud
8+
services: payment-hsm
9+
ms.service: payment-hsm
10+
ms.topic: landing-page # Required
11+
author: msmbaldwin
12+
ms.author: mbaldwin
13+
manager: rkarlin
14+
ms.date: 01/25/2022 #Required; mm/dd/yyyy format.
15+
16+
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new
17+
18+
landingContent:
19+
# Cards and links should be based on top customer tasks or top subjects
20+
# Start card title with a verb
21+
# Card
22+
- title: About Azure Payment HSM
23+
linkLists:
24+
- linkListType: overview
25+
links:
26+
- text: What is Payment HSM?
27+
url: overview.md
28+
29+
30+
# Card
31+
- title: Get started
32+
linkLists:
33+
- linkListType: deploy
34+
links:
35+
- text: Get started with Azure Payment HSM
36+
url: getting-started.md
37+
38+
# Card
39+
- title: Concepts
40+
linkLists:
41+
- linkListType: concept
42+
links:
43+
- text: Deployment scenarios
44+
url: deployment-scenarios.md
45+
- text: Certification and compliance
46+
url: certification-compliance.md
47+
48+
# Card
49+
- title: References
50+
linkLists:
51+
- linkListType: reference
52+
links:
53+
- text: Frequently asked questions
54+
url: faq.yml

‎articles/payment-hsm/media/deployment-1.png

52.5 KB
Loading

‎articles/payment-hsm/media/deployment-2.png

65.3 KB
Loading

‎articles/payment-hsm/overview.md

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
---
2+
title: What is Azure Payment HSM?
3+
description: Learn how Azure Payment HSM is an Azure service that provide cryptographic key operations for real-time, critical payment transactions
4+
services: payment-hsm
5+
author: msmbaldwin
6+
tags: azure-resource-manager
7+
8+
ms.service: payment-hsm
9+
ms.workload: security
10+
ms.topic: overview
11+
ms.date: 01/20/2022
12+
ms.author: mbaldwin
13+
14+
15+
---
16+
# What is Azure Payment HSM?
17+
18+
Azure Payment HSM Service is a "BareMetal" service delivered using [Thales payShield 10K payment hardware security modules (HSM)](https://cpl.thalesgroup.com/encryption/hardware-security-modules/payment-hsms/payshield-10k) to provide cryptographic key operations for real-time, critical payment transactions in the Azure cloud. Azure Payment HSM is designed specifically to help a service provider and an individual financial institution accelerate their payment system's digital transformation strategy and adopt the public cloud. It meets the most stringent security, audit compliance, low latency, and high-performance requirements by the Payment Card Industry (PCI).
19+
20+
Payment HSMs are provisioned and connected directly to users' virtual network, and HSMs are under users' sole administration control. HSMs can be easily provisioned as a pair of devices and configured for high availability. Users of the service utilize [Thales payShield Manager](https://cpl.thalesgroup.com/encryption/hardware-security-modules/payment-hsms/payshield-manager) for secure remote access to the HSMs as part of their Azure-based subscription. Multiple subscription options are available to satisfy a broad range of performance and multiple application requirements that can be upgraded quickly in line with end-user business growth. Azure payment HSM service offers highest performance level 2500 CPS.
21+
22+
Azure Payment HSM a highly specialized service. Therefore, we recommend that you fully understand the key concepts, including [pricing](https://azure.microsoft.com/services/azure-payment-hsm/) and [support](getting-started.md#support).
23+
24+
## Why use Azure Payment HSM?
25+
26+
Momentum is building as financial institutions move some or all of their payment applications to the cloud. This entails a migration from the legacy on-premises (on-prem) applications and HSMs to a cloud-based infrastructure that isn't generally under their direct control. Often it means a subscription service rather than perpetual ownership of physical equipment and software. Corporate initiatives for efficiency and a scaled-down physical presence are the drivers for this. Conversely, with cloud-native organizations, the adoption of cloud-first without any on-premise presence is their fundamental business model. Whatever the reason, end users of a cloud-based payment infrastructure expect reduced IT complexity, streamlined security compliance, and flexibility to scale their solution seamlessly as their business grows.
27+
28+
The cloud offers significant benefits, but challenges when migrating a legacy on-premise payment application (involving payment HSMs) to the cloud must be addressed. Some of these are:
29+
30+
- Shared responsibility and trust – what potential loss of control in some areas is acceptable?
31+
- Latency – how can an efficient, high-performance link between the application and HSM be achieved?
32+
- Performing everything remotely – what existing processes and procedures may need to be adapted?
33+
- Security certifications and audit compliance – how will current stringent requirements be fulfilled?
34+
35+
Azure Payment HSM addresses these challenges and delivers a compelling value proposition to users of the service through the following features.
36+
37+
### Enhanced security and compliance
38+
39+
End users of the service can leverage Microsoft security and compliance investments to increase their security posture. Microsoft maintains PCI DSS and PCI 3DS compliant Azure data centers, including those which house Azure Payment HSM solutions. The Azure Payment HSM solution can be deployed as part of a validated PCI P2PE / PCI PIN component or solution, helping to simplify ongoing security audit compliance. Thales payShield 10K HSMs deployed in the security infrastructure are certified to FIPS 140-2 Level 3 and PCI HSM v3.
40+
41+
### Customer-managed HSM in Azure
42+
43+
The Azure Payment HSM is a part of a subscription service that offers single-tenant HSMs for the service customer to have complete administrative control and exclusive access to the HSM. The customer could be a payment service provider acting on behalf of multiple financial institutions or a financial institution that wishes to directly access the Azure Payment HSM service. Once the HSM is allocated to a customer, Microsoft has no access to customer data. Likewise, when the HSM is no longer required, customer data is zeroized and erased as soon as the HSM is released to ensure complete privacy and security is maintained. The customer is responsible for ensuring sufficient HSM subscriptions are active to meet their requirements for backup, disaster recovery, and resilience to achieve the same performance available on their on-premise HSMs.
44+
45+
### Accelerate digital transformation and innovation in cloud
46+
47+
For existing Thales payShield customers wishing to add a cloud option, the Azure Payment HSM solution offers native access to a payment HSM in Azure for "lift and shift" while still experiencing the low latency they're accustomed to via their on-premise payShield HSMs. The solution also offers high-performance transactions for mission-critical payment applications. Consequently, customers can continue their digital transformation strategy by leveraging technology innovation in the cloud. Existing Thales payShield customers can utilize their existing remote management solutions (payShield Manager and payShield TMD together with associated smart card readers and smart cards as appropriate) to work with the Azure Payment HSM service. Customers new to payShield can source the hardware accessories from Thales or one of its partners before deploying their HSM as part of the subscription service.
48+
49+
## Typical use cases
50+
51+
With benefits including low latency and the ability to quickly add more HSM capacity as required, the cloud service is a perfect fit for a broad range of use cases, including:
52+
Payment processing
53+
- Card & mobile payment authorization
54+
- PIN & EMV cryptogram validation
55+
- 3D-Secure authentication
56+
57+
Payment credential issuing
58+
- Cards
59+
- Mobile secure elements
60+
- Wearables
61+
- Connected devices
62+
- Host card emulation (HCE) applications
63+
64+
Securing keys & authentication data
65+
- POS, mPOS & SPOC key management
66+
- Remote key loading (for ATM & POS/mPOS devices)
67+
- PIN generation & printing
68+
- PIN routing
69+
70+
Sensitive data protection
71+
- Point-to-point encryption (P2PE)
72+
- Security tokenization (for PCI DSS compliance)
73+
- EMV payment tokenization
74+
75+
## Suitable for both existing and new payment HSM users
76+
77+
The solution provides clear benefits for both Payment HSM users with a legacy on-premise HSM footprint and those new payment ecosystem entrants with no legacy infrastructure to support and who may choose a cloud-native approach from the outset.
78+
79+
Benefits for existing on-premise HSM users
80+
- Requires no modifications to payment applications or HSM software to migrate existing applications to the Azure solution
81+
- Enables more flexibility and efficiency in HSM utilization
82+
- Simplifies HSM sharing between multiple teams, geographically dispersed
83+
- Reduces physical HSM footprint in their legacy data centers
84+
- Improves cash flow for new projects
85+
86+
Benefits for new payment participants
87+
- Avoids introduction of on-premise HSM infrastructure
88+
- Lowers upfront investment via the Azure subscription model
89+
- Offers access to latest certified hardware and software on-demand
90+
91+
## Glossary
92+
93+
| Term | Definition |
94+
|---|---|
95+
| 3DS | 3D Secure |
96+
| ATM | Automated Teller Machine |
97+
| EMV | Europay Mastercard Visa |
98+
| FIPS | Federal Information Processing Standards |
99+
| HCE | Host Card Emulation |
100+
| HSM | Hardware Security Module |
101+
| mPOS | Mobile Point of Sale |
102+
| P2PE | Point-to-Point Encryption |
103+
| PCI | Payment Card Industry |
104+
| PIN | Personal Identification Number |
105+
| POS | Point of Sale |
106+
| SPOC | Software-based PIN Entry on Commercial off the Shelf (COTS) Solutions |
107+
| TMD | payShield Trusted Management Device |
108+
109+
## Next steps
110+
111+
- Learn more about [Azure Payment HSM](overview.md)
112+
- Find out how to [get started with Azure Payment HSM](getting-started.md)
113+
- See some common [deployment scenarios](deployment-scenarios.md)
114+
- Learn about [Certification and compliance](certification-compliance.md)
115+
- Read the [frequently asked questions](faq.yml)

‎articles/payment-hsm/toc.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
- name: Payment HSM Documentation
2+
href: index.yml
3+
- name: Overview
4+
items:
5+
- name: Payment HSM overview
6+
href: overview.md
7+
- name: Get started
8+
items:
9+
- name: Getting started with Azure Payment HSM
10+
href: getting-started.md
11+
- name: Concepts
12+
items:
13+
- name: Deployment scenarios
14+
href: deployment-scenarios.md
15+
- name: Certification and compliance
16+
href: certification-compliance.md
17+
- name: Reference
18+
items:
19+
- name: Thales payShield 10K
20+
href: https://cpl.thalesgroup.com/encryption/hardware-security-modules/payment-hsms/payshield-10k
21+
- name: Thales payShield Manager
22+
href: https://cpl.thalesgroup.com/encryption/hardware-security-modules/payment-hsms/payshield-manager
23+
- name: Thales payShield Trusted Management Device
24+
href: https://cpl.thalesgroup.com/encryption/hardware-security-modules/payment-hsms/payshield-trusted-management-device
25+
- name: Resources
26+
items:
27+
- name: Frequently asked questions
28+
href: faq.yml

0 commit comments

Comments
 (0)