Personal Network HSM
A New Approach to Distributed, Hardware-Based Cryptographic Security
Introduction
The EtherTrust Personal Network HSM (pNHSM) is an innovative cybersecurity architecture that transforms traditional Secure Elements into autonomous, network-accessible Hardware Security Modules.
Based on the Internet of Secure Elements (IoSE) concept introduced Pascal Urien, pNHSM combines the security of tamper-resistant microcontrollers with standard Internet protocols, enabling secure remote access to physically isolated cryptographic resources.
Unlike conventional Hardware Security Modules, which typically rely on a centralized cryptographic processor and logical partitions, pNHSM distributes cryptographic functions across a grid of independent Secure Elements, each operating as a dedicated TLS 1.3 server.
The architecture is designed to provide personal, hardware-isolated cryptographic services through secure, end-to-end network connections.
1. Personal – Dedicated Hardware Security Domains
The term Personal refers to the use of independent, physically isolated Secure Elements as dedicated security partitions.
Each Secure Element is a tamper-resistant microcontroller providing its own protected execution environment, cryptographic resources, and secure storage.
Unlike software-based isolation or shared HSM partitions, pNHSM relies on physical separation between individual Secure Elements.
Each element can be assigned to a specific user, application, or security domain, providing independent cryptographic key management and execution.
This architecture is designed to minimize the exposure of sensitive credentials to other applications and to the host operating system.
The result is a personal security environment in which cryptographic keys and sensitive operations remain within a dedicated hardware component.
2. Network – Native TLS 1.3 Connectivity
The term Network describes the integration of standard Internet communication capabilities directly into the Secure Element architecture.
Each Secure Element embeds an independent TLS 1.3 End Server, using Pre-Shared Key (PSK) authentication based on a 256-bit secret.
Every End Server is identified by a unique Secure Element Name (SEN), which can be selected through the Server Name Indication (SNI) extension of the TLS protocol.
A central TLS Front Server, typically running on a Raspberry Pi, embedded processor, or System-on-Chip (SoC), provides TCP/IP connectivity and manages TLS message routing.
When a remote client initiates a TLS connection, the Front Server examines the SNI field and forwards the TLS handshake and subsequent encrypted records to the designated Secure Element.
Importantly, the Front Server does not terminate the protected TLS session or require access to the cryptographic secrets held by the Secure Element.
TLS authentication, session key establishment, and cryptographic protection are handled by the Secure Element itself.
This architecture establishes an end-to-end TLS security channel between the remote client and its dedicated hardware security partition.
3. HSM – Integrated Cryptographic Key Management
The term HSM (Hardware Security Module) refers to the cryptographic services implemented within each Secure Element.
Every Secure Element integrates its own Key Management System (KMS), providing a protected environment for cryptographic key operations.
A dedicated command-line shell interface, operating above the embedded TLS server, allows authenticated remote clients to access authorized cryptographic services.
Depending on the embedded application, these services can include:
- Secure cryptographic key generation and storage
- Digital signature generation and verification
- Encryption and cryptographic processing
- Secure authentication and identity management
- Cryptographic key lifecycle management
Sensitive operations are executed inside the Secure Element, allowing applications to use protected cryptographic resources without directly accessing private keys.
The combination of a native TLS interface, embedded KMS, and dedicated hardware isolation creates a compact network-accessible HSM within each Secure Element.
4. Grid of Secure Elements Architecture
The pNHSM architecture is built around a Grid of Secure Elements (GoSE), where multiple independent cryptographic servers operate within a common physical infrastructure.
Each Secure Element functions as an autonomous TLS End Server with its own identity, cryptographic keys, secure applications, and management interfaces.
The shared TLS Front Server provides the network infrastructure required to communicate with individual Secure Elements.
Using SNI-based routing, multiple hardware security domains can be accessed through a single network endpoint.
This architecture enables the deployment of multiple independent cryptographic services within a common network-connected platform.
Additional Secure Elements or hardware boards can increase the number of available security domains, providing a modular approach to capacity expansion.
The grid architecture therefore combines centralized network connectivity with decentralized cryptographic security.
5. Secure Administration and Application Management
In addition to user-facing cryptographic services, pNHSM supports a dedicated administration architecture.
Based on the Remote APDU Call Secure (RACS) protocol, the administration interface enables remote communication with Secure Elements using standard ISO 7816 APDU commands.
Combined with GlobalPlatform security mechanisms, this interface supports secure application installation, configuration, and lifecycle management.
The administration and user service functions are logically separated.
The administration plane provides facilities for deploying and maintaining trusted applications, while the service plane exposes cryptographic operations through the Secure Element’s TLS 1.3 server.
Dedicated authentication and attestation procedures can help establish trust between application providers, users, and the Secure Elements hosting their security services.
This separation supports the remote management of distributed hardware security resources while preserving independent cryptographic environments.
6. Security Architecture and Key Benefits
The pNHSM approach combines several complementary security mechanisms.
Physical Isolation: Every Secure Element provides an independent hardware security environment rather than relying exclusively on software-based partitioning.
End-to-End TLS Security: TLS 1.3 PSK sessions are established directly between clients and Secure Elements, keeping session cryptography within the protected hardware.
Hardware-Protected Keys: Sensitive cryptographic keys are stored and processed within tamper-resistant Secure Elements.
Independent Security Domains: Each Secure Element maintains its own identity, cryptographic resources, and security applications.
Modular Scalability: Secure Element grids enable multiple dedicated cryptographic services to coexist within a shared networking infrastructure.
Open Technologies: The architecture builds upon standards and technologies including TLS 1.3, Java Card, ISO 7816, GlobalPlatform, and open hardware platforms.
Together, these characteristics provide an alternative approach to deploying cryptographic security services for individuals, organizations, and distributed computing environments.
7. Applications and Use Cases
The pNHSM architecture is designed for applications requiring dedicated cryptographic resources and secure remote access.
Potential use cases include:
- Cloud Key Management: Hardware-protected cryptographic resources for cloud-hosted applications.
- Digital Identity: Secure authentication and cryptographic identity services.
- Blockchain and Digital Assets: Hardware-isolated storage and use of private keys for digital transactions.
- Internet of Things: Dedicated cryptographic services for connected devices and embedded systems.
- Enterprise Cybersecurity: Network-accessible cryptographic security domains for business applications.
- Personal Data Protection: Dedicated security resources for individuals requiring control over sensitive digital credentials.
The architecture also offers opportunities for low-cost, hardware-based security services by leveraging the widespread availability of Secure Element technologies.
8. Implementations: pNHSM Grid and LeMONOLITH
EtherTrust develops complementary implementations of the Personal Network HSM architecture.
pNHSM Grid
The grid-based implementation hosts multiple Secure Elements operating as independent TLS 1.3 PSK servers.
A shared network processor performs TCP/IP connectivity and SNI-based routing, enabling multiple hardware security domains to operate within a common platform.
This configuration is particularly suited to applications requiring multiple dedicated cryptographic environments and scalable secure computing resources.
LeMONOLITH
LeMONOLITH is a compact implementation of the pNHSM architecture combining a single Secure Element with a System-on-Chip.
The SoC operates as the TLS Front Server, while the Secure Element provides the TLS End Server and associated cryptographic services.
This configuration brings the fundamental principles of pNHSM into a compact, standalone device suitable for personal and embedded security applications.
Both implementations share the same underlying principle: network connectivity is provided by the host processor, while cryptographic trust and sensitive operations remain within the Secure Element.
9. From IoSE to Personal Network HSM
The development of pNHSM represents a practical application of the Internet of Secure Elements concept.
Earlier research on the Cloud of Secure Elements (CoSE) introduced secure remote access to hardware cryptographic resources through network infrastructures.
IoSE extended this approach by introducing TLS servers directly within Secure Elements.
The Personal Network HSM builds upon these concepts by integrating independent TLS security endpoints, hardware-isolated key management services, and scalable Secure Element grids.
This evolution transforms traditional smart card technology into a foundation for distributed, Internet-accessible cryptographic infrastructure.
Conclusion
The EtherTrust Personal Network HSM introduces a distributed architecture for delivering dedicated, hardware-protected cryptographic services over standard Internet connections.
By combining physically isolated Secure Elements, embedded TLS 1.3 servers, SNI-based routing, and integrated Key Management Systems, pNHSM provides a modular approach to secure key storage, cryptographic processing, and trusted remote services.
Its architecture extends the traditional role of Secure Elements beyond local smart card applications, transforming them into independent, network-connected security modules.
pNHSM — One Secure Element. One TLS Server. One Independent Security Domain.