A New Approach to Distributed, Hardware-Based Cryptographic Security<\/strong><\/p>\n\n\n\n The EtherTrust Personal Network HSM (pNHSM)<\/strong> is an innovative cybersecurity architecture that transforms traditional Secure Elements into autonomous, network-accessible Hardware Security Modules.<\/p>\n\n\n\n Based on the Internet of Secure Elements (IoSE)<\/strong> concept introduced Pascal Urien, pNHSM combines the security of tamper-resistant microcontrollers with standard Internet protocols, enabling secure remote access to physically isolated cryptographic resources.<\/p>\n\n\n\n Unlike conventional Hardware Security Modules, which typically rely on a centralized cryptographic processor and logical partitions, pNHSM distributes cryptographic functions across a grid of independent Secure Elements, each operating as a dedicated TLS 1.3 server.<\/p>\n\n\n\n The architecture is designed to provide personal, hardware-isolated cryptographic services through secure, end-to-end network connections.<\/p>\n\n\n\n The term Personal<\/strong> refers to the use of independent, physically isolated Secure Elements as dedicated security partitions.<\/p>\n\n\n\n Each Secure Element is a tamper-resistant microcontroller providing its own protected execution environment, cryptographic resources, and secure storage.<\/p>\n\n\n\n Unlike software-based isolation or shared HSM partitions, pNHSM relies on physical separation between individual Secure Elements.<\/p>\n\n\n\n Each element can be assigned to a specific user, application, or security domain, providing independent cryptographic key management and execution.<\/p>\n\n\n\n This architecture is designed to minimize the exposure of sensitive credentials to other applications and to the host operating system.<\/p>\n\n\n\n The result is a personal security environment in which cryptographic keys and sensitive operations remain within a dedicated hardware component.<\/p>\n\n\n\n The term Network<\/strong> describes the integration of standard Internet communication capabilities directly into the Secure Element architecture.<\/p>\n\n\n\n Each Secure Element embeds an independent TLS 1.3 End Server<\/strong>, using Pre-Shared Key (PSK) authentication based on a 256-bit secret.<\/p>\n\n\n\n Every End Server is identified by a unique Secure Element Name (SEN)<\/strong>, which can be selected through the Server Name Indication (SNI) extension of the TLS protocol.<\/p>\n\n\n\n A central TLS Front Server<\/strong>, typically running on a Raspberry Pi, embedded processor, or System-on-Chip (SoC), provides TCP\/IP connectivity and manages TLS message routing.<\/p>\n\n\n\n When a remote client initiates a TLS connection, the Front Server examines the SNI field and forwards the TLS handshake and subsequent encrypted records to the designated Secure Element.<\/p>\n\n\n\n Importantly, the Front Server does not terminate the protected TLS session or require access to the cryptographic secrets held by the Secure Element.<\/p>\n\n\n\n TLS authentication, session key establishment, and cryptographic protection are handled by the Secure Element itself.<\/p>\n\n\n\n This architecture establishes an end-to-end TLS security channel between the remote client and its dedicated hardware security partition.<\/p>\n\n\n\n The term HSM (Hardware Security Module)<\/strong> refers to the cryptographic services implemented within each Secure Element.<\/p>\n\n\n\n Every Secure Element integrates its own Key Management System (KMS)<\/strong>, providing a protected environment for cryptographic key operations.<\/p>\n\n\n\n A dedicated command-line shell interface, operating above the embedded TLS server, allows authenticated remote clients to access authorized cryptographic services.<\/p>\n\n\n\n Depending on the embedded application, these services can include:<\/p>\n\n\n\n Sensitive operations are executed inside the Secure Element, allowing applications to use protected cryptographic resources without directly accessing private keys.<\/p>\n\n\n\n The combination of a native TLS interface, embedded KMS, and dedicated hardware isolation creates a compact network-accessible HSM within each Secure Element.<\/p>\n\n\n\n The pNHSM architecture is built around a Grid of Secure Elements (GoSE)<\/strong>, where multiple independent cryptographic servers operate within a common physical infrastructure.<\/p>\n\n\n\n Each Secure Element functions as an autonomous TLS End Server with its own identity, cryptographic keys, secure applications, and management interfaces.<\/p>\n\n\n\n The shared TLS Front Server provides the network infrastructure required to communicate with individual Secure Elements.<\/p>\n\n\n\n Using SNI-based routing, multiple hardware security domains can be accessed through a single network endpoint.<\/p>\n\n\n\n This architecture enables the deployment of multiple independent cryptographic services within a common network-connected platform.<\/p>\n\n\n\n Additional Secure Elements or hardware boards can increase the number of available security domains, providing a modular approach to capacity expansion.<\/p>\n\n\n\n The grid architecture therefore combines centralized network connectivity with decentralized cryptographic security.<\/p>\n\n\n\n In addition to user-facing cryptographic services, pNHSM supports a dedicated administration architecture.<\/p>\n\n\n\n Based on the Remote APDU Call Secure (RACS)<\/strong> protocol, the administration interface enables remote communication with Secure Elements using standard ISO 7816 APDU commands.<\/p>\n\n\n\n Combined with GlobalPlatform security mechanisms, this interface supports secure application installation, configuration, and lifecycle management.<\/p>\n\n\n\n The administration and user service functions are logically separated.<\/p>\n\n\n\n The administration plane provides facilities for deploying and maintaining trusted applications, while the service plane exposes cryptographic operations through the Secure Element’s TLS 1.3 server.<\/p>\n\n\n\n Dedicated authentication and attestation procedures can help establish trust between application providers, users, and the Secure Elements hosting their security services.<\/p>\n\n\n\n This separation supports the remote management of distributed hardware security resources while preserving independent cryptographic environments.<\/p>\n\n\n\n The pNHSM approach combines several complementary security mechanisms.<\/p>\n\n\n\n Physical Isolation:<\/strong> Every Secure Element provides an independent hardware security environment rather than relying exclusively on software-based partitioning.<\/p>\n\n\n\n End-to-End TLS Security:<\/strong> TLS 1.3 PSK sessions are established directly between clients and Secure Elements, keeping session cryptography within the protected hardware.<\/p>\n\n\n\n Hardware-Protected Keys:<\/strong> Sensitive cryptographic keys are stored and processed within tamper-resistant Secure Elements.<\/p>\n\n\n\n Independent Security Domains:<\/strong> Each Secure Element maintains its own identity, cryptographic resources, and security applications.<\/p>\n\n\n\n Modular Scalability:<\/strong> Secure Element grids enable multiple dedicated cryptographic services to coexist within a shared networking infrastructure.<\/p>\n\n\n\n Open Technologies:<\/strong> The architecture builds upon standards and technologies including TLS 1.3, Java Card, ISO 7816, GlobalPlatform, and open hardware platforms.<\/p>\n\n\n\n Together, these characteristics provide an alternative approach to deploying cryptographic security services for individuals, organizations, and distributed computing environments.<\/p>\n\n\n\n The pNHSM architecture is designed for applications requiring dedicated cryptographic resources and secure remote access.<\/p>\n\n\n\n Potential use cases include:<\/p>\n\n\n\n The architecture also offers opportunities for low-cost, hardware-based security services by leveraging the widespread availability of Secure Element technologies.<\/p>\n\n\n\n EtherTrust develops complementary implementations of the Personal Network HSM architecture.<\/p>\n\n\n\n The grid-based implementation hosts multiple Secure Elements operating as independent TLS 1.3 PSK servers.<\/p>\n\n\n\n A shared network processor performs TCP\/IP connectivity and SNI-based routing, enabling multiple hardware security domains to operate within a common platform.<\/p>\n\n\n\n This configuration is particularly suited to applications requiring multiple dedicated cryptographic environments and scalable secure computing resources.<\/p>\n\n\n\n LeMONOLITH<\/strong> is a compact implementation of the pNHSM architecture combining a single Secure Element with a System-on-Chip.<\/p>\n\n\n\n The SoC operates as the TLS Front Server, while the Secure Element provides the TLS End Server and associated cryptographic services.<\/p>\n\n\n\n This configuration brings the fundamental principles of pNHSM into a compact, standalone device suitable for personal and embedded security applications.<\/p>\n\n\n\n Both implementations share the same underlying principle: network connectivity is provided by the host processor, while cryptographic trust and sensitive operations remain within the Secure Element.<\/p>\n\n\n\n The development of pNHSM represents a practical application of the Internet of Secure Elements concept.<\/p>\n\n\n\n Earlier research on the Cloud of Secure Elements (CoSE) introduced secure remote access to hardware cryptographic resources through network infrastructures.<\/p>\n\n\n\n IoSE extended this approach by introducing TLS servers directly within Secure Elements.<\/p>\n\n\n\n The Personal Network HSM builds upon these concepts by integrating independent TLS security endpoints, hardware-isolated key management services, and scalable Secure Element grids.<\/p>\n\n\n\n This evolution transforms traditional smart card technology into a foundation for distributed, Internet-accessible cryptographic infrastructure.<\/p>\n\n\n\n The EtherTrust Personal Network HSM<\/strong> introduces a distributed architecture for delivering dedicated, hardware-protected cryptographic services over standard Internet connections.<\/p>\n\n\n\n By combining physically isolated Secure Elements, embedded TLS 1.3 servers, SNI-based routing, and integrated Key Management Systems, pNHSM provides a modular approach to secure key storage, cryptographic processing, and trusted remote services.<\/p>\n\n\n\n Its architecture extends the traditional role of Secure Elements beyond local smart card applications, transforming them into independent, network-connected security modules.<\/p>\n\n\n\n pNHSM \u2014 One Secure Element. One TLS Server. One Independent Security Domain.<\/strong><\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" Personal Network HSM A New Approach to Distributed, Hardware-Based Cryptographic Security Introduction The EtherTrust Personal Network HSM (pNHSM) is an innovative cybersecurity architecture that transforms traditional Secure Elements into autonomous, network-accessible Hardware Security Modules. Based on the Internet of Secure Elements (IoSE) concept introduced Pascal Urien, pNHSM combines the security of tamper-resistant microcontrollers with standard […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-173","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/ethertrust.com\/index.php\/wp-json\/wp\/v2\/pages\/173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ethertrust.com\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/ethertrust.com\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/ethertrust.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ethertrust.com\/index.php\/wp-json\/wp\/v2\/comments?post=173"}],"version-history":[{"count":2,"href":"https:\/\/ethertrust.com\/index.php\/wp-json\/wp\/v2\/pages\/173\/revisions"}],"predecessor-version":[{"id":176,"href":"https:\/\/ethertrust.com\/index.php\/wp-json\/wp\/v2\/pages\/173\/revisions\/176"}],"wp:attachment":[{"href":"https:\/\/ethertrust.com\/index.php\/wp-json\/wp\/v2\/media?parent=173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Introduction<\/h2>\n\n\n\n
1. Personal \u2013 Dedicated Hardware Security Domains<\/h2>\n\n\n\n
2. Network \u2013 Native TLS 1.3 Connectivity<\/h2>\n\n\n\n
3. HSM \u2013 Integrated Cryptographic Key Management<\/h2>\n\n\n\n
\n
4. Grid of Secure Elements Architecture<\/h2>\n\n\n\n
5. Secure Administration and Application Management<\/h2>\n\n\n\n
6. Security Architecture and Key Benefits<\/h2>\n\n\n\n
7. Applications and Use Cases<\/h2>\n\n\n\n
\n
8. Implementations: pNHSM Grid and LeMONOLITH<\/h2>\n\n\n\n
pNHSM Grid<\/h3>\n\n\n\n
LeMONOLITH<\/h3>\n\n\n\n
9. From IoSE to Personal Network HSM<\/h2>\n\n\n\n
Conclusion<\/h2>\n\n\n\n