Systems and methods for using extended hardware security modules

A method of managing processing modules available to remote clients over a computer network in order to provide confidentiality, non-repudiation, and authentication to the clients, comprising the steps of:

• providing at least one secure processing module having a first processor, a memory, and a cryptography module interconnected inside an anti-tamper enclosure, wherein said memory includes instructions that configure the first processor to selectively load and run a plurality of logical layers and allows the secure processing module to run at least one application software program;
• initiating said at least one secure processing module by storing thereon a private cryptographic key corresponding to a public cryptographic key, as well as a signed public key certificate for the said public cryptographic key, wherein the signed public key certificate is signed by a signor entity related to at least one of a production and sale of said secure processing module;
• connecting said at least one secure processing module to a computer network, wherein the step of connecting allows the at least one secure processing module to communicate electrical signals over the computer network;
• receiving through the computer network an electronic request from a requesting party for allocation of said at least one secure processing module;
• allocating said at least one secure processing module, wherein the step of allocating comprises the at least one secure processing module proving to said requesting party knowledge of the said private cryptographic key;
• the requesting party verifying said signed public key certificate using a second certificate provided to the requesting party, wherein verification comprises identifying said signor entity as the signor of the signed public key certificate;
• and at least reconfiguring said at least one secure processing module to be allocated and providing identifying information to the party from whom the electronic request was received;
• and
• wherein said step of allocating said at least one secure processing module selectively causes said requesting party from whom the electronic request was received to transmit at least one of encrypted client data and encrypted client software to at least one of the allocated secure processing modules;
• and
• wherein said step of allocating said at least one secure processing module selectively causes said requesting party from whom the electronic request was received to at least one of:
• receive encrypted processed data and interface with client application software programs, wherein said encrypted processed data embody the encrypted client data after being decrypted, processed, and encrypted on the allocated secure processing module and said client application software programs embody the encrypted client software after being decrypted and run on the allocated secure processing module.