Synchronizable hardware security module

A system, comprising:

• one or more processors;
• and
• memory storing computer-executable instructions that, as a result of being performed by one or more processors, cause the system to:
• generate a key map associated with a set of keys of a cluster of hardware security modules, the key map including information identifying individual keys of the set of keys;
• generate an update to a first hardware security module of the cluster of hardware security modules, the update includes at least one key of the set of keys out of synchronization with a second hardware security module of the cluster of hardware security modules;
• obtain an encrypted version of the at least one key;
• and
• cause the first hardware security module to update cryptographic information maintained by the first hardware security module to include a decrypted version of the encrypted version of the at least one key by at least providing the first hardware security module with the update and the encrypted version of the at least one key.

A non-transitory computer-readable storage medium storing executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

• obtain information indicating cryptographic keys contained in a cluster of hardware security modules by acquiring an inventory of retained cryptographic keys including cryptographic key versions;
• generate a key map based at least in part on the information, the key map identifying a set of cryptographic keys that are unsynchronized with at least one hardware security module of the cluster of hardware security modules;
• generate an update including a set of encrypted cryptographic keys based at least in part on the key map;
• and
• provide the update to the at least one hardware security module of be cluster of hardware security modules.