Data center security services

A method comprising:

• authenticating, by a computing system within a data center and based on input received over a plurality of customer ports, each of a plurality of customers to access services provided by at least one hardware security module included within the computing system, including a first customer and a second customer;
• generating, by the at least one hardware security module, a plurality of cryptographic keys, including a first cryptographic key associated with the first customer and a second cryptographic key associated with the second customer, wherein each of the plurality of cryptographic keys are generated and stored securely within the at least one hardware security module without disclosure outside of the at least one hardware security module;
• enforcing, by the computing system, restrictions on use of the plurality of cryptographic keys, including preventing use of the first cryptographic key by the second customer and preventing use of the second cryptographic key by the first customer;
• accessing, by the computing system and based on input received from a computing device operated by the first customer, a first set of customer data;
• generating, by the computing system, a first set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the first set of customer data using the first cryptographic key;
• outputting, by the computing system, the first set of processed data over a private connection to a first cloud service provider network;
• accessing, by the computing system and based on input received from a computing device operated by the second customer, a second set of customer data;
• generating, by the computing system, a second set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the second set of customer data using the second cryptographic key;
• and
• outputting, by the computing system, the second set of processed data over a private connection to a second cloud service provider network.

A non-transitory computer-readable storage medium comprising instructions that, when executed, configure processing circuitry of a computing system within a data center to:

• authenticate, based on input received over a plurality of customer ports, each of a plurality of customers to access services provided by at least one hardware security module included within the computing system, including a first customer and a second customer;
• generate, by the at least one hardware security module, a plurality of cryptographic keys, including a first cryptographic key associated with the first customer and a second cryptographic key associated with the second customer, wherein each of the plurality of cryptographic keys are generated and stored securely within the at least one hardware security module without disclosure outside of the at least one hardware security module;
• enforce restrictions on use of the plurality of cryptographic keys, including preventing use of the first cryptographic key by the second customer and preventing use of the second cryptographic key by the first customer;
• access, based on input received from a computing device operated by the first customer, a first set of customer data;
• generate a first set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the first set of customer data using the first cryptographic key;
• output the first set of processed data over a private connection to a first cloud service provider network;
• access, based on input received from a computing device operated by the second customer, a second set of customer data;
• generate a second set of processed data by causing the at least one hardware security module to perform a cryptographic operation on the second set of customer data using the second cryptographic key;
• and
• output the second set of processed data over a private connection to a second cloud service provider network.