Remote management of hardware security modules

A system comprising:

• one or more processors for executing computer-readable instructions, the computer-readable instructions controlling the one or more processors to perform operations comprising:
• receiving a command request from a mobile device, the command request comprising an encrypted key part and an encrypted signing key;
• decrypting, by a hardware security module (HSM), the command request using a key associated with a security zone of the mobile device;
• decrypting, by the HSM, the encrypted key part and the encrypted signing key to generate a decrypted key part and a decrypted signing key, wherein decrypting the encrypted key part and the encrypted signing key comprises using the key associated with the security zone of the mobile device and a key associated with a remote administrator associated with the mobile device;
• generating, for a domain with a target HSM and based on the command request, a command using the decrypted key part and the decrypted signing key;
• and
• transmitting the command to the domain for execution by the target HSM.

A computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors to cause the one or more processors to perform operations comprising:

• receiving a command request from a mobile device, the command request comprising an encrypted key part and an encrypted signing key;
• decrypting, by a hardware security module (HSM), the command request using a key associated with a security zone of the mobile device;
• decrypting, by the HSM, the encrypted key part and the encrypted signing key to generate a decrypted key part and a decrypted signing key, wherein decrypting the encrypted key part and the encrypted signing key comprises using the key associated with the security zone of the mobile device and a key associated with a remote administrator associated with the mobile device;
• generating, for a domain with a target HSM and based on the command request, a command using the decrypted key part and the decrypted signing key;
• and
• transmitting the command to the domain for execution by the target HSM.

A computer-implemented method comprising:

• receiving, by a processor of a computing device, from a mobile device associated with a remote administrator, a load key request comprising an encrypted key part and an encrypted signing key;
• validating the load key request from the mobile device;
• decrypting the encrypted key part and the encrypted signing key to generate a decrypted key part and a decrypted signing key, wherein decrypting the encrypted key part and the encrypted signing key comprise using a private key corresponding to a public key of a certificate authority (CA) certificate for a security zone and a private key corresponding to a public key of a CA certificate of a profile of the remote administrator;
• building a load key command for a domain designated by the load key request, wherein the load key command comprises the decrypted key part and is signed using the decrypted signing key;
• and
• transmitting the load key command to the domain for execution by a target hardware security module (HSM) of the domain.

A computer-implemented method comprising:

• receiving, by a processor of a secure computing device from a mobile device associated with a remote administrator, an encrypted hardware security module (HSM) command request comprising an encrypted key part and an encrypted signing key;
• decrypting the encrypted HSM command request from the mobile device;
• decrypting, by an HSM of the secure computing device, the encrypted key part and the encrypted signing key to generate a decrypted key part and a decrypted signing key;
• generating an HSM command corresponding to the encrypted HSM command request for a designated domain, based at least in part on the decrypted key part and the decrypted signing key;
• and
• transmitting the HSM command to the designated domain for execution by a target HSM of the designated domain.