Device and a method for performing a cryptographic algorithm

A hardware security module (HSM), comprising:

• a first processor;
• and
• a second processor comprising a cryptographic co-processor, wherein the first processor and the second processor are physically located within a same HSM boundary;
• wherein the first processor is configured to:
• receive input data comprising encrypted data;
• transmit the encrypted data and one or more requests for cryptographic operations to the second processor;
• and
• receive, from the second processor, results of the cryptographic operations,
• wherein the first processor is restricted from accessing plaintext cryptographic material;
• wherein the second processor is configured to:
• receive the encrypted data and the one or more requests;
• enforce one or more access control policies on inputs associated with the one or more requests;
• decrypt at least a portion of the encrypted data using the inputs associated with the one or more requests;
• and
• execute, in hardware, a cryptographic program using the decrypted data based on the one or more requests.

A method performed within a hardware security module (HSM) comprising a first processor and a second processor that is a cryptographic co-processor, the method comprising:

• receiving, by the first processor, encrypted input data;
• transmitting, by the first processor, the encrypted input data and a request to perform a cryptographic operation to the second processor;
• enforcing, by the second processor, one or more access control policies on inputs associated with the request;
• decrypting, by the second processor, at least a portion of the encrypted input data;
• executing, by the second processor in hardware, a cryptographic program using the decrypted data based on the request, wherein execution is restricted to a hardware-approved subset of instructions;
• and
• returning, to the first processor, output data derived from the execution.

A hardware security module (HSM) comprising:

• a general-purpose processor configured to process only encrypted data;
• and
• a cryptographic co-processor configured to:
• decrypt at least a portion of the encrypted data;
• execute user-defined cryptographic programs in hardware;
• and
• restrict execution to a hardware-approved subset of instructions,
• wherein the general-purpose processor and the cryptographic co-processor are co-located within a same physical HSM and are isolated such that plaintext key material is not exposed to the general-purpose processor.