nShield HSM licensing

Base/Mid/High - Customer selects the processing speed they would like for the HSM they have chosen. nShield datasheets providing the baseline transactional speed for most common algorithms (e.g.: RSA 4096, ECC 512, etc.)

Speed upgrades/Performance upgrades

Customer has the flexibility to upgrade the performance level of their HSM (Base/Mid) as an additional license (physical or electronic).

Customers may also select HSMs (or the related firmware) that are certified compliant with certain regimes as follows:

Common Criteria eIDAS

Compliance regime against which certain HSM firmware needs to be certified to fulfil the requirements of some use cases (e.g., remote signature). Note all Common Criteria orders ship from the United Kingdom with Tamper Evident Packaging.

FIPS 140

Organizations use the FIPS 140 standard to ensure that the hardware they select meets specific security requirements. The FIPS certification standard defines four increasing, qualitative levels of security:

Level 1 Requires production-grade equipment and externally tested algorithms.

Level 2 Adds requirements for physical tamper-evidence and role-based authentication. Software implementations must run on an Operating System approved to Common Criteria at EAL2.

Level 3 Adds requirements for physical tamper-resistance and identity-based authentication. There must also be physical or logical separation between the interfaces by which "critical security parameters" enter and leave the module. Private keys can only enter or leave in encrypted form.

Level 4 This level makes the physical security requirements more stringent, requiring the ability to be tamper-active, erasing the contents of the device if it detects various forms of environmental attack.

The FIPS 140 standard technically allows for software-only implementations at level 3 or 4 but applies such stringent requirements that very few have been validated. For many organizations, requiring FIPS certification at FIPS 140 level 3 is a good compromise between effective security, operational convenience, and choice in the marketplace.

Client licenses refer to the licensing system to control the number of application hosts that can consume an HSM in its network appliance form factor (nShield 5c, nShield 5c 10G or nShield Connect XC).

Network appliance HSMs include a default total of 3 client licenses allowing a maximum of 3 concurrent client connections. Additional client licenses are available for purchase to increase this limit. Licenses are applied to an individual HSM.

Note - Client licenses are perpetual HSM feature activations. The maximum amount that can be added to a single HSM is capped based on performance tier (B/M/H). Please refer to the product notes for more information.

License transfer fees - Licenses are typically linked to the serial of an HSM. These can be transferred from one unit to another under an appropriate license (and subject to the license transfer fee).

Additional soft client licenses - a default three (3) client licenses are provided at no extra cost. Additional client licenses are at an additional cost.

Enterprise Client license - In case the number of extra clients required is considerable (typically over 30) an enterprise license is available at a higher price to allow max number of clients permitted.

Enterprise Client license transfer fees - Licenses are typically linked to the serial of an HSM. These can be transferred from one unit to another under an appropriate license (and subject to the license transfer fee).

nShield Edge Developer Edition - for the nShield Edge only and refers to the lower cost of a unit sold for development purposes only. HSMs are to be used only for non-production use in support of development or engineering activities in support of development of applications or systems that will interact with the HSMs (in addition to this restriction, the standard terms and conditions, including restrictions, continue to apply).

Serialized tamper evident packaging - required for Common Criteria eIDAS certification (and some customers require it based on their own security requirements).

nShield Feature Activation - activates a specific function that is disabled on the HSM by default. e.g.: PQ algorithms for XC, CodeSafe, Elliptic curves etc…​

Transferred Licenses - free transfer of licenses are only provided from end of support (EOS) HSMs to new HSMs, as long as Customer has an active support contract in place for the non-EOS new HSMs.

The following items are subject to additional charge unless specifically included in a package:

The nShield firmware and nShield Connect image is preloaded in the HSM (and will depend on hardware selection and proposed configurations). nShield Firmware & nShield Connect Image (ISO) contains the supported firmware and Connect images which allows for updating the HSM to later versions.

Transfer Entitlement for Option Packs - Customer may transfer their Option Packs from one HSM to another subject to a transfer fee.