Hyperledger Foundation Hyperledger Global Forum 2018, 16 Dec 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Infrastructure for Blockchain Key Management Solutions - Patrick Lastennet, Interxion

Description

Enterprises using DLT/Hyperledger for building new business services and applications are struggling to reconcile full control and maximum protection of critical cryptographic material with the necessity to extract themselves from on-prem legacy security infrastructure. Leveraging dedicated HSMs aaS in strategically located datacentres allows to move to a cloud model without compromising on security and control.

----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #Blockchain

A

Okay, so my name is Patroclus today: I'm a director for enterprise for interaction, interaction is a datas and provider location and data center, and today I'm here to talk to you about a new service that we've launched. So it's a little bit unusual for data center provider, but we stepping up a little bit of the stack in terms of infrastructure and we start to offer an infrastructure solution that helps protect your key management solutions. So three things I will go through today. First of all, the role we play within Enterprise IT.

A

Secondly, I'd like to highlight a little bit the considerations the enterprise has as far as key management is concerned, and, lastly, we'll we'll dive a little bit on the solution itself.

A

So what we see in terms of the enterprise IT is really this: the Great Divide. So on one hand you have the application world DevOps and on the other side of the network, net ops and really this is a trend which is really exacerbated with also the advent of containerization, which really should enable you to run a workload or an application anywhere cloud, on-premise cetera.

A

So just out of interest in this audience who feels more of an allegiance to the application, DevOps yeah, I think so and the other side, anyone from the dark side of the net ops infrastructure, ok, so this is a little bit so I think this is. This is quite revealing, but it does matter when it comes to security. So how do we intend to bridge the gap?

A

Well, if you look at the enterprise network architecture, today, really three components on prime neutral colocation with it, which is what we do third-party data center with lots of connectivity and, obviously the cloud so the trend. Obviously you know workloads are migrating to the cloud. However, if you look at on-prem, you still have a number of workloads which are particularly sensitive in terms of security and performance which remain you know, managed on Prem.

A

Sas is also accessed through VPN. You know directly from from on Prem still for for other enterprises and they also still contract directly with the ISPs who popped there on their own data center. So where we are relevant, really is all these critical security and performance related workloads? More and more, there is a demand to consume them as a service, and if you want to consume another service, a natural thing is to go into a neutral colocation facility, where you have all the IT service provider or solution provider. Who can offer this? The SAS?

A

There's no real debate about this. You know we see Salesforce on high degree s, so this is very much the trend and an ultimately you internet access. You can peer. You can peer directly in in a colocation facility.

A

So the current situation in terms of security, obviously enterprise things about secure and manage encryption keys to big things on their mind as well. Gdp are obviously and a new new regulation on the radar. Now is the cloud act, u.s. cloud act, anyone familiar with this new us-based regulation, so I don't know.

A

If you recall a few years ago, Microsoft there was a big case between Microsoft and the Department of Justice, where by Microsoft's was asked to hand over emails which they had stored in Dublin in their data center in Dublin, and they eventually won the case and and didn't have to hand over these these emails.

A

Now the cloud act is aimed at addressing these type of situations and now the it is in fact the case that the US government, for instance, is in its right to obtain any information that Microsoft or any other cloud provider us-based might store abroad.

A

So obviously, this creates a lot of nervousness among certain European based enterprises, so in terms of your security and and where you want to store critical material, this becomes this becomes relevant.

A

So the major consideration in terms of key management that we hear from cecil's and CEOs, obviously hardware versus software, so you have solutions out there which are capable of managing the whole lifecycle of encryption keys like what metrics SafeNet they all do, our software solutions.

A

How do you position this? You know usability versus best practice in terms of security, which is probably more than Hardware solution cloud or on Prem. A lot of the cloud providers have got their own key management solutions and in cloud HSMs again, do you trust demo? Do you want to do it on Prem application performance? If you segregate your keys from the application, you need to think about the the latency, the round-trip time, delays, potentially between the the keys and the and the application in the space of payments. That's particularly relevant multi cloud management.

A

Obviously large enterprises think in terms of avoiding at all cost the the vendor lock-in. Do you go for the new solution, which is maybe has got an edge, but it's not completely certified or or compliant with the various regulators? And finally, how do you reconcile the fact that your senior management is pushing for consumption of IT as a service? How do you reconcile this with with security?

A

Where often you you want to have a very proprietary solution, so this is what we've taken all of this into account: we've we've partnered, so we our data center provider. We really not!

A

You know our expertise is not necessarily in cryptography, so we've partnered with a Exede secure solution, which is a a german certified trust service provider and we've partnered with all the main brands of hardware, security modules or DeMarko dallas and an gemalto, and what we offering essentially is dedicated HSN's in all of our data centers accessible either from our data center or from all of the cloud providers to which we manage and integrate the connectivity.

A

So this is a little bit the distribution of our data centers all across Europe, the network we've interconnected, all of the data centers all across Europe and we've also interconnected. All of the cloud service providers, all the main cloud service providers who often happen to have their computer and their network nodes in our data.

A

Centers so obviously you've got the the benefits of the of the proximity there and in certain given locations we rack and stack dedicated HSMs now, the way it works, we really don't have access to the content of the HSM, so the only way to access the HSM is via your key management solution or your your application. So the benefits is: there's no ambiguity as to where the HSM is there's full audit ability, so the enterprise can. We can escort them into the data center if they want to perform the key invitations manually.

A

This can be done so there's absolute certainty about where the where the cryptographic material resides and there's absolutely no risk of of a third-party provider accessing this material so symphony. This is a use case, so it's not really blockchain related, but I think it is very interesting still because it it applies to a big consortium of banks who use a symphony. This is an information sharing platform which runs on Google and aw.

A

Yes, so all the major German investment banks are now actively using this in production and we see a big overlap between those banks and some of the guys who are behind the big consortiums which are driving some of the hyper ledger initiatives. So, typically the way the way they've make use of kyojin they obviously they'll, have a dedicated Symphony pod in the cloud. They'll have dual instances of security or of key managers.

A

So that's is this: is the key manager application provided by provided by Symphony and then they'll leverage our network to to interconnect to the HSMs which are located in you, know various geographies and then obviously you can achieve the redundancy using the native, the native replication facilities of the various HSMs.

A

Okay, and but one of the first early adopter of this solution was blockchain helix as a german-based startup, which has launched an IC o---- platform. Basically, they have to manage identity and blockchain ID and to secure their databases, they decided to use juice our solution, so this is also a way for startup new companies to sort of gain.

A

This credibility, vis a vie of the regulator and the enterprise- it's it's, it gives them the stamp of approval of you know they're using the best technology in terms of all the most recognized technology as far as hsm are concerned, and, and also the the regulator love the fact that they can go and audit the data center and the actual location, whether those are HSM resides.

A

And that's it pretty.

A