Cryptographic HSM infrastructure is a costly although critical part of any payment system. Until recently it has been necessary for payments providers to manage their own Payment HSMs – involving both exacting physical security requirements and scarce cryptographic security expertise. These constraints have made it difficult, if not impossible, to migrate payment applications to the cloud.
In response, the HSM industry has developed a number of Cloud Payment HSM offerings. These include ‘bare metal’ offerings which provide secure hosting but leave the management of the devices to the customer. Other ‘Payment Cryptography as a Service’ offerings provide more fully managed multi-tenant services.
