Transaction Security Broker (TSB)

Modern financial and digital asset applications require more than basic key usage. They increasingly depend on fine-grained policies and complex workflows.

Implementing these workflows directly inside each application is complex. They require state management, authorization collection, and reliable coordination, while ensuring that all security-critical checks remain inside the HSM.

Solution

The Securosys Transaction Security Broker (TSB) simplifies the implementation of advanced authorization and key-usage workflows and how applications interact with the Primus HSM. TSB is a Java-based service that communicates with the HSM over JCE while exposing a language-agnostic REST API that applications can use without installing client-side libraries. All cryptographic operations and security-critical checks remain inside the HSM, while TSB orchestrates request handling, approval logic, and workflow state.

Approvals can be provided using signing keys held on crypto tokens, in software, or through the Securosys Authorization App. The Securosys Authorization App provides approvers with a simple interface to receive notifications, review requests, and submit approvals. TSB manages communication with the app and collects approvals before forwarding authorized operations to the HSM.

TSB supports two usage modes. In its basic mode, it acts as a REST translation layer, enabling applications to perform signing, decryption, and key management operations through REST calls. In its workflow mode, TSB manages Smart Key Attribute (SKA) approval processes by collecting authorizations, coordinating multi-step workflows, and forwarding completed authorization data to the HSM. This separation ensures that all the approvals required by the SKA policy have been gathered together by TSB outside the HSM, while only the HSM itself enforces all policies

TSB provides a language-agnostic REST API to access Primus HSM functionality without client-side libraries. This simplifies integration with modern applications and services.

TSB manages approval collection and workflow state for SKA-enabled keys, reducing complexity for applications while ensuring that all authorization checks remain inside the HSM.

TSB can run as multiple container instances connected to the same HSM partition, enabling horizontal scaling and integration with high-availability HSM clusters.

All cryptographic operations and SKA policy validations occur inside the secure physical boundary of the Primus HSM, ensuring key protection with tamper-resistant hardware at every stage.

TSB can be deployed on external platforms or within the HSM as VaultContainers, offering architectural flexibility based on operational and regulatory needs.

The approval process applies when using Smart Key Attributes with TSB.

To support SKA workflows, the Securosys Authorization App enables approvers to receive notifications, review pending tasks, and provide approvals directly from their devices. The app integrates with TSB, which orchestrates the workflow while the HSM performs all policy enforcement.

Step 1

Request Approval

A business application requests a key operation (e.g., signing) via TSB.

Step 2

Policy Retrieval

The HSM returns the SKA policy associated with the key, with a signed timestamp.

Step 3

Broadcast Request

The application fetches the approval request from TSB and broadcasts it to approvers.

Step 4

Collect Approvals

TSB collects approvals until the key’s SKA rules are met.

Step 5

Authorization Validation

TSB forwards the payload and collected approvals to the HSM.The HSM validates authorization data according to SKA attributes.

Step 6

Final Signature

If all conditions are met, the HSM signs the payload and returns the signature to TSB.

Enable m-of-n or multi-layer approval flows for high-value financial transactions, ensuring controlled and verifiable authorization.

Enforce time-based policies to delay or restrict key operations, reducing operational risk.

Combine device-based approvals, user roles, or multi-device workflows with HSM-based key protection.

Define complex, granular SKA policies for key usage and enforce them through TSB for digital assets, financial operations, and regulated environments.

Challenge

Solution

Key Benefits

Use Cases

Transaction Security Broker (TSB)

Challenge

Solution

Key Benefits

Use Cases

Related Products