Systems and methods for hardware security module and physical safe integration

Patent metadata

Field	Value
Publication number	US-12452051-B2
Application number	US-202318096783-A
Country	US
Kind code	B2
Filing date	Jan 13, 2023
Priority date	Jan 13, 2023
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

Systems and methods for integrating a physical safe with one or more hardware security modules (“HSMs”) on a server rack may include a server rack with a biometric locking front door, one or more HSMs mounted and physically locked to the server rack, and a rack-mounted safe. The safe may be configured to fit entirely within the server rack when the server rack front door is closed, include a biometric lock on the front door that only unlocks upon a biometric authentication from each of a key custodian A and a key custodian B, and include at least two internal compartments, each secured by a biometric lock, containing physical keys for the locks of the one or more HSMs.

First claim

I claim:

1. A system for integrating a physical safe with one or more hardware security modules (“HSMs”) on a server rack, comprising:
the server rack including a first side mounting rail, a second side mounting rail, and a locking front door with a biometric lock;
one or more HSMs mounted and physically locked to the first side mounting rail through a first keyed lock and the second side mounting rail through a second keyed lock; and
a safe comprising:
a plurality of mounting ears, wherein the plurality of mounting ears fit entirely within the server rack when the server rack locking front door is closed;
a biometric lock on a safe front door configured to unlock responsive to a biometric authentication from each of a key custodian A and a key custodian B; and

a plurality of internal compartments, comprising:
a compartment A containing physical keys for the first side lock of the one or more HSMs secured by a biometric lock that unlocks responsive to biometric authentication by key custodian A; and
a compartment B containing physical keys for the second side lock of the one or more HSMs secured by a biometric lock that only unlocks responsive to biometric authentication by key custodian B.

2. The system of claim 1 , wherein the biometrics for the biometric lock on the front rack door, the biometric lock on the safe front door and the biometric lock on the compartment A and compartment B comprise one or more of fingerprint, retinal scan, voice print, and facial recognition.

3. The system of claim 1 , wherein biometric authentication is verified by a digital biometric key for each of key custodian A and key custodian B, and the digital biometric keys for key custodian A and key custodian B are encrypted.

4. The system of claim 3 , wherein the encrypted digital biometric key is stored on one or more of the rack-mounted HSMs.

5. The system of claim 4 , wherein the biometric lock on the front rack door, the biometric lock on the safe front door and the biometric lock on compartment A and compartment B are in digital communication with at least one of the one or more HSMs via a hardwired direct connection.

6. The system of claim 4 , wherein the biometric lock on the front rack door, the biometric lock on the safe front door and the biometric lock on compartment A and compartment B are in digital communication with at least one of the one or more HSMs via a network connection.

7. The system of claim 4 , wherein the biometric lock on the front rack door, the biometric lock on the safe front door and the biometric lock on compartment A and compartment B are network connected to one or more redundant HSMs in a separate rack system, and wherein the biometric locks are configured to acquire the encrypted digital biometric key from the one or more redundant HSMs over the network connection upon failure of the one or more HSMs.

8. The system of claim 1 , wherein compartment A and compartment B each store one of the two physical keys required to unlock each of the one or more HSMs from the rack.

9. The system of claim 1 , wherein the biometric authentication of key custodian A and key custodian B must occur within a predefined timeframe.

10. The system of claim 1 , wherein the safe is designed to fit within the rack and to meet weight limitations for the rack and a floor of a room where the rack is installed.

11. A method for using an integrated physical safe with one or more hardware security modules (“HSMs”) on a server rack, comprising:
receiving, at a biometric lock on a front door of the server rack, a biometric rack access attempt from one of a key custodian A and a key custodian B;
authenticating the biometric rack access attempt by comparing the biometric rack access attempt with a digital biometric key for key custodian A and key custodian B;
unlocking, as a result of the authentication, the biometric lock on the front door of the server rack to reveal one or more rack-mounted HSMs physically locked to the rack, and a rack mounted safe with a biometric lock on the front door;
receiving, by the safe, biometric safe access attempts from each of the key custodian A and the key custodian B;
authenticating the safe biometric access attempts of both the key custodian A and the key custodian B by comparing the biometric safe access attempt with the digital biometric key for key custodian A and key custodian B;
unlocking, as a result of the safe authentication, the biometric lock on the front door of the safe to reveal at least two internal compartments, a compartment A and a compartment B, compartment A having a biometric lock and containing at least one physical key and compartment B having a biometric lock and containing at least one physical key;
receiving, by the biometric lock of compartment A, a biometric compartment A access attempt by the key custodian A;
authenticating the biometric compartment A access attempt by comparing the attempt with the digital biometric key for key custodian A and key custodian B;
unlocking, as a result of the biometric compartment A authentication, the biometric lock on compartment A to provide access to the at least one physical key within compartment A;
receiving, by the biometric lock of compartment B, a biometric compartment B access attempt by the key custodian B;
authenticating the biometric compartment B access attempt by comparing the attempt with the digital biometric key for key custodian A and key custodian B;
unlocking, as a result of the biometric compartment B authentication, the biometric lock on compartment B to provide access to the at least one physical key within compartment B; and
unlocking with one of the at least one physical key from compartment A and one of the at least one physical key from compartment B, one of the one or more rack-mounted HSMs from the rack.

12. The method of claim 11 , wherein the biometrics for the biometric rack access attempt, the biometric safe access attempt, the biometric compartment A access attempt, and the biometric compartment B access attempt comprise one or more of fingerprint, retinal scan, voice print, and facial recognition.

13. The method of claim 11 , wherein the digital biometric key for key custodian A and key custodian B is encrypted.

14. The method of claim 13 , wherein the encrypted digital biometric key is stored on one or more of the rack-mounted HSMs.

15. The method of claim 14 , wherein the biometric lock on the front rack door, the biometric lock on the safe front door and the biometric lock on compartment A and compartment B are in digital communication with at least one of the one or more HSMs via a hardwired direct connection.

16. The method of claim 14 , wherein the biometric lock on the front rack door, the biometric lock on the safe front door and the biometric lock on compartment A and compartment B are in digital communication with at least one of the one or more HSMs via a network connection.

17. The method of claim 14 , wherein the biometric lock on the front rack door, the biometric lock on the safe front door and the biometric lock on compartment A and compartment B are network connected to one or more redundant HSMs in a separate rack system, and wherein the biometric locks acquire the encrypted digital biometric key from the one or more redundant HSMs over the network connection upon failure of the one or more HSMs.

18. The method of claim 11 , wherein compartment A and compartment B each store one of the two physical keys required to unlock each of the one or more HSMs from the rack.

19. The method of claim 11

Assignees

• Capital One Services Llc
• Capital One Services Inc

Inventors

• Chigurupati Srinivasa

Classifications

• E05B49/00

  Electric permutation locks; Circuits therefor {; Mechanical aspects of electronic locks; Mechanical keys therefor (arrangements for sensing or reading record carriers G06K7/00; mechanisms including electronic locks actuated by nonmechanical keys such as passive and active electrical keys and other data carriers G07C9/00, G07F7/00; electronic switching H03K17/00)} · CPC title

• G07C9/00912 Primary

  for safes, strong-rooms, vaults or the like · CPC title

• G07C9/25

  using biometric data, e.g. fingerprints, iris scans or voice recognition · CPC title

• G07C9/00563

  using personal physical data of the operator, e.g. finger prints, retinal images, voicepatterns · CPC title

• H04L9/0877 Primary

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title