Advanced Features
Automated Key Discovery & CBOM Generation: Qinsight goes beyond basic integration by actively scanning the Utimaco HSM (via RCAPI) to dynamically generate a Cryptographic Bill of Materials (CBOM). This provides a comprehensive, real-time inventory of all cryptographic assets, algorithms, and key sizes residing within the hardware boundary.
Security Policy Validation & Rotation Tracking: Qinsight automatically analyzes the fetched HSM metadata to identify weak or vulnerable cryptographic algorithms (e.g., quantum-vulnerable RSA/ECDSA, small key sizes) and tracks key rotation lifecycles, alerting administrators if keys managed by the Utimaco HSM fall out of enterprise compliance or internal policies.
High Availability / Redundancy
While the current integration was developed and verified against the u.trust-GP-HSM-Simulator v6.4.0.0 in a standalone VM, production environments can achieve High Availability by deploying the RCAPI Server behind a load balancer pointing to a physical Utimaco HSM cluster.
Scalability Recommendations
As Qinsight Atlas connects via the Utimaco REST Cryptographic API (RCAPI), the integration is inherently stateless at the application layer and highly horizontally scalable. To accommodate large-scale enterprise environments with high cryptographic discovery volumes, we recommend:
-
Horizontal Scaling of RCAPI Servers: Deploy multiple instances of the
utimaco-rcapi-server-jreDocker container across different host machines. -
Load Balancing: Place a standard Layer 7 / TCP Load Balancer (such as NGINX or HAProxy) in front of the RCAPI Docker containers.
-
HSM Clustering: Ensure the backend u.trust GP HSM Se-Series is configured in a cluster (HA group). The RCAPI instances will automatically leverage the Utimaco hardware's built-in synchronization.