This paper provides an integration guide explaining how to install a Hardware Security Module (HSM) - SafeGuard CryptoServer - within a Xen guest environment.
Concepts
Xen is a virtual-machine monitor which allows several guest operating systems to execute on the same computer hardware concurrently. In the structure of Xen systems, the Xen Hypervisor is located at the lowest and most privileged layer. Above this layer several operating systems may come, which the hypervisor schedules across the physical CPUs. The host operating system so called dom0 (domain 0) boots (using modified kernel) automatically when the hypervisor boots and receives special management privileges and direct access to all physical hardware by default. Further, the administrator can log into so called domU (U = 0, 1, 2 ...) guest operating systems. Since Xen Hypervisor runs on the hardware directly (bare-metal) unlike classical virtual machines, it is possible to pass-through the PCI slot, which SafeGuard CryptoServer is connected to, up to the guest operating system where the CryptoServer is configured. It is sufficient to install the driver on the guest operating system only.
The SafeGuard CryptoServer is a hardware security module developed by Utimaco Safeware AG, i.e., a physically protected specialized computer unit designed to perform sensitive cryptographic tasks and to securely manage cryptographic keys and data. In a SafeGuard CryptoServer security system security-relevant actions can be executed, and security relevant information can be stored. It can be used as a universal, independent security component for heterogeneous computer systems.