Transaction Security Broker

The Transaction Security Broker (TSB) is designed to make using Smart Key Attributes (SKAs) is easier. The TSB implements logic that is common to the SKA workflow, but not strictly part of the authorization needing to reside in the HSM.

This page provides an overview of the TSB in the SKA context. For more details, see the TSB documentation.

Motivation

When using SKAs, an application often needs to collect authorizations from multiple different people, or it needs to wait for a certain amount of time to pass (for timelocks). This requires keeping state. Somewhere, the not-yet-complete authorizations need to be stored, the partial authorizations need to be collected, until they are ready to be forwarded to the HSM.

Since this logic is just waiting for all parts of the data to be ready, it is not security-critical, and thus doesn't need to happen inside the HSM. (Note that the authorization itself still happens inside the HSM.) At the same time, this logic does not need to be re-implemented by each application that wants to use SKAs.

Therefore, Securosys introduced the TSB. The TSB sits between the application and the HSM and handles the logic for collecting all parts of an authorization. It exposes a REST API that can be consumed by applications, and it communicates with the HSM over the JCE API.

Multi-Authorization Workflow

With the TSB, the workflow of using SKAs can look as follows:

1. A business application sends a payload to the TSB and requests it to be signed with a specific key.
2. The TSB records a signature request and returns its ID.
3. The approval clients retrieve their pending approval tasks from the TSB.
4. The approval client sends an approval of the signature request to the TSB.
5. The TSB waits for the rules to be met. Then the TSB sends the required authorization data together with the payload to the HSM.
6. The HSM checks the authorization data against the key attributes and the specific payload. If the criteria are met, the HSM signs the payload and returns the signature to the TSB.
7. The business application retrieves the signature from the TSB.

TSB as a simple REST API

The TSB can also be used for normal key operations with the HSM, without leveraging SKAs. This is useful if you want to interact with the HSM over REST, since the HSM does not provide a native HTTP interface. In this setup, the TSB provides a REST-to-JCE translation layer.