# HSM4 SSL: Leveraging HSMs for Enhanced Intra-Domain Security +
## 3 HSM4 SSL Architecture
### HSM4 SSL: Low-Level Architecture
#### 3.3.6. HSM4 SSL Physical Layer  
The physical layer includes the hardware components and infrastructure necessary for the secure operation of the system, such as the following:  
* HSMs: The physical layer includes tamper-resistant HSMs that provide cryptographic services. HSM4 SSL relies on the security of those HSMs as they adhere to strict security standards such as FIPS 140-2, which are engineered to protect sensitive data and manage cryptographic keys with unmatched security, thereby strengthening the SSL operations, which are crucial for secure intra-domain communication. Plus, to accommodate various needs and requirements and to allow for greater flexibility, HSM4 SSL supports an array of HSMs from multiple vendors. This multi-vendor approach ensures that organizations are not locked into a single provider, thereby reducing the risk of vendor lock-in and allowing for a customized security fit. The integration process is streamlined, ensuring that adding a new HSM to the environment is as simple as possible. Moreover, in light of the evolving landscape of cybersecurity threats due to the arrival of quantum computers, HSM4 SSL must evolve at a comparable pace. Of note is that the National Institute of Standards and Technology (NIST) has selected four cryptographic algorithms covering key exchange and digital signatures that are pending standardization. However, the development of post-quantum safe HSMs is considered a hot topic by leading HSM manufacturers, such as Thales and Crypto4A [30; 31], as building a post-quantum safe HSM requires completely different cryptographic frameworks compared to those employed in contemporary HSMs. Moreover, as HSM4 SSL is designed for quick adaptability, we are certain that as these post-quantum safe algorithms and HSMs are standardized and developed, HSM4 SSL will be able to incorporate these HSMs into the architecture.
* Databases: For supplementary storage capacity, the physical layer may include databases that store cryptographic elements, such as keys, certificates, and audit logs. These databases can be located either on the same server as the HSMs or on a separate server.
* Virtual HSM: In addition to physical HSMs, the physical layer supports the virtual HSM, also known as a HSM simulator. It is important to note that the HSM4 SSL architecture has been developed and thoroughly tested in the SoftHSM simulator environment. SoftHSM provides a software-based emulation of an HSM and offers a controlled environment for cryptographic operations and secure storage [32].  
Figure 8: HSM4 SSL JSON-based assignment policy set.  
The physical layer is designed with scalability in mind. As new cryptographic challenges arise and industrial needs change, HSM4 SSL's physical layer can easily incorporate newer HSMs that meet these evolving standards. Plus, the HAL can be dynamically updated to include the newly added HSM's driver to facilitate communication. This process allows HSM4 SSL to leverage the latest HSM technology without requiring any modifications to the system's core architecture and ensure long-term viability and effectiveness.