A method comprising: in a hardware security system: establishing a communication connection with a hardware security module, HSM, (128, 420, 820) of each of a plurality of nodes; providing security controller circuitry for each of the nodes, the security controller circuitry comprising: an HSM interface (250, 402, 502, 602, 702, 802) that includes: a security circuitry application programming interface, API; and an API-to-API mapping (506,606, 706); receiving, at the security controller circuitry, a security function call made to the security circuitry API (504,604,704) of each of the nodes; responsively invoking, by the security controller circuitry, processing chaincode that support an implementation of a data storage layer for the nodes, wherein the chaincode updates the balances of two accounts in the data storage layer in order to transfer value between the accounts, wherein each of the accounts includes a URL for a corresponding peer node of the account, wherein each of the accounts is encrypted with peer node keys for the corresponding peer node of the account and cannot be decrypted by keys of another peer node; mapping the security function call to an HSM specific function call for a respective HSM (128, 420, 820) of each of the corresponding nodes, the mapping performed via the API-to-API mapping (506,606, 706); transmitting the HSM specific function call to the respective HSM (128, 420, 820) of each of the corresponding nodes; and receiving a security response from the respective HSM (128, 420, 820) of each of the corresponding nodes, the security response received over the communication connection, and the security response received in response to the HSM specific function call. establishing a communication connection with a hardware security module, HSM, (128, 420, 820) of each of a plurality of nodes; providing security controller circuitry for each of the nodes, the security controller circuitry comprising: an HSM interface (250, 402, 502, 602, 702, 802) that includes: a security circuitry application programming interface, API; and an API-to-API mapping (506,606, 706); a security circuitry application programming interface, API; and an API-to-API mapping (506,606, 706); receiving, at the security controller circuitry, a security function call made to the security circuitry API (504,604,704) of each of the nodes; responsively invoking, by the security controller circuitry, processing chaincode that support an implementation of a data storage layer for the nodes, wherein the chaincode updates the balances of two accounts in the data storage layer in order to transfer value between the accounts, wherein each of the accounts includes a URL for a corresponding peer node of the account, wherein each of the accounts is encrypted with peer node keys for the corresponding peer node of the account and cannot be decrypted by keys of another peer node; wherein the chaincode updates the balances of two accounts in the data storage layer in order to transfer value between the accounts, wherein each of the accounts includes a URL for a corresponding peer node of the account, wherein each of the accounts is encrypted with peer node keys for the corresponding peer node of the account and cannot be decrypted by keys of another peer node; mapping the security function call to an HSM specific function call for a respective HSM (128, 420, 820) of each of the corresponding nodes, the mapping performed via the API-to-API mapping (506,606, 706); transmitting the HSM specific function call to the respective HSM (128, 420, 820) of each of the corresponding nodes; and receiving a security response from the respective HSM (128, 420, 820) of each of the corresponding nodes, the security response received over the communication connection, and the security response received in response to the HSM specific function call. the security response received over the communication connection, and the security response received in response to the HSM specific function call.