Luna HSM licensing covers Thales hardware security modules, which are dedicated appliances, cards and USB devices that protect cryptographic keys and run cryptographic operations.[5] Thales documents three licence types for Luna Network HSM 7: client licences, feature licences and partition licences.[1] Hosted equivalents are sold through Data Protection on Demand (DPoD), which Thales describes as an online platform where Luna Cloud HSM, CipherTrust and payShield services are bought by plan.[6]
Hardware variants and what is licensed
Luna HSMs come as network-attached appliances, PCIe cards, portable USB HSMs and USB backup HSMs.[5] Luna Network HSM 7 divides one physical HSM into logical partitions, each with independent data, access controls and policies, which can be dedicated to one client or shared among several; Luna PCIe HSM 7 is a single-partition card.[5] Licensing therefore concentrates on the network appliance, where the number of partitions and the connected application servers are the countable items.
| Model | Factory partitions | Maximum partitions | Maximum five-pack upgrades |
|---|---|---|---|
| Luna Network HSM 7 model 700 | 5 | 5 | Not available |
| Model 750 | 5 | 20 | 3 |
| Model 790 | 10 | 100 | 18 |
Thales publishes these figures in its upgrade purchasing page.[3] Its worked example is a model 790, shipped with 10 partitions, which needs four partition upgrades to reach a maximum of 30.[3] Catalog: Luna partition licence, partition upgrade pack, rule partition packs.
Client licences
A client licence gives the right to connect an application server, whether physical or virtual, to a Luna Network HSM 7.[1] One client licence allows multiple applications on that server and connections to multiple Luna Network HSM 7 units, and one licence suffices when several containers connected in a cluster to the same partition or HA group belong to the same application.[1] Client licences are perpetual and need no licence file, and since they are not attached to a specific HSM serial number there is no transfer procedure.[1] Catalog: Luna client licence, rules what one licence covers, perpetual and not tied to an HSM.
Where no client licence is needed
Thales states that client licences are not required for Luna USB HSM 7, Luna PCIe HSM 7 or Luna Backup HSM 7.[1] The need is also waived when other Thales solutions are used: CipherTrust Manager (physical or virtual) when the HSM serves as root of trust, key source or manager of anchored domains, WAF products, ID Prime Virtual, the DKE broker, the DPoD Luna Cloud HSM tile and Crypto Command Center.[1] The CipherTrust documentation makes the same point for CCKM: no separate Luna client licence is needed on the CipherTrust Manager, but partition licences still apply on the HSM side.[8] Catalog: waivers.
Feature licences
Feature licences apply to Luna Network HSM 7 and Luna PCIe HSM 7 and enable functionality modules, the post-quantum cryptography functionality module and Korean algorithms.[1] Functionality-module licences are enforced per device: the customer supplies the device serial number and Thales generates a licence file for it, and these licences can be revoked and reassigned through the Thales Licensing Portal, while transfer of the post-quantum module is honour based.[1] Functionality modules are allowed only on FM-ready HSMs.[3]
Partition licences and upgrades
Partition licences come in packs of five that raise the maximum number of application partitions, can be applied to a Luna Network HSM 7 and are perpetual but require a downloaded licence file; the upgrade is not destructive.[1] Only models 750 and 790 accept upgrades.[2] Upgrades can be ordered at purchase and are then installed at the factory, or ordered later as a field upgrade: Thales sends an email with an entitlement certificate carrying an entitlement identifier, which is needed to create an account on the Thales Licensing Portal and activate the licence.[2]
Upgrade licences can be revoked from one HSM so that they can be activated on another, by contacting Thales.[2] If an HSM is returned under a return material authorisation, the unit that comes back carries the purchased upgrades and Thales Customer Care revokes the upgrades in the portal on the customer’s behalf, so the licence record then refers to the replacement serial number.[2] Catalog: revocation and transfer.
Seeing what is installed
The hsm displayLicenses command lists the licences on the HSM and can be run by the Admin, Operator or Monitor roles. It separates HSM upgrade licences, some of which may be destructive, from partition creation licences, and can be used to check for available partition licences before creating a partition.[4] Thales’s example output lists a base configuration, key backup via the cloning protocol, “Maximum 100 partitions”, an allow-decommissioning capability and “Performance level 15”.[4] This is the practical way to inventory partition and performance entitlements on an appliance.
Enforcement, support and compliance
Client and feature licences are honour based: the customer is responsible for declaring the number in use to its Thales account manager and maintaining them.[1] Partition and functionality-module upgrades are enforced technically through licence files tied to the HSM. Catalog: honour-based declaration.
Support and maintenance fees are due every year, can be prepaid for up to five years at a discount, are a percentage of the licensing price and correspond to Standard, Enhanced and Premier HSM service levels. They apply to client licences and partition licences.[1] Catalog: Luna support and maintenance. See software maintenance and support.
An inventory should therefore record, for each HSM: model, serial number, partitions licensed against the maximum, functionality modules, the number of application servers connected, whether any connection uses a waived path such as CipherTrust Manager, and the support level.
Data Protection on Demand
DPoD offers Luna Cloud HSM services, formerly called HSM on Demand, and others through a Thales marketplace and other ecommerce marketplaces.[7] Thales publishes the plan limits per service. The basic Luna Cloud HSM service provides up to 20 clients per service with up to five unique client credentials, storage of up to 100 objects or 156 kb (Thales’s example is fifty 4096-bit RSA key pairs), up to 100 operations per second and no more than one key generation per second, with FIPS and non-FIPS modes selectable by the user.[7] Most of the use-case services, such as Luna Cloud HSM for Oracle TDE, for Microsoft SQL Server or for digital signing, list the same limits, while Luna HSM Backup and Luna Cloud HSM with Key Export give a limit of up to five cloning operations per second instead.[7] Catalog: plan limits.
Thales lists public DPoD prices on its marketplace, in euros only for now, with quotes available in other currencies, and describes billing choices of Full Upfront, Annual Upfront and Monthly Arrears.[6] Where a service has more than one plan, the published price is the basic plan, and partner services are quoted by the partner.[6] Catalog: DPoD billing options, rule billing choices.
Out of scope
This article does not cover payShield payment HSMs, Luna ProtectServer HSMs, the Crypto Command Center, the Thales Licensing Portal account administration, or DPoD commercial arrangement documents that were not retrieved.