Home▸Cybersecurity▸HSM Key Custody: Envelope Encryption & Rotation

HSM Key Custody: Envelope Encryption & Rotation

Interactive 3D model of a Hardware Security Module protecting a master key: watch envelope encryption wrap per-object data keys inside the hardware boundary, key rotation re-wrap old keys, and unauthorized extraction attempts get blocked at the boundary.

Cybersecurity3DModerate60 FPS

This simulation renders the security model behind hardware key-management systems — the same one used by AWS KMS, Google Cloud KMS, HashiCorp Vault's HSM backend, and PKCS#11 tokens. A glowing core at the center represents the master Key-Encryption Key (KEK), sealed inside a hardware boundary it can never leave. Incoming objects generate a fresh Data Encryption Key, travel to the boundary to be wrapped by the KEK, then carry only that wrapped key out to storage — the raw key is never persisted or exposed. A rotation timer periodically mints a new KEK version and lazily re-wraps a sample of stored keys, while simulated unauthorized extraction attempts are shown bouncing off the hardware boundary and logged, since a real HSM enforces that guarantee in silicon, not software.

⚙ Under the hood

Watch a Hardware Security Module protect a master key in real time: fresh data-encryption keys travel to the hardware boundary to be wrapped, a rotation timer mints new key versions and lazily re-wraps stored keys, and simulated unauthorized extraction attempts are blocked at the boundary and logged.

cybersecuritycryptographyHSMkey managementencryptionKMS

3D · Three.js / WebGL renderer · 60 FPS target · runs fully client-side, no install