Develop and execute sensitive code within a FIPS 140-3 Level 3 certified nShield hardware security module.
CodeSafe is a runtime on the Entrust nShield HSM that allows third-party developers to run their own code within the secure boundary of the module. Using the CodeSafe Developer Kit, developers write their own CodeSafe Apps, cross-compile them, and package them to run on the HSM. While on the HSM, the CodeSafe App is segregated from the actual keys loaded onto the module, including the keys the App uses. This means that CodeSafe can be used without affecting the FIPS 140 validation of the module it runs on.
Use CodeSafe as a secure root of trust and policy engine for manufacturing equipment and IoT devices, where firmware signing, device identity, and command authorization must remain safe even in a hostile factory or edge environment.
Run wallet logic and transaction-approval flows within CodeSafe so that private keys and signing policies for digital assets never leave a tamper resistant environment.
Use CodeSafe to implement the tokenization engine –PAN→token mapping, detokenization rules, and vault access – entirely inside the HSM.
Beyond basic key storage and protection, use CodeSafe to enforce complex financial controls – such as regulatory checks, per product rules, and conditional signing – at the cryptographic boundary.
Move critical decision logic (risk checks, limits, foureyes rules, approval workflows) into a CodeSafe trusted agent so even a compromised OS or rogue admin cannot bypass it.
Use CodeSafe to implement, test, and run new or nonstandard cryptographic algorithms (for example, PQC, national algorithms, proprietary schemes) inside the HSM boundary, before or instead of native firmware support.
CodeSafe can be used to execute any type of application within the tamper-resistant nShield HSM.
Because sensitive applications execute within the HSM’s secure boundary, they are safeguarded from internal and external threats.
Full specifications for CodeSafe
| Specification | Details |
|---|---|
| CodeSafe is compatible with the following programming applications: |
|
Download product documentation and resources
Our team of experts is ready to help you find the perfect solution for your business needs. Get personalized advice and competitive quotes.
We're here to help with any questions
