Personal Network HSM (pNHSM)

The EtherTrust Personal Network HSM (pNHSM) is an innovative hardware security architecture built around a grid of Secure Elements. Each Secure Element, associated with a Secure Element Processor (SEP), embeds an independent TLS 1.3 Pre-Shared Key (PSK) End Server, known as TLS for Secure Elements (TLS-SE), and is individually addressed using Server Name Indication (SNI). A TLS Front Server provides TCP/IP connectivity and SNI-based routing, directing incoming TLS connections to the appropriate Secure Elements without terminating the end-to-end TLS sessions. Each Secure Element integrates its own Key Management System (KMS) and secure command-line shell interface, enabling independent cryptographic operations and secure key management within a dedicated, physically isolated hardware security domain.

About pNHSM

TLS-SE specification

SEP specification

LeMonolith

LeMonolith is a compact, single-Secure-Element implementation of the EtherTrust pNHSM architecture. It combines a System-on-Chip (SoC), acting as a TLS Front Server providing TCP/IP connectivity, with a dedicated Secure Element operating as a TLS 1.3 Pre-Shared Key (PSK) End Server. The Secure Element provides a physically isolated security environment integrating its own Key Management System (KMS) and secure shell interface. LeMONOLITH delivers hardware-protected cryptographic services and secure key management in a compact, standalone network-connected device.

LeMonolith: User Manual

Talk EthCC[8]

MFA TLS-IM Token

The EtherTrust MFA TLS Identity Module (TLS-IM) Token is an innovative hardware security device combining a microcontroller and a TLS-IM javacard, to provide strong multi factor authentication. It performs TLS 1.3 pre-shared-key (PSK) cryptographic operations within a tamper-resistant chip. It enables secure authentication to TLS 1.3 PSK servers without exposing PSK.
It combines three authentication factors: physical possession, PIN verification, and explicit user confirmation through a push button. Its security architecture also includes microcontroller authentication using dynamic SRAM Physical Unclonable Functions (dPUF), firmware integrity verification through Bijective MAC Time-Stamped (bMAC_TS) attestation, and PKI-based Secure Element authentication. It also supports secure remote administration through a dedicated embedded TLS-PSK channel, providing a hardware-based foundation for trusted digital authentication.