payShield Manager

payShield Manager

Reduce operating costs by managing payShield HSMs remotely

payShield Manager from Thales e-Security enables security teams to perform all tasks remote from data centers, reducing costs and delivering greater operational efficiency. It is a hardware security module (HSM) management tool specifically designed for the Thales payShield 9000 HSM that operates via a standard browser interface.

A secure connection to the HSM, underpinned by smart card access control, enables key management, security configuration and software/license updates to be carried out remotely. Flexibility to check the operational status of any HSM is also provided via a dedicated, restricted operator role. The result is dramatic reductions in operating costs.

Designed with the most stringent security requirements in mind, Thales payShield Manager addresses two primary challenges faced by today’s organizations: how to securely manage payment HSMs across multiple data centers and how to accommodate the rising number of operations that must be performed.

Today’s increasing workload often leads to more travel and higher costs. But with Thales payShield Manager, once the HSMs are initially installed in the data center rack (without reliance on the security team or master key component holders), configuration and management tasks can be executed securely from a remote location using a standard web browser interface.

Beyond eliminating the time and cost of travel, the browser streamlines operations by enabling faster execution of complex commands. With the ability to provide greater separation of duties, security personnel can delegate more routine tasks for less security sensitive operations while maintaining the high levels of security demanded in today’s payment ecosystem.


Key Benefit

  • Reduces operating costs by eliminating the need for physical presence for HSM management.
  • Provides 24 x 7 management even when local physical access to HSMs is not available.
  • Supports a large number of HSMs deployed across multiple locations.
  • Operates seamlessly with VPNs and firewalls.
  • Adapts rapidly to evolving organizational needs through support of a management port white list for device access.


Security Features

  • Strong authentication during connection to the hardware security module (HSM) helps eliminate man-in-the-middle attacks, therefore providing a secure management session with all cryptographic keys protected by HSMs and/or secure smart cards at all times.
  • Data encryption on all communications between the browser interface and the HSM provides the necessary confidentiality when connecting across open networks.
  • Comprehensive access controls, down to the level of individual HSMs, provides high levels of flexibility for system administrators.
  • Works seamlessly in conjunction with existing corporate security solutions including VPNs, firewalls and anti-virus software.
  • Administrator and Operator roles under smart card access control, providing clear segregation of duties.


Operational Features

  • All configuration and management tasks can be performed at a location remote from the data center, thereby saving time and money and providing on-demand access to HSMs.
  • The ability to run custom console commands via the ‘Virtual Console’ facility removes reliance on data center direct HSM access using a traditional console interface.
  • Read-only access using the ‘Restricted User’ role facilitates rapid checking that any given HSM is working correctly without full secure login to the payShield HSM being required.
  • The ability to define and manage logical groups of HSMs provides a flexible and secure way to segregate complex HSM environments into smaller manageable units assigned to dedicated security teams.
  • Flexible administration enables changes to HSMs and/or security personnel to be implemented quickly and securely.


Solution components

  • PC or laptop (to be supplied by the user) to be used for the local or remote access point incorporating an Internet Explorer or Firefox web browser running on any operating system
  • USB-connected or built-in standard PC/SC smart card reader with secure PIN Pad recommended
  • Thales warranted smart cards for remote access specially designed for use with payShield Manager
  • Remote Management software license for each HSM is required to operate in the remote mode of payShield Manager


HSM compatibility

  • payShield 9000 with firmware version 3.0 or later


User interface

  • Standard browser (Internet Explorer and Firefox) – identical interface for both local and remote modes of operation
  • Rapid navigation via intuitive menu system using web-based accordion presentation style and simple parameter selection
  • Virtual Console provides support for customer-specific Console commands


System configuration

  • Factory warranting process to establish trust model for HSMs and smart cards
  • Customer commissioning process to facilitate secure initialization
  • Creation and management of separate domains of HSMs that form logical groups when used in conjunction with payShield Manager
  • Management of security personnel (administrators and operators) incorporating personalized smart cards for secure access control, providing role separation
  • Allocation of security personnel to individual HSMs and selected operations


Local and remote device management

  • Online, offline, secure and authorized state operations with smart cards used as substitutes for physical keys during local and remote operations
  • Local master key (LMK) management – generation, installation and migration
  • Interface management – host, alarm, management and printer port settings
  • Security configuration settings
  • Loading of firmware and license files via HTTPS session
  • Audit trail and error log management
  • Diagnostic information – including utilization statistics, configuration settings and health check data


Virtual Console

  • Generate keys
  • Import keys
  • Export keys
  • Access to all non-smart card-based Console commands
  • Access to custom Console commands



  • Strong mutual authentication for establishment of remote session
  • Data encryption to protect all data between user smart card and HSM
  • AES 256-bit session keys, ECC 521-bit certificates
  • GlobalPlatform compliant smart cards with Thales applet – secure distribution from approved source, not available on open market