AWS XKS Performance Summary

We have tested different environments to capture performance metrics for the CipherTrust Cloud Key Manager (CCKM) AWS External Key Service integration. The performance results provided within this document demonstrate the effects of deployment choices on throughput for AWS HYOK key encrypt operations for one key within one key store. This can help you plan your CipherTrust Manager deployment to meet your performance needs for AWS XKS integration. There is an AWS requirement that encrypt and decrypt requests must be completed within 250 ms. Thus, the results are presented to show the throughput possible before meeting that threshold.

All environments used an open source k6.io tool (https://k6.io/) as the REST client to simulate encrypt requests from AWS KMS. The client ran on a virtual machine with 50 GB system volume, 8 CPUs, and 64 GB of memory. For the deployments using LUNA HSM as a key source, the HSM model of Luna K7 was employed.

Tested Environments

The following deployments were tested:

• Luna Network HSM as a key source (on premises or GCP):

  • Single node of CipherTrust Manager on premises, K6 client on premises, single node of HSM

  • Single node of CipherTrust Manager on premises, K6 client on premises, two nodes of HSM in HA mode

  • Single node of CipherTrust Manager on premises, K6 client on premises, HSM in Export mode and Clone mode

  • Single node of CipherTrust Manager on GCP, K6 client on AWS, single node of HSM

  • Single node of CipherTrust Manager on GCP, K6 client on AWS, two nodes of HSM in HA mode

  • Single node of CipherTrust Manager on GCP, K6 client on AWS, HSM in Export mode and Clone mode

  • Two Cluster nodes of CipherTrust Manager on GCP, K6 client on AWS, Two nodes of HSM in HA mode

• CipherTrust Manager as a key source (on premises and on AWS):

  • Single node of CipherTrust Manager on premises, K6 client on premises

  • Single node of CipherTrust Manager on GCP, K6 client on AWS

  • Single node of CipherTrust Manager on AWS, K6 client on AWS

  • Two clustered CipherTrust Manager nodes on AWS, K6 client on AWS

The following CipherTrust Manager release version was employed in the tested deployments:

CipherTrust Managers were deployed as geographically close to the K6 client as possible to avoid potential network latencies, which can occur when crossing geographic regions. In your CCKM deployment, we similarly recommend deploying the virtual CipherTrust Manager instance geographically close to one of the AWS KMS regions where you intend to set up the AWS XKS. We recommend a network latency of round-trip communication of 35 ms or less between AWS KMS and the CipherTrust Manager. Also, if you are using Luna Network HSM as your key source for AWS HYOK, ensure the CipherTrust Manager and the HSM are geographically close and has the lowest possible latency. We recommend a network latency of round-trip communication of 25 ms or less between the CipherTrust Manager and the HSM.

The following graph was generated using a model of XKS performance. Simulated data is displayed. In this model, the internal latency of the CCKM was pre-set and the network latency between CipherTrust Manager/CCKM and the HSM was varied. The resulting data displayed in the graph captures the rapid degradation of performance with increasing network latency between CipherTrust Manager/CCKM and the HSM. In other words, increasing the latency to the HSM results in an (undesirable) non-linear degradation in performance.

Network Requirements

The following ports were opened to ensure CipherTrust Manager communication:

Used to communicate with CipherTrust Manager:

Used for Connection to LUNA HSM:

Test process

The test consisted of starting a given number of virtual users to perform encrypt operations on the AWS XKS/HYOK key. Each user simulated a separate thread. Total test duration was 40 seconds for each reading. The test was divided into the following increments:

• Ramp-up time was 5 seconds. Virtual users were started.
• Test duration was 30 seconds for each reading. Virtual users make wrap requests during this time.
• Ramp-down time was 5 seconds. Virtual users were stopped until there were zero active virtual users.

Repeating the test in your environment

We have published the scripts used with k6.io on Github, for you to repeat the tests in your own environments as desired.

AWS XKS deployment results

• LUNA HSM as a Key Source

• CipherTrust Manager as a Key Source

LUNA HSM as a key source

LUNA HSM details

HSM Details

Single node of CipherTrust Manager on premises, K6 client on premises, single node of HSM

4 CPU - 64 GB RAM

This deployment includes the following:

• Single node of CipherTrust Manager on premises
• K6 client on premises
• Single node of HSM on premises

Here are details of this deployment:

The network latency between the CipherTrust Manager and the K6 client is 0.730 ms and between the CipherTrust Manager and the HSM is 0.230 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 500.194051 per second.

8 CPU - 64 GB RAM

This deployment includes the following:

• Single node of CipherTrust Manager on premises
• K6 client on premises
• Single node of HSM on premises

Here are details of this deployment:

The network latency between the CipherTrust Manager and the K6 client is 0.730 ms and between the CipherTrust Manager and the HSM is 0.230 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 968.739411 per second.

Single node of CipherTrust Manager on premises, K6 client on premises, two nodes of HSM in HA mode

This deployment includes the following:

• Single node of CipherTrust Manager on premises
• K6 client on premises
• Two nodes of HSM (in HA mode) on premises

Here are details of this deployment:

The network latency between the CipherTrust Manager and the K6 client is 0.730 ms and between the CipherTrust Manager and the HSM is 0.366 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 1134.078952 per second.

Single node of CipherTrust Manager on premises, K6 client on premises, HSM in Export mode and Clone mode

This deployment includes the following:

• Single node of CipherTrust Manager on premises
• K6 client on premises
• Two nodes of HSM (in Export mode and Clone mode) on premises

Here are details of this deployment:

The network latency between the CipherTrust Manager and the K6 client is 0.730 ms and between the CipherTrust Manager and the HSM is 0.366 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 1018.119718 per second.

Single node of CipherTrust Manager on GCP, K6 client on AWS, single node of HSM

This deployment includes the following:

• Single node of CipherTrust Manager on GCP Cloud
• K6 client on AWS
• Single node of HSM on premises

Here are details of this deployment:

The network latency between the CipherTrust Manager and the K6 client is 29.476 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 239.413903 per second.

Single node of CipherTrust Manager on GCP, K6 client on AWS, two nodes of HSM in HA mode

This deployment includes the following:

• Single node of CipherTrust Manager on GCP Cloud
• K6 client on AWS
• Two nodes of HSM (in HA mode) on premises

Here are details of this deployment:

The network latency between the CipherTrust Manager and the K6 client is 29.476 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 211.770214 per second.

Single node of CipherTrust Manager on GCP, K6 client on AWS, HSM in Export mode and Clone mode

This deployment includes the following:

• Single node of CipherTrust Manager on GCP Cloud
• K6 client on AWS
• Sing node of HSM (in Export mode and Clone mode) on premises

Here are details of this deployment:

The network latency between the CipherTrust Manager and the K6 client is 29.476 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 221.314997 per second.

Two Cluster nodes of CipherTrust Manager on GCP, K6 client on AWS, two nodes of HSM in HA mode

This deployment includes the following:

• Two cluster nodes of CipherTrust Manager on GCP Cloud
• K6 client on AWS
• Two nodes of HSM (in HA mode) on premises

Here are details of this deployment:

The network latency between the CipherTrust Manager and the K6 client is 29.476 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 407.633572 per second.

CipherTrust Manager as a key source

Single node of CipherTrust Manager on premises, K6 client on premises

4 CPU - 16 GB RAM

This deployment includes the following:

• Single node of CipherTrust Manager on premises
• K6 client on premises

Here are details of this deployment:

The network latency between the CipherTrust Manager and the K6 client is 0.730 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 1154.094363 per second.

8 CPU - 32 GB RAM

This deployment includes the following:

• Single node of CipherTrust Manager on premises
• K6 client on premises

Here are details of this deployment:

The network latency between the CipherTrust Manager and the K6 client is 0.730 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 2646.351737 per second.

16 CPU - 32 GB RAM

This deployment includes the following:

• Single node of CipherTrust Manager on premises
• K6 client on premises

The network latency between the CipherTrust Manager and the K6 client is 0.730 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 6112.681305 per second.

Single node of CipherTrust Manager on GCP, K6 client on AWS

This deployment includes the following:

• Single node of CipherTrust Manager on GCP Cloud
• K6 client on AWS

The network latency between the CipherTrust Manager and the K6 client is 29.476 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 389.971801 per second.

Single node of CipherTrust Manager on AWS, K6 client on AWS

This deployment includes the following:

• Single node of CipherTrust Manager on AWS
• K6 client on AWS

The network latency between the CipherTrust Manager and the K6 client is 0.515 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 929.770284 per second.

Two clustered CipherTrust Manager nodes on AWS, K6 client on AWS

This deployment includes the following:

• Two clustered nodes of CipherTrust Manager on AWS
• K6 client on AWS

The network latency between the CipherTrust Manager and the K6 client is 0.515 ms.

Results:

Observation:

For this deployment, a response time compliance of 250 ms was met for a maximum throughput of 1930.219812 per second.

Conclusion

• The performance improves with higher number of CPUs. The minimum number of CPUs and RAM required: 4 CPUs and 16 GB RAM.

• Performance linearly improves with adding more CipherTrust Manager nodes.

• Partition mode (Export vs Clone) does not have any impact on performance.

• Changing HSM connections (STC vs NTLS) does not have significant affect on performance.

• If you are using Luna Network HSM as your key source for AWS HYOK, ensure the CipherTrust Manager and the HSM are geographically close and has the lowest possible latency. Increasing the latency to the HSM results in degradation in performance.

• Different models of Luna 7 HSMs have their maximum throughput. Depending on your requirement, ensure to choose a model that can meet your needs. Ensure the HSM throughput does not become a bottle neck for the deployment. Refer to Luna HSM documentation for more information. CCKM uses the AES-GCM small packet encryption algorithm on a Luna HSM for AWS XKS operations. Refer to the Luna Network HSM 7 Specifications section under the Specifications tab (next to Overview and Features) within Thales LUNA HSM to view the performance numbers for the various Luna HSM models using the AES-GCM small packet encryption algorithm.

• The results captured was for one HYOK key in one key store, which represents the total throughput. When the number of key stores is higher, the total throughput will be cumulative across key stores.