|
CDSA supports diverse programming environments, ranging from ANSI C to Java. The
architecture is designed to be both modular and extensible. Extensibility is important because it
encourages ISVs to develop incremental functionality and performance improvements to remain competitive.
Figure 1: The CDSA Architecture
The heart of CDSA is the Common Security Services Manager (CSSM). CSSM is
an API with openly published specifications that an application can use to gain access to security features.
Typical requested security features include performing cryptographic operations, determining the trust level of
a certificate holder, manipulating certificates, and accessing data storage media.
CSSM gains specific security features from service provider modules.
A service provider module provides a specific subset of security functions. Four basic service provider
module types integrate into the CDSA environment. These are:
Cryptographic Service Provider (CSP) modules
CSPs perform cryptographic operations such as bulk encrypting, digesting, and digital signatures. In
addition, they store private keys. CSPs are the "lock and key" components of the CDSA structure.
Trust Policy (TP) modules
TPs implement policies defined by authorities and institutions and set the level of trust required to
carry out specific actions (such as issuing a check or access to confidential intellectual property).
The modular concept permits TP modules to be associated with the needs of specific institutions. For
example, a credit card issuer might have different trust policies than a government agency.
Certificate Library (CL) modules
CLs provide syntactic manipulation of stored certificates and revocation lists, as well as access to
remote signing capabilities such as Certification Authorities (CA).
Data Storage Library (DL) modules
DLs provide stable storage for security-related data objects – certificates, cryptographic keys,
policy objects and more. The actual storage may be in a commercially available database system, a native
file system, a custom hardware device, and so on. DLs are analogous to a "file cabinet" for
security data.
Any number of independent software or hardware vendors can create
service provider modules, highlighting the CDSA emphasis on openness and interoperability. Through the
CSSM APIs, an application can directly or indirectly select the service provider modules needed for
specific security services.
Finally, the CDSA 2.0 specification introduces elective module
managers EMM) as a key CDSA component. An EMM can add new and compelling security features not
encompassed by the current set of service providers. For example, one new feature that could be added
to CDSA with an EMM is biometric authentication. EMMs provide an important extensibility mechanism,
while at the same time minimizing the impact of new features to existing CDSA-based applications.
|
