5
Chapter 3
Implementation overview
Implementation architecture
To implement a hardware based cryptographic service provider, essentially three
elements are required.
1.
One or more hardware security modules (HSMs) for key processing and storage.
2.
High level cryptographic API software. This software uses HSM services when
providing “cryptographic service provider” functionality to applications.
3.
Access provider software to implement the connection between the cryptographic
API software and the HSMs.
Where key processing and storage is to be implemented using a standalone SafeNet
ProtectServer Network HSM, the cryptographic service provider will operate in
network mode.
In network mode, Network HSM Access Provider software is installed on the same
machine used to host the cryptographic API software. It is used to implement the
connection between and the SafeNet ProtectServer Network HSM and the
cryptographic host using a TCP/IP network connection. The SafeNet ProtectServer
Network HSM can then be located at any distance from the machine hosting the
access provider, cryptographic API and application software.
A network mode implementation of a cryptographic service provider using the
SafeNet ProtectServer Network HSMis shown in the next figure.
PC
– Network Client and Application Host
Crypto
API
Application
Network
Network HSM
Access
Provider
SafeNet ProtectServer
Network HSM
