Netscape Certificate Management System 6.2, Руководство администратора

Страница: 64 / 874

System Architecture
64 Netscape Certificate Management System Administrator’s Guide • June 2003
http://www.mozilla.org/projects/security/pki/jss/index.html
NSS
Network Security Services (NSS) is a set of libraries designed to support
cross-platform development of security-enabled communications applications.
Applications built with the NSS libraries support the SSL protocol for
authentication, tamper detection, and encryption as well as the PKCS #11 interface
for cryptographic token interfaces. Netscape uses NSS to support these features in
a wide range of products, including CMS. NSS documentation can be found
on-line at:
http://www.mozilla.org/projects/security/pki/nss/overview.html
PKCS #11
Public-Key Cryptography Standard (PKCS) #11 specifies an API used to
communicate with devices that hold cryptographic information and perform
cryptographic operations. Because it supports PKCS #11, CMS works with a wide
range of hardware and software devices intended for such purposes.
One or more PKCS #11 modules must be available to any CMS subsystem instance.
As shown in the figure, a PKCS #11 module (also called a cryptographic module or
cryptographic service provider) manages cryptographic services such as
encryption and decryption via the PKCS #11 interface. PKCS #11 modules can be
thought of as drivers for cryptographic devices that can be implemented in either
hardware or software. Netscape provides a built-in PKCS #11 module with CMS.
A PKCS #11 module always has one or more slots, which can be implemented as
physical hardware slots in some form of physical reader (for example, for smart
cards) or as conceptual slots in software. Each slot for a PKCS #11 module can in
turn contain a token, which is the hardware or software device that actually
provides cryptographic services and optionally stores certificates and keys.
Netscape provides two built-in modules with CMS:
• Default Netscape Internal PKCS #11 Module. This comes with two built-in
tokens:
❍
The Internal Crypto Services token performs all cryptographic operations,
such as encryption, decryption, and hashing.