Operating models
Summary. TrustBridge runs in three models. In the Managed model, an operating partner handles installation, updates, monitoring, and certificate management for an organization that does not want to maintain cryptographic infrastructure of its own. In the Customer Managed model, an organization runs everything itself. In the Federated Hybrid model, organizations using different models work together in the same supply chain. One rule holds in all three: operating a system is not owning its keys. Only the organization's own people grant approvals, its certificate authority's keys live in an HSM assigned to that organization alone, and a change of operator succeeds without handing over private keys.
Terms
- Operating partner – a company that, in the Managed model, runs a TrustBridge installation for an organization within the scope agreed by contract.
- Installation – an organization's components: CA worker, HSM, online services, management application, key agents, and TLS adapters.
- Custodian – a person holding a share of the access to the offline root.
- CA generation – a set of CA keys and certificates with its own lifetime; a new generation replaces the previous one.
The three models
graph TD
subgraph M1 [Managed]
O1[Organization:<br/>approvers, custodians, policies]
P1[Operating partner:<br/>installation, updates, monitoring]
H1[HSM<br/>for this organization only]
end
subgraph M2 [Customer Managed]
O2[Organization:<br/>everything in-house]
H2[HSM<br/>of the organization]
end
subgraph M3 [Federated Hybrid]
X1[Supplier, Managed]
X2[Enterprise, Customer Managed]
X3[Partner with its own<br/>enterprise PKI]
end
P1 -->|operates| H1
O1 ==>|approves| H1
O2 ==>|operates and approves| H2
X1 ---|relationship| X2
X2 ---|relationship| X3
classDef par fill:#deecf9,stroke:#0078d4,color:#201f1e
classDef onl fill:#f3f2f1,stroke:#605e5c,color:#201f1e
classDef tcb fill:#fde7e9,stroke:#a4262c,color:#201f1e
class O1,O2,X1,X2,X3 par
class P1 onl
class H1,H2 tcb
style M1 fill:#ffffff,stroke:#8a8886,color:#201f1e
style M2 fill:#ffffff,stroke:#8a8886,color:#201f1e
style M3 fill:#ffffff,stroke:#8a8886,color:#201f1e| Model | For whom | Who operates | Who approves |
|---|---|---|---|
| Managed | Small and mid-sized businesses that want secure connections to their customers without maintaining their own cryptographic infrastructure | The operating partner, within the contractually agreed scope | The organization's own people |
| Customer Managed | Large enterprises and organizations with their own security infrastructure | The organization itself | The organization's own people |
| Federated Hybrid | Supply chains in which organizations use different models or their own PKIs | Each organization according to its model | Each organization for itself |
Responsibilities in the Managed model
| Task | Operating partner | Organization |
|---|---|---|
| Installation and configuration | Carries it out | Sets the requirements |
| Security updates | Carries them out, within agreed timeframes | Is informed |
| Monitoring and troubleshooting | Carries it out | Is informed of disruptions |
| Certificate lifecycle management (renewal, revocation on instruction) | Carries it out | Approves manual issuances, instructs revocations |
| Approval of manual orders | – | The organization's people, with their own approval keys |
| Trust relationships and policies | Sets them up technically | Agrees on and approves them |
| Offline root ceremonies | Conducts them | Provides the custodians |
| Help with security incidents | Assists, within the agreed scope | Decides on emergency revocation and relationship revocation |
| Technical support | Provides it | – |
The operating partner holds no approval keys and none of the key agents' secrets. It can prepare an issuance but cannot trigger one; the trust model explains why control over the database and the management application is not enough for that.
Responsibilities in the Customer Managed model
The organization runs its certificate authorities, private keys, HSMs, policies, relationship approvals, certificates, reviews, and operating procedures itself. WKL supplies the software, its updates, interoperability with other TrustBridge installations and enterprise PKIs, this documentation, and the agreed support.
Working together in the Federated Hybrid model
An organization does not give up its independence by working with others. Every relationship is bilateral, and no organization needs another organization's operator to set one up:
| Constellation | How the relationship comes about |
|---|---|
| Managed and Customer Managed | Both installations exchange trust anchors; the operating partner sets up the supplier's side, and the supplier grants the approval |
| Two organizations with different operating partners | As above; the operating partners play no role toward each other |
| TrustBridge and an existing enterprise PKI | The partner brings its PKI's anchor into the relationship and equips the systems involved with a TLS adapter and key agent |
Where the keys live
| Key | Managed | Customer Managed |
|---|---|---|
| Offline root | Offline; accessible only to the organization's custodians | Offline, at the organization |
| Keys of the issuing CAs | An HSM, or a dedicated HSM partition, assigned exclusively to this organization | The organization's HSM |
| Approval keys | Personal hardware tokens of the organization's approvers | Same as Managed |
| System and agent keys | On the systems themselves | Same as Managed |
| Key agents' secrets | Only on the two hosts involved | Same as Managed |
Changing operators and ending a cooperation
A change of operator or of model requires no hand-over of private keys. It runs through a new CA generation:
- New issuing CA keys are created in the new environment and certified by the organization's root in a ceremony with its custodians.
- The organization adds the new generation to its relationships; partners recognize it alongside the old one.
- Systems receive certificates from the new generation at their next renewal.
- After the transition period, the old generation is revoked and its keys are destroyed in the old HSM; the destruction is logged.
When a cooperation between two organizations ends, each revokes its direction of the relationship; see Federation and bilateral trust. Ledgers and evidence stay with the organization they belong to.
What this page does not define
- No prices or contract terms. An operating partner's scope, timeframes, and response times are set by the contract with that partner.
- No obligation to use a particular operator or a subscription. Every organization can change its model.
- No transfer of responsibility for approvals. In the Managed model, whoever approves is always one of the organization's own people.