~~NOTOC~~
{{wvds:title>Architecture}}

===== System Architecture =====

==== Two-Daemon Architecture ====

The WvdS Crypto Service consists of two independent daemons on L4Re:

<code>
                           L4Re System
+---------------------------------------------------------------------+
|                                                                     |
|  +------------------+     +------------------+     +--------------+ |
|  |  crypto_service  |     |   est_service    |     | OEM Gateway  | |
|  |                  |     |                  |     |              | |
|  |  * AES-256-GCM   |     |  * EST Protocol  |     | * Your Code  | |
|  |  * ML-DSA Sign   |     |  * Cert Request  |     | * Sensor Data| |
|  |  * ML-KEM KeyGen |     |  * Cert Renewal  |     | * Business   | |
|  +--------+---------+     +--------+---------+     +------+-------+ |
|           |                        |                      |         |
|           +------------------------+----------------------+         |
|                         Shared Memory IPC                           |
|                                                                     |
+---------------------------------------------------------------------+
</code>

=== crypto_service ===

| Function | Cryptographic operations |
| Protocol | Request/Response via Shared Memory |
| Library | OpenSSL 3.6 with FIPS Provider |

The crypto_service performs all cryptographic operations:
  * AES-256-GCM Encrypt/Decrypt
  * ML-DSA Sign/Verify
  * ML-KEM KeyGen/Encaps/Decaps

=== est_service ===

| Function | Certificate management |
| Protocol | EST (Enrollment over Secure Transport) |
| RFC | RFC 7030 |

The est_service handles:
  * Initial certificate request (Enrollment)
  * Certificate renewal (Re-Enrollment)
  * CA certificate retrieval

----

==== Shared Memory Communication ====

Communication between OEM Gateway and Crypto Service uses Shared Memory:

<code>
OEM Gateway                          crypto_service
    |                                      |
    |  1. Request in Shared Memory         |
    +------------------------------------->|
    |                                      |
    |  2. Signal (IPC)                     |
    +------------------------------------->|
    |                                      |
    |  3. Processing                       |
    |                                      |
    |  4. Response in Shared Memory        |
    |<-------------------------------------+
    |                                      |
    |  5. Signal (IPC)                     |
    |<-------------------------------------+
</code>

**Advantages:**
  * No kernel overhead for data transfer
  * Zero-copy for large payloads
  * Maximum performance

**Limitations:**
  * Max Payload: 64 KB
  * Synchronous processing (one request at a time)

----

==== Delivery Contents ====

<code>
wvds-crypto-svc-0.2.0-oem-delivery.tar.gz
|
+-- bin/
|   +-- aarch64/
|       +-- wvds_crypto_service          # READY-TO-USE DAEMON (L4Re Task)
|
+-- lib/
|   +-- aarch64/                         # ARM64 Target (L4Re)
|   |   +-- libl4re_crypto_service.so    # Crypto Service Library
|   |   +-- libcrypto.so.3               # OpenSSL 3.6
|   |   +-- libssl.so.3                  # OpenSSL 3.6
|   |   +-- fips.so                      # FIPS Provider
|   |   +-- fipsmodule.cnf               # FIPS Configuration
|   +-- x86_64/                          # x86_64 (for local testing)
|       +-- [same files]
|
+-- include/
|   +-- wvds_crypto.h                    # C Header for helper functions
|
+-- certs/                               # Test certificates
|   +-- root_ca.pem / .der
|   +-- service_cert.pem / .der
|   +-- client_cert.pem / .der
|
+-- scripts/
|   +-- extract_certs.py                 # Certificate tool
|
+-- install.sh                           # Installation script
+-- README_OEM.md                        # Quick Start
+-- WvdS_KB_OEM.md                       # Knowledge Base
</code>

----

==== Key Storage ====

The Crypto Service supports various key storage options:

| Option | Security | Configuration |
| File | Basic | Keys in filesystem (encrypted) |
| TPM | High | Keys in Trusted Platform Module |
| HSM | Maximum | Keys in Hardware Security Module |

Configuration is done via ''config.json'' (see [[.:installation|Installation]]).

----

==== Security Boundaries ====

<code>
+---------------------------------------------------------------+
|                    L4Re Microkernel                           |
+---------------------------------------------------------------+
|     |              |              |              |            |
|  +--+--+       +---+---+      +---+---+      +---+---+        |
|  | Sigma0 |    | Moe   |      | Crypto |     | OEM   |        |
|  | (Root) |    | (Mem) |      | Service|     | Gateway|       |
|  +--------+    +-------+      +--------+     +--------+        |
|                                   |              |             |
|                                   +--------------+             |
|                                   Shared Memory                |
|                                   (only these two)             |
+---------------------------------------------------------------+
</code>

**Isolation:**
  * Each task has its own address space
  * Crypto Service can only be reached via defined IPC
  * Kernel enforces capability-based access control

----

[[.:start|< Back to Overview]]