Der WvdS Crypto Service besteht aus zwei unabhaengigen Daemons auf L4Re:
L4Re System +---------------------------------------------------------------------+ | | | +------------------+ +------------------+ +--------------+ | | | crypto_service | | est_service | | OEM Gateway | | | | | | | | | | | | * AES-256-GCM | | * EST Protocol | | * Ihr Code | | | | * ML-DSA Sign | | * Cert Request | | * Sensordaten| | | | * ML-KEM KeyGen | | * Cert Renewal | | * Business | | | +--------+---------+ +--------+---------+ +------+-------+ | | | | | | | +------------------------+----------------------+ | | Shared Memory IPC | | | +---------------------------------------------------------------------+
| Funktion | Kryptografische Operationen |
| Protokoll | Request/Response ueber Shared Memory |
| Bibliothek | OpenSSL 3.6 mit FIPS Provider |
Der crypto_service fuehrt alle kryptografischen Operationen aus:
| Funktion | Zertifikatsverwaltung |
| Protokoll | EST (Enrollment over Secure Transport) |
| RFC | RFC 7030 |
Der est_service handhabt:
Die Kommunikation zwischen OEM Gateway und Crypto Service erfolgt ueber Shared Memory:
OEM Gateway crypto_service
| |
| 1. Request in Shared Memory |
+------------------------------------->|
| |
| 2. Signal (IPC) |
+------------------------------------->|
| |
| 3. Verarbeitung |
| |
| 4. Response in Shared Memory |
|<-------------------------------------+
| |
| 5. Signal (IPC) |
|<-------------------------------------+
Vorteile:
Einschraenkungen:
wvds-crypto-svc-0.2.0-oem-delivery.tar.gz | +-- bin/ | +-- aarch64/ | +-- wvds_crypto_service # FERTIGER DAEMON (L4Re Task) | +-- lib/ | +-- aarch64/ # ARM64 Target (L4Re) | | +-- libl4re_crypto_service.so # Crypto Service Library | | +-- libcrypto.so.3 # OpenSSL 3.6 | | +-- libssl.so.3 # OpenSSL 3.6 | | +-- fips.so # FIPS Provider | | +-- fipsmodule.cnf # FIPS Konfiguration | +-- x86_64/ # x86_64 (fuer lokale Tests) | +-- [gleiche Dateien] | +-- include/ | +-- wvds_crypto.h # C Header fuer Helper-Funktionen | +-- certs/ # Test-Zertifikate | +-- root_ca.pem / .der | +-- service_cert.pem / .der | +-- client_cert.pem / .der | +-- scripts/ | +-- extract_certs.py # Zertifikat-Tool | +-- install.sh # Installations-Script +-- README_OEM.md # Quick Start +-- WvdS_KB_OEM.md # Knowledge Base
Der Crypto Service unterstuetzt verschiedene Key Storage Optionen:
| Option | Sicherheit | Konfiguration |
| File | Basis | Keys im Dateisystem (verschluesselt) |
| TPM | Hoch | Keys im Trusted Platform Module |
| HSM | Maximal | Keys im Hardware Security Module |
Die Konfiguration erfolgt ueber config.json (siehe Installation).
+---------------------------------------------------------------+ | L4Re Microkernel | +---------------------------------------------------------------+ | | | | | | | +--+--+ +---+---+ +---+---+ +---+---+ | | | Sigma0 | | Moe | | Crypto | | OEM | | | | (Root) | | (Mem) | | Service| | Gateway| | | +--------+ +-------+ +--------+ +--------+ | | | | | | +--------------+ | | Shared Memory | | (nur diese beiden) | +---------------------------------------------------------------+
Isolation: