System Architecture

Two-Daemon Architecture

The WvdS Crypto Service consists of two independent daemons on L4Re: 

                           L4Re System
+---------------------------------------------------------------------+
|                                                                     |
|  +------------------+     +------------------+     +--------------+ |
|  |  crypto_service  |     |   est_service    |     | OEM Gateway  | |
|  |                  |     |                  |     |              | |
|  |  * AES-256-GCM   |     |  * EST Protocol  |     | * Your Code  | |
|  |  * ML-DSA Sign   |     |  * Cert Request  |     | * Sensor Data| |
|  |  * ML-KEM KeyGen |     |  * Cert Renewal  |     | * Business   | |
|  +--------+---------+     +--------+---------+     +------+-------+ |
|           |                        |                      |         |
|           +------------------------+----------------------+         |
|                         Shared Memory IPC                           |
|                                                                     |
+---------------------------------------------------------------------+

crypto_service

Function Cryptographic operations
Protocol Request/Response via Shared Memory
Library OpenSSL 3.6 with FIPS Provider

The crypto_service performs all cryptographic operations:

est_service

Function Certificate management
Protocol EST (Enrollment over Secure Transport)
RFC RFC 7030

The est_service handles:

Shared Memory Communication

Communication between OEM Gateway and Crypto Service uses Shared Memory: 

OEM Gateway                          crypto_service
    |                                      |
    |  1. Request in Shared Memory         |
    +------------------------------------->|
    |                                      |
    |  2. Signal (IPC)                     |
    +------------------------------------->|
    |                                      |
    |  3. Processing                       |
    |                                      |
    |  4. Response in Shared Memory        |
    |<-------------------------------------+
    |                                      |
    |  5. Signal (IPC)                     |
    |<-------------------------------------+

Advantages:

Limitations:

Delivery Contents

wvds-crypto-svc-0.2.0-oem-delivery.tar.gz
|
+-- bin/
|   +-- aarch64/
|       +-- wvds_crypto_service          # READY-TO-USE DAEMON (L4Re Task)
|
+-- lib/
|   +-- aarch64/                         # ARM64 Target (L4Re)
|   |   +-- libl4re_crypto_service.so    # Crypto Service Library
|   |   +-- libcrypto.so.3               # OpenSSL 3.6
|   |   +-- libssl.so.3                  # OpenSSL 3.6
|   |   +-- fips.so                      # FIPS Provider
|   |   +-- fipsmodule.cnf               # FIPS Configuration
|   +-- x86_64/                          # x86_64 (for local testing)
|       +-- [same files]
|
+-- include/
|   +-- wvds_crypto.h                    # C Header for helper functions
|
+-- certs/                               # Test certificates
|   +-- root_ca.pem / .der
|   +-- service_cert.pem / .der
|   +-- client_cert.pem / .der
|
+-- scripts/
|   +-- extract_certs.py                 # Certificate tool
|
+-- install.sh                           # Installation script
+-- README_OEM.md                        # Quick Start
+-- WvdS_KB_OEM.md                       # Knowledge Base

Key Storage

The Crypto Service supports various key storage options:

Option Security Configuration
File Basic Keys in filesystem (encrypted)
TPM High Keys in Trusted Platform Module
HSM Maximum Keys in Hardware Security Module

Configuration is done via config.json (see Installation).

Security Boundaries

+---------------------------------------------------------------+
|                    L4Re Microkernel                           |
+---------------------------------------------------------------+
|     |              |              |              |            |
|  +--+--+       +---+---+      +---+---+      +---+---+        |
|  | Sigma0 |    | Moe   |      | Crypto |     | OEM   |        |
|  | (Root) |    | (Mem) |      | Service|     | Gateway|       |
|  +--------+    +-------+      +--------+     +--------+        |
|                                   |              |             |
|                                   +--------------+             |
|                                   Shared Memory                |
|                                   (only these two)             |
+---------------------------------------------------------------+

Isolation:

< Back to Overview