System Architecture [WvdS Doku]

System Architecture

Two-Daemon Architecture

The WvdS Crypto Service consists of two independent daemons on L4Re:

                           L4Re System
+---------------------------------------------------------------------+
|                                                                     |
|  +------------------+     +------------------+     +--------------+ |
|  |  crypto_service  |     |   est_service    |     | OEM Gateway  | |
|  |                  |     |                  |     |              | |
|  |  * AES-256-GCM   |     |  * EST Protocol  |     | * Your Code  | |
|  |  * ML-DSA Sign   |     |  * Cert Request  |     | * Sensor Data| |
|  |  * ML-KEM KeyGen |     |  * Cert Renewal  |     | * Business   | |
|  +--------+---------+     +--------+---------+     +------+-------+ |
|           |                        |                      |         |
|           +------------------------+----------------------+         |
|                         Shared Memory IPC                           |
|                                                                     |
+---------------------------------------------------------------------+

crypto_service

Function	Cryptographic operations
Protocol	Request/Response via Shared Memory
Library	OpenSSL 3.6 with FIPS Provider

The crypto_service performs all cryptographic operations:

AES-256-GCM Encrypt/Decrypt
ML-DSA Sign/Verify
ML-KEM KeyGen/Encaps/Decaps

est_service

Function	Certificate management
Protocol	EST (Enrollment over Secure Transport)
RFC	RFC 7030

The est_service handles:

Initial certificate request (Enrollment)
Certificate renewal (Re-Enrollment)
CA certificate retrieval

Shared Memory Communication

Communication between OEM Gateway and Crypto Service uses Shared Memory:

OEM Gateway                          crypto_service
    |                                      |
    |  1. Request in Shared Memory         |
    +------------------------------------->|
    |                                      |
    |  2. Signal (IPC)                     |
    +------------------------------------->|
    |                                      |
    |  3. Processing                       |
    |                                      |
    |  4. Response in Shared Memory        |
    |<-------------------------------------+
    |                                      |
    |  5. Signal (IPC)                     |
    |<-------------------------------------+

Advantages:

No kernel overhead for data transfer
Zero-copy for large payloads
Maximum performance

Limitations:

Max Payload: 64 KB
Synchronous processing (one request at a time)

Delivery Contents

wvds-crypto-svc-0.2.0-oem-delivery.tar.gz
|
+-- bin/
|   +-- aarch64/
|       +-- wvds_crypto_service          # READY-TO-USE DAEMON (L4Re Task)
|
+-- lib/
|   +-- aarch64/                         # ARM64 Target (L4Re)
|   |   +-- libl4re_crypto_service.so    # Crypto Service Library
|   |   +-- libcrypto.so.3               # OpenSSL 3.6
|   |   +-- libssl.so.3                  # OpenSSL 3.6
|   |   +-- fips.so                      # FIPS Provider
|   |   +-- fipsmodule.cnf               # FIPS Configuration
|   +-- x86_64/                          # x86_64 (for local testing)
|       +-- [same files]
|
+-- include/
|   +-- wvds_crypto.h                    # C Header for helper functions
|
+-- certs/                               # Test certificates
|   +-- root_ca.pem / .der
|   +-- service_cert.pem / .der
|   +-- client_cert.pem / .der
|
+-- scripts/
|   +-- extract_certs.py                 # Certificate tool
|
+-- install.sh                           # Installation script
+-- README_OEM.md                        # Quick Start
+-- WvdS_KB_OEM.md                       # Knowledge Base

Key Storage

The Crypto Service supports various key storage options:

Option	Security	Configuration
File	Basic	Keys in filesystem (encrypted)
TPM	High	Keys in Trusted Platform Module
HSM	Maximum	Keys in Hardware Security Module

Configuration is done via config.json (see Installation).

Security Boundaries

+---------------------------------------------------------------+
|                    L4Re Microkernel                           |
+---------------------------------------------------------------+
|     |              |              |              |            |
|  +--+--+       +---+---+      +---+---+      +---+---+        |
|  | Sigma0 |    | Moe   |      | Crypto |     | OEM   |        |
|  | (Root) |    | (Mem) |      | Service|     | Gateway|       |
|  +--------+    +-------+      +--------+     +--------+        |
|                                   |              |             |
|                                   +--------------+             |
|                                   Shared Memory                |
|                                   (only these two)             |
+---------------------------------------------------------------+

Isolation:

Each task has its own address space
Crypto Service can only be reached via defined IPC
Kernel enforces capability-based access control

< Back to Overview