Cryptographic framework

1. A method for processing requests, comprising:

calling into a user-level encryption framework to process a first request, wherein calling into the encryption framework comprises sending the first request from a user-level application and wherein the user-level encryption framework comprises a first user-level cryptographic provider which when executed performs a first cryptographic function and a second user-level cryptographic provider which when executed performs a second cryptographic function;

processing the first request and returning a result to the user-level application, wherein processing the first request comprises:

determining whether the first request comprises a metaslot provider request, wherein the metaslot provider request is a request for a metaslot provider, wherein the metaslot provider is a virtual user-level cryptographic provider that exposes to the user-level application that it can perform the first cryptographic function and the second cryptographic function, and wherein the metaslot provider does not include functionality to perform any cryptographic functions;

if the first request comprises the metaslot provider request:

selecting the metaslot provider, wherein the metaslot provider determines which user-level cryptographic provider from available user-level cryptographic providers based on a current load and a rate of request processing of each of the available user-level cryptographic providers; and

processing, based on the selecting, the first request using the first user-level cryptographic provider; and

if the first request does not comprise the metaslot provider request:

selecting a user-level cryptographic provider specified in the first request; and

processing, based on the selecting, the first request using the specified user-level cryptographic provider;

calling into the user-level encryption framework to load an additional user-level cryptographic provider on demand, wherein the additional user-level cryptographic provider is offered as one of the available user-level providers;

receiving a second request; and

selecting the additional user-level cryptographic provider and processing the second request using the additional user-level provider.

2. The method of claim 1 , wherein processing the first request further comprises:

forwarding control to a kernel-level cryptographic framework and processing the first request using a kernel-level cryptographic provider, if the first request comprises a kernel-level cryptographic provider request.

3. The method of claim 2 , wherein the kernel-level cryptographic provider comprises at least one selected from the group consisting of a kernel-level hardware cryptographic provider and a kernel-level software cryptographic provider.

4. The method of claim 3 , wherein the kernel-level hardware cryptographic provider and the kernel-level software cryptographic provider are cryptographically signed.

5. The method of claim 1 , wherein processing the first request further comprises:

verifying whether the user-level application may access the user-level cryptographic provider using a module verification daemon.

6. The method of claim 5 , wherein the module verification daemon comprises functionality to determine whether there is a usage restriction associated with user-level cryptographic provider.

7. The method of claim 6 , wherein the module verification daemon comprises functionality to determine whether there is an activation file associated with the user-level cryptographic provider, wherein the activation file overrides the usage restrictions associated with the user-level cryptographic provider.

8. The method of claim 1 , wherein the user-level cryptographic provider comprises at least one selected from the group consisting of a user-level software cryptographic provider, the metaslot provider, a kernel-level cryptographic provider, and a user-level security token provider.

9. The method of claim 8 , wherein the user-level cryptographic provider is cryptographically signed.

10. The method of claim 8 , wherein the user-level security token cryptographic provider comprises a smart card framework.

11. The method of claim 1 , wherein the first cryptographic function comprises at least one selected from the group consisting of generating a message digest, generating a message authentication code, signature generation and verification, encryption, decryption, and dual-operation routines.

12. The method of claim 11 , wherein dual-operation routines comprise at least one selected from the group consisting of encryption and generating a message authentication code and generating the message authentication code and decryption.

13. The method of claim 11 , wherein the first cryptographic function is performed in a plurality of sub-operations.

14. A non-transitory computer readable medium comprises software instructions for processing requests, where software instructions provide functionality to:

call into a user-level encryption framework to process a first request, wherein calling into the encryption framework comprises sending the first request from a user-level application and wherein the user-level encryption framework comprises a first user-level cryptographic provider which when executed performs a first cryptographic function and a second user-level cryptographic provider which when executed performs a second cryptographic function, and wherein the metaslot provider does not include functionality to perform any cryptographic functions;

process the first request and returning a result to the user-level application, wherein processing the first request comprises:

determining whether the first request comprises a metaslot provider request, wherein the metaslot provider request is a request for a metaslot provider, wherein the metaslot provider is a virtual user-level cryptographic provider that exposes to the user-level application that it can perform the first cryptographic function and the second cryptographic function; and wherein the metaslot provider does not include functionality to perform any cryptographic functions;

if the first request comprises the metaslot provider request:

select the metaslot provider, wherein the metaslot provider determines which user-level cryptographic provider from available user-level cryptographic providers based on a current load and a rate of request processing of each of the available user-level cryptographic providers; and

processing, based on the selecting, the first request using the first user-level cryptographic provider; and

if the first request does not comprise the metaslot provider request:

selecting a user-level cryptographic provider specified in the first request; and

processing, based on the selecting, the first request using the specified user-level cryptographic provider;

call into the user-level encryption framework to load an additional user-level cryptographic provider on demand, wherein the additional user-level cryptographic provider is offered as one of the available user-level providers;

receive a second request; and

select the additional user-level cryptographic provider and processing the second request using the additional user-level provider.

15. A computer system, comprising:

a processor;

a memory;

a storage device; and

software instructions stored in the memory for enabling the computer system under control of the processor, to:

call into a user-level encryption framework to process a first request, wherein calling into the encryption framework comprises sending the first request from a user-level application and wherein the user-level encryption framework comprises a first user-level cryptographic provider which when executed performs a first cryptographic function and a second user-level cryptographic provider which when executed performs a second cryptographic function, and wherein the metaslot provider does not include functionality to perform any cryptographic functions;

process the first request and returning a result to the user-level application, wherein processing the first request comprises:

determining whether the first request comprises a metaslot provider request, wherein the metaslot provider request is a request for a metaslot provider, wherein the metaslot provider is a virtual user-level cryptographic provider that exposes to the user-level application that it can perform the first cryptographic function and the second cryptographic function; and wherein the metaslot provider does not include functionality to perform any cryptographic functions;

if the first request comprises the metaslot provider request:

selecting the metaslot provider, wherein the metaslot provider determines which user-level cryptographic provider from available user-level cryptographic providers based on a current load and a rate of request processing of each of the available user-level cryptographic providers; and

processing, based on the selecting, the first request using the first user-level cryptographic provider; and

if the first request does not comprise the metaslot provider request:

selecting a user-level cryptographic provider specified in the first request; and

processing, based on the selecting, the first request using the specified user-level cryptographic provider;

call into the user-level encryption framework to load an additional user-level cryptographic provider on demand, wherein the additional user-level cryptographic provider is offered as one of the available user-level providers;

receive a second request; and

select the additional user-level cryptographic provider and processing the second request using the additional user-level provider.