Method and apparatus for supporting cryptographic-related activities in a public key infrastructure

1. A method comprising:

executing, by a device, an instruction of an application program,

the instruction requiring cryptographic-related processing;

generating, by the device and using the application program, a first message,

the first message corresponding to a message of a plurality of messages,

each of the plurality of messages invoking a different cryptographic-related processing,

the plurality of messages being stored in the device,

the message, of the plurality of messages, relating to the cryptographic-related processing required by the instruction,

the first message being transmitted to an authentication call component or an authentication socket component in a kernel space of the device;

generating, by the device and using the authentication call component or the authentication socket component, a second message that is transmitted to an authentication request component in the kernel space,

the second message being based on the first message;

transmitting, by the device and using the authentication request component, the second message to a cryptographic processing component of a plurality of cryptographic processing components in the kernel space,

each of the plurality of cryptographic processing components being associated with a different type of cryptographic-related processing,

the second message being transmitted to the cryptographic processing component based on the cryptographic processing component being associated with a type of the cryptographic-related processing; and

performing, by the device and using the cryptographic processing component, the cryptographic-related processing required by the instruction based on the second message.

2. The method of claim 1 , where performing the cryptographic-related processing includes at least one of:

verifying or generating a digital signature;

encrypting data;

decrypting data;

retrieving a digital certificate or certificate revocation list;

verifying a hierarchy of a certificate;

performing self-signed certificate processing;

retrieving, verifying, and storing a digital certificate in the device; or

performing certificate age checking.

3. The method of claim 1 , further comprising:

transmitting the first message to the authentication socket component in the kernel space,

where transmitting the first message includes:

generating a user datagram protocol (UDP) message containing an identifier associated with the cryptographic-related processing, and

transmitting the UDP message via a UDP socket to the authentication socket component.

4. The method of claim 1 , further comprising:

transmitting a result of performing the cryptographic-related processing to the authentication request component.

5. The method of claim 4 , further comprising:

transmitting the result of performing the cryptographic-related processing from the authentication request component to the application program,

the application program being in a user space of the device.

6. The method of claim 1 , where the instruction is associated with an input that represents a digitally signed network control message requiring verification.

7. A device, comprising:

a memory to store:

a plurality of instructions, and

a plurality of public key authentication infrastructure (PKAI) function call messages,

each of the plurality of PKAI function call messages invoking a different PKAI function; and

a processor to execute the plurality of instructions in the memory to:

receive an input requiring performance of a cryptographic-related function,

the input being received based on execution of an application program;

generate, within the device and based on the input, a particular PKAI function call message based on the plurality of PKAI function call messages stored in the memory,

the particular PKAI function call message relating to the cryptographic-related function,

the particular PKAI function call message being forwarded to an authentication call component in a kernel space of the device;

generate, using the authentication call component, another message based on the particular PKAI function call message,

the other message relating to the cryptographic-related function;

forward the other message to an authentication request component in the kernel space of the device,

the authentication request component identifying a cryptographic processing component, of a plurality of cryptographic processing components in the kernel space, for performing the cryptographic-related function,

each of the plurality of cryptographic processing components being associated with a different type of cryptographic-related function, and

the authentication request component forwarding the other message to the cryptographic processing component based on the cryptographic processing component being associated with a type of the cryptographic-related function; and

cause the cryptographic-related function to be performed by the cryptographic processing component based on the other message.

8. The device of claim 7 , where, when causing the cryptographic-related function to be performed, the processor is to cause at least one of:

a digital signature to be verified or generated;

data to be encrypted;

data to be decrypted;

a digital certificate or certificate revocation list to be retrieved;

a hierarchy of a certificate to be verified;

self-signed certificate processing to be performed;

a digital certificate to be retrieved, verified, and stored; or

certificate age checking to be performed.

9. The device of claim 7 , where the processor further executes the plurality of instructions in the memory to:

transmit a result of the cryptographic processing component performing the cryptographic-related function to the authentication request component.

10. The device of claim 7 , where the processor further executes the plurality of instructions in the memory to:

return a result of performing the cryptographic-related function to the application program.

11. The device of claim 7 , where, when performing the cryptographic-related function, the cryptographic processing component is to:

access a remote server, via a network, to retrieve cryptographic-related information.

12. A network node comprising:

a user space component, implemented at least partially in hardware, to:

execute an instruction requiring performance of a cryptographic-related function, and

generate a first message corresponding to a particular message of a plurality of messages stored in the network node,

each of the plurality of messages invoking a different cryptographic-related function,

the first message relating to the performance of the cryptographic-related function;

a first kernel space component, implemented at least partially in hardware, to:

receive the first message, relating to the cryptographic-related function, from the user space component, and

generate a second message, corresponding to the first message, as part of a function call; and

a second kernel space component, implemented at least partially in hardware, to:

receive the second message generated as part of the function call, and

forward, based on the function call, the second message to a cryptographic processing component of a plurality of cryptographic processing components within a kernel space of the network node,

each of the plurality of cryptographic processing components being associated with a different type of cryptographic-related function,

the second message being forwarded to the cryptographic processing component based on a type of the cryptographic-related function,

the cryptographic processing component performing the cryptographic-related function based on the second message.

13. The network node of claim 12 , further comprising:

another user space component to initialize or shut down a cryptographic-related service associated with the cryptographic-related function.

14. The network node of claim 13 , further comprising:

a third kernel space component to:

receive a request, from the other user space component, to perform another cryptographic-related function requested by the user space component, and

generate a function call corresponding to performing the other cryptographic-related function.

15. The network node of claim 12 , further comprising:

another user space component to access a remote server, via a network, to retrieve cryptographic-related information,

the cryptographic-related information being associated with the cryptographic-related function.

16. The network node of claim 12 , where, when performing the cryptographic-related processing, the cryptographic processing component is to at least one of:

verify or generate a digital signature;

encrypt data;

decrypt data;

retrieve a digital certificate or certificate revocation list;

verify a certificate's hierarchy;

perform self-signed certificate processing;

retrieve, verify, and store a digital certificate in the network node; or

perform certificate age checking.

17. The network node of claim 12 , where the function call is a user datagram protocol (UDP) message containing an identifier associated with the cryptographic-related function.

18. The network node of claim 12 , where the second kernel space component is further to:

receive a result, from the cryptographic processing component, of the cryptographic processing component performing the cryptographic-related function, and

forward the result to the user space component.