ProtectProcessing
Cryptographic API/ Toolkit
ProtectProcessing is a customization Software Development Kit (SDK) delivering an
unsurpassed level of flexibility, extensibility and security to your cryptographic applications.
SafeNet (SFNT:Nasdaq) is a global leader in information security. Founded more
than 20 years ago, the company provides complete security utilizing its encryption
technologies to protect communications, digital identities and intellectual property,
and offers a full spectrum of products including hardware, software, and chips.
SALES OFFICES
ARM, Bank of America, Cisco Systems, the Departments of Defense, and Homeland
Security, Microsoft, Samsung, Texas Instruments, the U.S. Internal Revenue Service,
and scores of other customers entrust their security needs to SafeNet. For more
information, visit www.safenet-inc.com.
Corporate: 4690 Millennium Drive, Belcamp, Maryland 21017 USA
Tel: +1 410 931 7500 or 800 533 3958 Email: info@safenet-inc.com
Australia +61 3 9882 8322
Brazil +55 11 3392 4600
Canada +1 613 723 5077
China +86 10 8266 3936
Finland +358 20 500 7800
France +33 1 47 55 74 70
Germany +49 18 03 72 46 26 9
Hong Kong +852 3157 7111
India +91 11 2691 7538
Japan (Tokyo) +81 3 5719 2731
Korea +82 31 705 8212
Mexico +52 55 5575 1441
Netherlands +31 73 658 1900
Singapore +65 6297 6196
Taiwan +886 2 2735 3736
U.K. +44 1276 608 000
U.S. (Massachusetts) +1 978 539 4800
U.S. (New Jersey) +1 201 333 3400
U.S. (Virginia) +1 703 279 4500
U.S. (Irvine, California) +1 949 450 7300
U.S. (Santa Clara, California) +1 408 855 6000
U.S. (Torrance, California) +1 310 533 8100
Australia +61 2 9906 2988
Brazil +55 21 2215 5765
Czech Republic +420 2 2423 6833
Germany +49 2151 3630 20
India +91 80 5110 0600
Italy +39 02 7729 7599
Netherlands +31 20 311 6540
Singapore +65 6559 3449
Switzerland +41 61 462 2010
U.S. (Roseville, California) +1 916 677 2450
Distributors and resellers located worldwide
2165EN-AU1205. ©2005 SafeNet, Inc. All rights reserved. SafeNet and SafeNet logo are registered trademarks of SafeNet.
All other product names are trademarks of their respective owners.
BENEFITS AT A GLANCE
 Develop custom cryptographic and security
functionality to run on HSMs
 Modify or develop custom extensions to
off-the-shelf ProtectToolkit APIs and HSM
operations
 Execute critical custom application code within
the secure tamper-resistant environment of a
SafeNet PCI adapter or network-connected HSM
ProtectProcessing facilitates accelerated development and
performance, plus provides enhanced system security,
independence and confidentiality to security-sensitive
application developments.
 Develop and debug custom application code in a
convenient PC-based software emulation
environment, without the need for a HSM being
connected to the developer’s computer
ProtectProcessing provides the ability to create customized cryptographic applications
from scratch (including completely new algorithms), or develop custom extensions to
off-the-shelf PKCS#11 functionality by patching the standard routines that are executed within
the secure confines of a HSM.
 Enhance security to comply with certain security
policies or meet specific regulatory, industry or
regional requirements
 Increase performance by bundling multiple
individual cryptographic calls into one complex,
atomic custom API command. This results in
dramatically reduced function call overhead and
a boost in performance
ProtectProcessing includes a software emulation capability, plus a modified GNU compiler
and linker to generate the executable binary code for the HSMs native processor architecture.
This includes all the necessary tools for code signing and certificate management associated
with the import of trusted custom code extensions into the HSM.
Motivations to develop customized HSM code are diverse and may include:
 Need for specific functionality, like a regional cryptographic algorithm or key derivation method
 Add customized security functionality such as secure protocol conversion and re-encryption
within the secure confines of a HSM
 Change to an existing function, which may not deliver exactly what is required, or must be
removed
 Increase performance by bundling multiple individual cryptographic calls into one complex,
atomic custom API command resulting in a dramatically reduced function call overhead and
a boost in performance
PRODUCT DATA SHEET
WORLDWIDE OFFICES
www.safenet-inc.com
ABOUT SAFENET
ProtectProcessing
Cryptographic API/ Toolkit
ACCELERATED INDEPENDENT DEVELOPMENT
HSM PLATFORM OPTIONS
The Software Development Kit (SDK) and emulation functionality streamlines costs and resources enabling developers (either a SafeNet
partner or an end user) to create and debug custom-specific Functionality Modules (FMs) in a standard PC environment. This can be performed
outside of the HSM without any involvement from SafeNet.
The protection of keys and other valuable data within a physically secure tamper-resistant
HSM is paramount to achieve strong cryptographic security. The storage of keys within a
software-only solution greatly diminishes the security against malicious attack due to a
hacker’s ability to infiltrate and compromise keys from the file system or working memory.
All cryptographic functions are temporarily performed within software libraries on the development server avoiding the need to have a HSM
connected to each developer’s machine. Upon completion of development and testing, the implemented custom code can then be easily and
securely downloaded, stored and run within the secure environment of the HSM.
The SDK provides the software libraries, header files and reference documentation required to compile and link a Windows emulation build of
the FM. A modified GNU compiler and linker enable the generation of executable binary code within the FM for the HSMs native processor
architecture. Sample programs with source code and build instructions, providing re-usable code skeletons and demonstrations of typical
customization scenarios, assist and accelerate application development.
In addition, the necessary tools are provided for code signing and certificate management associated with the import of trusted custom code
extensions into the HSM.
ACCELERATED PROCESSING PERFORMANCE
Combining numerous individual cryptographic operations into a single comprehensive custom call dramatically reduces the processing load
between the HSM and the host system. Such consolidation of cryptographic functions into a single operation facilitates accelerated
performance of the overall system.
ENHANCED SYSTEM SECURITY
ProtectProcessing enables custom cryptographic processes to be securely performed within the protected environment of a SafeNet HSM rather
than on the host system. Complex security-critical processing components of an application, utilizing digitally signed code, can be operated as
a whole on the HSM, ensuring no risk of sensitive information ever being exposed in an unprotected environment. The net-effect of this approach
nes of the
HSM.
INDEPENDENCE AND CONFIDENTIALITY
ProtectProcessing enables independent in-house development by end users and solution providers. In addition, by avoiding the need to
engage third-party developers, full confidentiality of custom security systems and processes can be achieved. The development party is in full
control of the certificate management and code signing, and can also implement at their discretion, a trust model involving third-parties such
as a Trust Center.
TRAINING
SafeNet provides full training on ProtectProcessing to facilitate the specific in-house development needs of your security project. No prior
embedded system experience is required, only knowledge of the industry standard ANSI-based ‘C’ language and its ‘C’ run-time library.
ProtectProcessing operates seamlessly with the HSMs listed below.
PROTECTHOST ORANGE
ProtectHost Orange is a FIPS 140 - 2 level 3 certified
network-attached HSM that connects to a single machine or a
complete network as a central cryptographic subsystem to
perform symmetric and asymmetric cryptography.
PROTECTSERVER ORANGE EXTERNAL
ProtectServer Orange External is a FIPS 140 - 1 level 3
certified network-attached HSM that connects via TCP/IP to a single
machine or complete network (LAN) as a central cryptographic
subsystem to perform symmetric and asymmetric cryptography.
PROTECTSERVER GOLD
ProtectServer Gold is a FIPS 140 - 2 level 3 certified PCI
adapter-based HSM that can be installed in server systems as a
cryptographic subsystem to perform symmetric and asymmetric
cryptography.
PROTECTSERVER ORANGE
ProtectServer Orange is a FIPS 140 - 1 level 3 certified PCI
adapter-based HSM that can be installed in server systems as a
cryptographic subsystem to perform symmetric and asymmetric
cryptography.
PROTECTSERVER BLUE
ProtectServer Blue is an ITSEC certified PCI adapter-based
HSM that can be installed in server systems as a cryptographic
subsystem to perform symmetric and asymmetric cryptography.
TECHNICAL SPECIFICATIONS
SUPPORTED DEVELOPMENT PLATFORMS
FM Development
 Windows NT 4.0, 2000, XP, Server 2003
Host Side Development
(Host Development Kit - HDK)
 Windows NT 4.0, 2000, XP, Server 2003
 Linux Kernel 2.4.18 and later, 2.6.x
 Sun Solaris (Sparc) 7, 8, 9
DEVELOPMENT TOOLS REQUIRED
FM Software Emulation
 Microsoft Visual C++ 6 or later
Please Note - GNU compiler and linker (for HSMs
ARM CPU code generation) is included in the SDK
HOST DEVELOPMENT
 Native compiler toolkit for the supported platform
 gnumake v3.78.1 - This package can be obtained
from www.gnu.org/software/make/make.html
PROTECTPROCESSING APIs









Host Message Dispatch (MD) API
HSM Interface Service (SVC) API
FM Dispatch API
PKCS#11 API (full)
PKCS#11 State Management API
Application ID API
Serial communications API
High Resolution Timer API
ANSI C RTL API (Subset)
API LANGUAGE
 FM code - ‘C’
 Host side code - ‘C’, Java
ProtectProcessing
Cryptographic API/ Toolkit
ACCELERATED INDEPENDENT DEVELOPMENT
HSM PLATFORM OPTIONS
The Software Development Kit (SDK) and emulation functionality streamlines costs and resources enabling developers (either a SafeNet
partner or an end user) to create and debug custom-specific Functionality Modules (FMs) in a standard PC environment. This can be performed
outside of the HSM without any involvement from SafeNet.
The protection of keys and other valuable data within a physically secure tamper-resistant
HSM is paramount to achieve strong cryptographic security. The storage of keys within a
software-only solution greatly diminishes the security against malicious attack due to a
hacker’s ability to infiltrate and compromise keys from the file system or working memory.
All cryptographic functions are temporarily performed within software libraries on the development server avoiding the need to have a HSM
connected to each developer’s machine. Upon completion of development and testing, the implemented custom code can then be easily and
securely downloaded, stored and run within the secure environment of the HSM.
The SDK provides the software libraries, header files and reference documentation required to compile and link a Windows emulation build of
the FM. A modified GNU compiler and linker enable the generation of executable binary code within the FM for the HSMs native processor
architecture. Sample programs with source code and build instructions, providing re-usable code skeletons and demonstrations of typical
customization scenarios, assist and accelerate application development.
In addition, the necessary tools are provided for code signing and certificate management associated with the import of trusted custom code
extensions into the HSM.
ACCELERATED PROCESSING PERFORMANCE
Combining numerous individual cryptographic operations into a single comprehensive custom call dramatically reduces the processing load
between the HSM and the host system. Such consolidation of cryptographic functions into a single operation facilitates accelerated
performance of the overall system.
ENHANCED SYSTEM SECURITY
ProtectProcessing enables custom cryptographic processes to be securely performed within the protected environment of a SafeNet HSM rather
than on the host system. Complex security-critical processing components of an application, utilizing digitally signed code, can be operated as
a whole on the HSM, ensuring no risk of sensitive information ever being exposed in an unprotected environment. The net-effect of this approach
nes of the
HSM.
INDEPENDENCE AND CONFIDENTIALITY
ProtectProcessing enables independent in-house development by end users and solution providers. In addition, by avoiding the need to
engage third-party developers, full confidentiality of custom security systems and processes can be achieved. The development party is in full
control of the certificate management and code signing, and can also implement at their discretion, a trust model involving third-parties such
as a Trust Center.
TRAINING
SafeNet provides full training on ProtectProcessing to facilitate the specific in-house development needs of your security project. No prior
embedded system experience is required, only knowledge of the industry standard ANSI-based ‘C’ language and its ‘C’ run-time library.
ProtectProcessing operates seamlessly with the HSMs listed below.
PROTECTHOST ORANGE
ProtectHost Orange is a FIPS 140 - 2 level 3 certified
network-attached HSM that connects to a single machine or a
complete network as a central cryptographic subsystem to
perform symmetric and asymmetric cryptography.
PROTECTSERVER ORANGE EXTERNAL
ProtectServer Orange External is a FIPS 140 - 1 level 3
certified network-attached HSM that connects via TCP/IP to a single
machine or complete network (LAN) as a central cryptographic
subsystem to perform symmetric and asymmetric cryptography.
PROTECTSERVER GOLD
ProtectServer Gold is a FIPS 140 - 2 level 3 certified PCI
adapter-based HSM that can be installed in server systems as a
cryptographic subsystem to perform symmetric and asymmetric
cryptography.
PROTECTSERVER ORANGE
ProtectServer Orange is a FIPS 140 - 1 level 3 certified PCI
adapter-based HSM that can be installed in server systems as a
cryptographic subsystem to perform symmetric and asymmetric
cryptography.
PROTECTSERVER BLUE
ProtectServer Blue is an ITSEC certified PCI adapter-based
HSM that can be installed in server systems as a cryptographic
subsystem to perform symmetric and asymmetric cryptography.
TECHNICAL SPECIFICATIONS
SUPPORTED DEVELOPMENT PLATFORMS
FM Development
 Windows NT 4.0, 2000, XP, Server 2003
Host Side Development
(Host Development Kit - HDK)
 Windows NT 4.0, 2000, XP, Server 2003
 Linux Kernel 2.4.18 and later, 2.6.x
 Sun Solaris (Sparc) 7, 8, 9
DEVELOPMENT TOOLS REQUIRED
FM Software Emulation
 Microsoft Visual C++ 6 or later
Please Note - GNU compiler and linker (for HSMs
ARM CPU code generation) is included in the SDK
HOST DEVELOPMENT
 Native compiler toolkit for the supported platform
 gnumake v3.78.1 - This package can be obtained
from www.gnu.org/software/make/make.html
PROTECTPROCESSING APIs









Host Message Dispatch (MD) API
HSM Interface Service (SVC) API
FM Dispatch API
PKCS#11 API (full)
PKCS#11 State Management API
Application ID API
Serial communications API
High Resolution Timer API
ANSI C RTL API (Subset)
API LANGUAGE
 FM code - ‘C’
 Host side code - ‘C’, Java
ProtectProcessing
Cryptographic API/ Toolkit
ProtectProcessing is a customization Software Development Kit (SDK) delivering an
unsurpassed level of flexibility, extensibility and security to your cryptographic applications.
SafeNet (SFNT:Nasdaq) is a global leader in information security. Founded more
than 20 years ago, the company provides complete security utilizing its encryption
technologies to protect communications, digital identities and intellectual property,
and offers a full spectrum of products including hardware, software, and chips.
SALES OFFICES
ARM, Bank of America, Cisco Systems, the Departments of Defense, and Homeland
Security, Microsoft, Samsung, Texas Instruments, the U.S. Internal Revenue Service,
and scores of other customers entrust their security needs to SafeNet. For more
information, visit www.safenet-inc.com.
Corporate: 4690 Millennium Drive, Belcamp, Maryland 21017 USA
Tel: +1 410 931 7500 or 800 533 3958 Email: info@safenet-inc.com
Australia +61 3 9882 8322
Brazil +55 11 3392 4600
Canada +1 613 723 5077
China +86 10 8266 3936
Finland +358 20 500 7800
France +33 1 47 55 74 70
Germany +49 18 03 72 46 26 9
Hong Kong +852 3157 7111
India +91 11 2691 7538
Japan (Tokyo) +81 45 640 5733
Korea +82 31 705 8212
Mexico +52 55 5575 1441
Netherlands +31 73 658 1900
Singapore +65 6297 6196
Taiwan +886 2 2735 3736
U.K. +44 1276 608 000
U.S. (Massachusetts) +1 978 539 4800
U.S. (New Jersey) +1 201 333 3400
U.S. (Virginia) +1 703 279 4500
U.S. (Irvine, California) +1 949 450 7300
U.S. (Santa Clara, California) +1 408 855 6000
U.S. (Torrance, California) +1 310 533 8100
Australia +61 2 9906 2988
Brazil +55 21 2215 5765
Czech Republic +420 2 2423 6833
Germany +49 2151 3630 20
India +91 80 5110 0600
Italy +39 02 7729 7599
Netherlands +31 20 311 6540
Singapore +65 6559 3449
Switzerland +41 61 462 2010
U.S. (Roseville, California) +1 916 677 2450
Distributors and resellers located worldwide
2165EN-AU1205. ©2005 SafeNet, Inc. All rights reserved. SafeNet and SafeNet logo are registered trademarks of SafeNet.
All other product names are trademarks of their respective owners.
BENEFITS AT A GLANCE
 Develop custom cryptographic and security
functionality to run on HSMs
 Modify or develop custom extensions to
off-the-shelf ProtectToolkit APIs and HSM
operations
 Execute critical custom application code within
the secure tamper-resistant environment of a
SafeNet PCI adapter or network-connected HSM
ProtectProcessing facilitates accelerated development and
performance, plus provides enhanced system security,
independence and confidentiality to security-sensitive
application developments.
 Develop and debug custom application code in a
convenient PC-based software emulation
environment, without the need for a HSM being
connected to the developer’s computer
ProtectProcessing provides the ability to create customized cryptographic applications
from scratch (including completely new algorithms), or develop custom extensions to
off-the-shelf PKCS#11 functionality by patching the standard routines that are executed within
the secure confines of a HSM.
 Enhance security to comply with certain security
policies or meet specific regulatory, industry or
regional requirements
 Increase performance by bundling multiple
individual cryptographic calls into one complex,
atomic custom API command. This results in
dramatically reduced function call overhead and
a boost in performance
ProtectProcessing includes a software emulation capability, plus a modified GNU compiler
and linker to generate the executable binary code for the HSMs native processor architecture.
This includes all the necessary tools for code signing and certificate management associated
with the import of trusted custom code extensions into the HSM.
Motivations to develop customized HSM code are diverse and may include:
 Need for specific functionality, like a regional cryptographic algorithm or key derivation method
 Add customized security functionality such as secure protocol conversion and re-encryption
within the secure confines of a HSM
 Change to an existing function, which may not deliver exactly what is required, or must be
removed
 Increase performance by bundling multiple individual cryptographic calls into one complex,
atomic custom API command resulting in a dramatically reduced function call overhead and
a boost in performance
PRODUCT DATA SHEET
WORLDWIDE OFFICES
www.safenet-inc.com
ABOUT SAFENET