# HSM4 SSL: Leveraging HSMs for Enhanced Intra-Domain Security +
## 3 HSM4 SSL Architecture
### HSM4 SSL: Low-Level Architecture
#### 3.3.2. HSM4 SSL Management Layer  
Exposing the higher-level API to communicate with the underlying HSMs happens in the management layer, where HSM4 SSL's centralized control and monitoring mechanisms come into play. This is primarily made up of multiple service managers that can be classified as follows:  
1. Base Service Functions: The base service functions are employed to provide the primary services required to properly operate the HSM4 SSL. The base service functions include the following: * Topology Manager: Stores information about the HSMs and organizes HSMs with their physical and logical connections in a hierarchical structure. The topology manager monitors newly added and removed HSMs to construct this structure dynamically. * Statistics Manager: Collects statistical information from the underlying HSMs, such as request counts and error rates. It stores and maintains this information to comprehensively generate reports based on the collected statistics. Figure 4: RPS comparison results. Figure 5: Latency comparison results. * Flow Manager: Creates policy sets that guide the request routing process. These policy sets define the rules and criteria for determining the appropriate destination for each incoming request. By configuring these policies, the flow manager guides the HAL, enabling it to determine the specific HSM to which a request should be sent. These policies can consider various factors, such as security requirements, load balancing, the availability of HSM resources, and other relevant considerations. * Host Manager: Manages and stores connected endpoint hosts' information. It maintains a repository that stores crucial details about each host, including their MAC addresses and IP addresses. * HSM Manager: Manages and stores the underlying HSMs' information. It maintains a centralized repository of HSM-related data, including their statuses and configurations. This information includes details about the available HSMs, their connectivity, operational status, and any relevant configuration settings. * Security Manager: Analyzes the HSMs' states and incoming data to identify anomalies. Maservic managerlearning-based anomaly detection systems can be employed in the security manager to continuously scan incoming requests and detect threats. * Event Manager: Collaborates closely with the security manager. Its primary role is to monitor critical events within the HSMs. By continuously monitoring various aspects of the system, such as performance and security indicators, in any critical event, such as a security breach or system failure, the event manager generates reports and alerts. Moreover, in case of an HSM failure error generated by the security manager, the event manager communicates with the flow manager with a specific error code requiring it to update the policy set. This allows the HAL to route incoming requests to available HSMs until the error is handled. * Database Manager: Manages and backs up data storage and generates statistics about saved data, such as certificates and audit logs. * Operation Service Functions: On the other hand, operation service functions contain managers oriented to perform specific cryptographic and HSM-related tasks, such as the following:
* Authorization Manager: Performs host authentication and authorization and determines which hosts can access HSM resources. It is responsible for validating the identity and credentials of connecting hosts and determining their level of access to HSM resources. By enforcing access control policies and rules, the authorization manager ensures that only authorized hosts can utilize the HSM resources and perform cryptographic operations. * Cryptography Manager: Performs cryptographic operations, such as encryption and decryption, and secure storage initialization within the HSMs to store cryptographic objects. * Keys Manager: Handles key generation and retrieves cryptographic keys for hosts for encryption and decryption processes.