Overview of Active Process Manager
Active Process Manager (APM), developed by Aventra Oy/Ltd based in Finland, is an innovative solution for automating security-related processes. With APM, you can control devices like HSMs, smart cards and smart card printers, and build an automated workflow which integrates your process into data sources and external systems, such as databases and web services. Examples of APM usage scenarios include smart card issuance and key management tasks such as creating cryptographic keys and securely transferring them between systems and devices. APM’s configuration and workflows are saved in solution files. Users can create solutions for different purposes, and one solution can have several functions. The solution workflow is created using APM’s visual solution editor.
Principle of Operation and Key Concepts
With APM, you can create solutions for various use cases. A solution consists of one or more steps, which represent functions that the end user can start from APM’s front-end. Logic that is shared by several front-end functions can be combined into a single step. A solution step is built by inserting plug-ins into the step, using APM’s solution editor. A plug-in is a software module designed to perform a specific task, or to maintain a connection to a device or an integrated system. Plug-ins can pass parameters to other plug-ins. When user starts a step by pressing a button on the front-end, APM runs the plug-ins of the step from top to bottom. This standard flow can be altered using solution logic plug-ins, which can execute a group of plug-ins conditionally, branch, or call other steps. APM’s included set of plug-ins includes plug-ins for specific purposes, for example the PKCS#11 update plug-in can perform many operations defined in the PKCS#11 standard. By building an APM solution, you can use data source plug-ins to gather the data from various sources/integrations, link the data to the PKCS#11 update plug-in for processing, and combine this workflow with other security-related automated tasks, where – for example – cryptography, smart cards, smart card printers, access control tags and USB tokens are involved. The results of the plug-ins can be directed to various data sources as well.
Overview of Utimaco u.trust GP HSM
The Utimaco u.trust GP HSM is a hardware security module developed by Utimaco IS GmbH. It is a physically protected, specialized computer unit designed to perform sensitive cryptographic tasks and securely manage and store cryptographic keys and data. The u.trust GP HSM can be used as a universal, independent security component for heterogeneous computer systems.
Joint Value Proposition
APM can connect to the Utimaco u.trust GP HSM using the PKCS#11 or CNG interface. While Utimaco’s tools included with the u.trust GP HSM provide powerful features to manage and configure the device, APM enables configuring key management tasks and cryptographic operations easily, with a graphical user interface. Tasks such as key generation, wrapping, unwrapping, and derivation have traditionally required heavy command-line scripting or writing customized software. APM’s configurable plug-ins make such tasks easier to configure, and APM has powerful features to integrate the tasks in automated workflows which interact with data sources and external systems. APM can also perform cryptographic operations such as signature creation and encryption with the HSM, and it can be used for automating the operations in many scenarios where such operations are needed. For example, APM can process many cryptographic operations in a batch run, fetching the data from an integrated system. In the REST API mode, an external system can trigger APM to process cryptographic operations. APM has features for encoding access cards and tags for physical access controls, and these features can be combined with highly secure HSM-based key management to ensure security of the access control keys in the whole infrastructure.