CSG

Applications

Applications calling CSG do so using either a CSG client library or the RESTful interface. Client libraries can be configured either to directly load balance across all CSG servers or to integrate with an external load balancer. The CSG will authenticate applications based on credentials local to the CSG server cluster or through integration with an LDAP/AD service.

APIs - Crypto Query Language

Crypto Query Language (CQL) is the primary interface to CSG and enables developers to rapidly integrate applications. Compared to APIs such as PKCS #11, CQL has no learning curve and delegates all security decisions (including key selection) to the CSG policy file. CQL can be used from Java, .NET and C/C++ or through CSG’s RESTful API. An example of an encryption command is shown below:

DO ENCRYPT FROM App TO Database WITH DATA 57FD01A…

Each developer will be given a welcome pack that describes which CSG servers to connect to and which commands they have access to. Templates for welcome packs are supplied with CSG.

CSG Servers

The CSG server is a Java application which will centrally control and manage applications, HSMs and cryptographic policy. A cluster of CSG servers would be deployed to ensure full availability and resilience capabilities.

Service Management

Administration of the CSG system is performed remotely via an admin client. All administrators authenticate to the system using Smartcard and PIN. The security critical operations, such as a change in CSG policy, must be done under dual control. Additionally, the admin client presents a monitoring pane which displays information on the health, load and transaction latency across the CSG servers and HSMs (this information is also exposed via a SOAP web service).

HSMs

The CSG servers utilize a pool of HSMs, which they will monitor and load-balance operations across, as appropriate. CSG supports all major HSM brands and integrates with both General Purpose and specialized Payments HSMs.