Skip to main content
This document shows how to configure the Futurex CryptoHub with Versasec vSEC:CMS by using Futurex PKCS #11 libraries. For additional questions about your CryptoHub device, see the relevant user guide.

​
Application description

From the Versasec documentation website: vSEC:CMS is an innovative, easily integrated, and cost-effective Credential Management System (CMS) designed to assist you in deploying and managing credentials within your organization. vSEC:CMS is fully functional with Minidriver-enabled credentials, such as smart cards, USB tokens, and virtual smart cards, including Windows Hello for Business (WHfB). It streamlines all aspects of credential management by seamlessly connecting to enterprise directories, certificate authorities, physical access control systems, email servers, log servers, biometric fingerprint readers, PIN mailers, and more. With vSEC:CMS, you can issue credentials to employees, personalize them with authentication details, and manage the entire credential life cycle, directly from this off-the-shelf product.

​
Architecture

The vSEC:CMS client-server architecture uses both an RPC framework and SOAP with the following protocols:
  • gRPC with HTTP/2 or HTTP/2 over TLS
  • SOAP with HTTP or HTTPS
For simplicity, this guide refers to it as HTTP(S).

​
Main components

The following items comprise the main components of vSEC:CMS: -vSEC:CMS Service: This Windows service manages the vSEC:CMS database and operator account management for authorized users. It operates as a Windows service, defaulting to run under the SYSTEM account.
  • vSEC:CMS SOAP/gRPC Service: Another Windows service, this component facilitates communication with the vSEC:CMS Service. It serves as the SOAP/gRPC service for the vSEC:CMS Agent, vSEC:CMS Admin, and the vSEC:CMS User Application.
  • vSEC:CMS Agent or vSEC:CMS Admin: Each operator uses either of these components, operating within the user’s context.
  • vSEC:CMS User Application: This component, executed on an end-user workstation, enables self-service credential operations with both conventional smart cards and virtual smart cards.

​
HSM support in vSEC:CMS

You can use an HSM to store the master keys used when performing administration key operations with the vSEC:CMS, such as registering a smart card token or PIN unblock operations. The vSEC:CMS interfaces with the HSM through the PKCS #11 protocol. You should use the HSM key management tools available from the HSM vendor for all management functions around the master key stored on the HSM.