diff --git a/ndn-cpp/security/identity-manager.cpp b/ndn-cpp/security/identity/identity-manager.cpp
similarity index 100%
rename from ndn-cpp/security/identity-manager.cpp
rename to ndn-cpp/security/identity/identity-manager.cpp
diff --git a/ndn-cpp/security/identity-manager.hpp b/ndn-cpp/security/identity/identity-manager.hpp
similarity index 96%
rename from ndn-cpp/security/identity-manager.hpp
rename to ndn-cpp/security/identity/identity-manager.hpp
index 9ed42ef..2557a03 100644
--- a/ndn-cpp/security/identity-manager.hpp
+++ b/ndn-cpp/security/identity/identity-manager.hpp
@@ -6,7 +6,7 @@
 #ifndef NDN_IDENTITY_MANAGER_HPP
 #define	NDN_IDENTITY_MANAGER_HPP
 
-#include "../data.hpp"
+#include "../../data.hpp"
 
 namespace ndn {
 
diff --git a/ndn-cpp/security/identity/private-key-storage.cpp b/ndn-cpp/security/identity/private-key-storage.cpp
new file mode 100644
index 0000000..4f2d0aa
--- /dev/null
+++ b/ndn-cpp/security/identity/private-key-storage.cpp
@@ -0,0 +1,23 @@
+/**
+ * @author: Jeff Thompson
+ * See COPYING for copyright and distribution information.
+ */
+
+#include "private-key-storage.hpp"
+
+using namespace std;
+
+namespace ndn {
+
+PrivateKeyStorage::~PrivateKeyStorage()
+{
+}
+
+// TODO: Move to subclass.
+Blob 
+PrivateKeyStorage::sign(const Blob& blob, const string& keyName, DigestAlgorithm digestAlgorithm)
+{
+  return Blob();
+}
+
+}
diff --git a/ndn-cpp/security/identity/private-key-storage.hpp b/ndn-cpp/security/identity/private-key-storage.hpp
new file mode 100644
index 0000000..bb79753
--- /dev/null
+++ b/ndn-cpp/security/identity/private-key-storage.hpp
@@ -0,0 +1,95 @@
+/**
+ * @author: Yingdi Yu <yingdi@cs.ucla.edu>
+ * @author: Jeff Thompson
+ * See COPYING for copyright and distribution information.
+ */
+
+#ifndef NDN_PRIVATE_KEY_STORAGE_HPP
+#define	NDN_PRIVATE_KEY_STORAGE_HPP
+
+#include <string>
+#include "../../util/blob.hpp"
+#include "../security-common.hpp"
+
+namespace ndn {
+
+class PrivateKeyStorage {
+  /**
+   * The virtual destructor
+   */    
+  virtual 
+  ~PrivateKeyStorage();
+
+#if 0
+  /**
+   * @brief generate a pair of asymmetric keys
+   * @param keyName the name of the key pair
+   * @param keyType the type of the key pair, e.g. RSA
+   * @param keySize the size of the key pair
+   */
+  virtual void 
+  generateKeyPair(const string & keyName, KeyType keyType = KEY_TYPE_RSA, int keySize = 2048) = 0;
+
+  /**
+   * @brief get the public key
+   * @param keyName the name of public key
+   * @return the public key
+   */
+  virtual Ptr<Publickey> 
+  getPublickey(const string & keyName) = 0;
+#endif
+  
+  /**
+   * Sign data blob.
+   * @param blob The blob to be signed.
+   * @param keyName The name of the signing key.
+   * @param digestAlgorithm the digest algorithm.
+   * @return The signature, or 0 if signing fails.
+   */  
+  virtual Blob 
+  sign(const Blob& blob, const std::string& keyName, DigestAlgorithm digestAlgorithm = DIGEST_ALGORITHM_SHA256);
+    
+#if 0
+  /**
+   * @brief decrypt data
+   * @param keyName the name of the decrypting key
+   * @param blob the blob to be decrypted
+   * @param sym if true symmetric encryption is used, otherwise asymmetric decryption is used.
+   * @return decrypted data
+   */
+  virtual Ptr<Blob> 
+  decrypt(const string & keyName, const Blob & data, bool sym = false) = 0;
+
+  /**
+   * @brief encrypt data
+   * @param keyName the name of the encrypting key
+   * @param blob the blob to be encrypted
+   * @param sym if true symmetric encryption is used, otherwise asymmetric decryption is used.
+   * @return encrypted data
+   */
+  virtual Ptr<Blob> 
+  encrypt(const string & keyName, const Blob & pData, bool sym = false) = 0;
+
+  /**
+   * @brief generate a symmetric key
+   * @param keyName the name of the key 
+   * @param keyType the type of the key, e.g. AES
+   * @param keySize the size of the key
+   */
+  virtual void 
+  generateKey(const string & keyName, KeyType keyType = KEY_TYPE_AES, int keySize = 256) = 0;
+
+  /**
+   * @brief check if a particular key exist
+   * @param keyName the name of the key
+   * @param keyClass the class of the key, e.g. public, private, or symmetric
+   * @return true if the key exists, otherwise false
+   */
+  virtual bool
+  doesKeyExist(const string & keyName, KeyClass keyClass) = 0;  
+#endif
+};
+
+}
+
+#endif
diff --git a/ndn-cpp/security/security-common.hpp b/ndn-cpp/security/security-common.hpp
new file mode 100644
index 0000000..2f2e660
--- /dev/null
+++ b/ndn-cpp/security/security-common.hpp
@@ -0,0 +1,46 @@
+/**
+ * @author: Yingdi Yu <yingdi@cs.ucla.edu>
+ * @author: Jeff Thompson
+ * See COPYING for copyright and distribution information.
+ */
+
+#ifndef NDN_SECURITY_COMMON_HPP
+#define	NDN_SECURITY_COMMON_HPP
+
+namespace ndn {
+
+enum KeyType {
+  KEY_TYPE_RSA,
+  // KEY_TYPE_DSA,
+  KEY_TYPE_AES,
+  // KEY_TYPE_DES,
+  // KEY_TYPE_RC4,
+  // KEY_TYPE_RC2
+};
+
+enum KeyClass {
+  KEY_CLASS_PUBLIC,
+  KEY_CLASS_PRIVATE,
+  KEY_CLASS_SYMMETRIC
+};
+  
+enum KeyFormat {
+  KEY_FORMAT_PUBLIC_OPENSSL,
+};
+
+enum DigestAlgorithm {
+  // DIGEST_ALGORITHM_MD2,
+  // DIGEST_ALGORITHM_MD5,
+  // DIGEST_ALGORITHM_SHA1,
+  DIGEST_ALGORITHM_SHA256
+};
+
+enum EncryptMode {
+  ENCRYPTION_MODE_DEFAULT,
+  ENCRYPTION_MODE_CFB_AES,
+  // ENCRYPTION_MODE_CBC_AES
+};
+
+}
+
+#endif