diff --git a/tests/unit-tests/security/pib/certificate-container.t.cpp b/tests/unit-tests/security/pib/certificate-container.t.cpp
index 5edbfb2..4eeaa4a 100644
--- a/tests/unit-tests/security/pib/certificate-container.t.cpp
+++ b/tests/unit-tests/security/pib/certificate-container.t.cpp
@@ -35,25 +35,100 @@
 
 BOOST_AUTO_TEST_SUITE(Security)
 BOOST_AUTO_TEST_SUITE(Pib)
-BOOST_AUTO_TEST_SUITE(TestCertificateContainer)
+BOOST_FIXTURE_TEST_SUITE(TestCertificateContainer, PibDataFixture)
 
 using pib::Pib;
 
-BOOST_FIXTURE_TEST_CASE(TestCertificateContainer, PibDataFixture)
+BOOST_AUTO_TEST_CASE(Basic)
 {
   auto pibImpl = make_shared<PibMemory>();
-  Pib pib("pib-memory", "", pibImpl);
 
-  Identity identity1 = pib.addIdentity(id1);
-  Key key11 = identity1.addKey(id1Key1.buf(), id1Key1.size(), id1Key1Name);
-  key11.addCertificate(id1Key1Cert1);
-  key11.addCertificate(id1Key1Cert2);
+  // start with an empty container
+  CertificateContainer container(id1Key1Name, pibImpl);
+  BOOST_CHECK_EQUAL(container.size(), 0);
+  BOOST_CHECK_EQUAL(container.getCache().size(), 0);
 
-  CertificateContainer container = key11.getCertificates();
+  // add one cert
+  container.add(id1Key1Cert1);
+  BOOST_CHECK_EQUAL(container.size(), 1);
+  BOOST_CHECK_EQUAL(container.getCache().size(), 1);
+  BOOST_CHECK(container.find(id1Key1Cert1.getName()) != container.end());
+
+  // add the same cert again
+  container.add(id1Key1Cert1);
+  BOOST_CHECK_EQUAL(container.size(), 1);
+  BOOST_CHECK_EQUAL(container.getCache().size(), 1);
+  BOOST_CHECK(container.find(id1Key1Cert1.getName()) != container.end());
+
+  // add another cert
+  container.add(id1Key1Cert2);
   BOOST_CHECK_EQUAL(container.size(), 2);
+  BOOST_CHECK_EQUAL(container.getCache().size(), 2);
   BOOST_CHECK(container.find(id1Key1Cert1.getName()) != container.end());
   BOOST_CHECK(container.find(id1Key1Cert2.getName()) != container.end());
 
+  // get certs
+  BOOST_REQUIRE_NO_THROW(container.get(id1Key1Cert1.getName()));
+  BOOST_REQUIRE_NO_THROW(container.get(id1Key1Cert2.getName()));
+  Name id1Key1Cert3Name = id1Key1Name;
+  id1Key1Cert3Name.append("issuer").appendVersion(3);
+  BOOST_CHECK_THROW(container.get(id1Key1Cert3Name), Pib::Error);
+
+  // check cert
+  v2::Certificate cert1 = container.get(id1Key1Cert1.getName());
+  v2::Certificate cert2 = container.get(id1Key1Cert2.getName());
+  BOOST_CHECK_EQUAL(cert1, id1Key1Cert1);
+  BOOST_CHECK_EQUAL(cert2, id1Key1Cert2);
+
+  // create another container from the same PibImpl
+  // cache should be empty
+  CertificateContainer container2(id1Key1Name, pibImpl);
+  BOOST_CHECK_EQUAL(container2.size(), 2);
+  BOOST_CHECK_EQUAL(container2.getCache().size(), 0);
+
+  // get certificate, cache should be filled
+  BOOST_REQUIRE_NO_THROW(container2.get(id1Key1Cert1.getName()));
+  BOOST_CHECK_EQUAL(container2.size(), 2);
+  BOOST_CHECK_EQUAL(container2.getCache().size(), 1);
+
+  BOOST_REQUIRE_NO_THROW(container2.get(id1Key1Cert2.getName()));
+  BOOST_CHECK_EQUAL(container2.size(), 2);
+  BOOST_CHECK_EQUAL(container2.getCache().size(), 2);
+
+  // remove a certificate
+  container2.remove(id1Key1Cert1.getName());
+  BOOST_CHECK_EQUAL(container2.size(), 1);
+  BOOST_CHECK_EQUAL(container2.getCache().size(), 1);
+  BOOST_CHECK(container2.find(id1Key1Cert1.getName()) == container2.end());
+  BOOST_CHECK(container2.find(id1Key1Cert2.getName()) != container2.end());
+
+  // remove another certificate
+  container2.remove(id1Key1Cert2.getName());
+  BOOST_CHECK_EQUAL(container2.size(), 0);
+  BOOST_CHECK_EQUAL(container2.getCache().size(), 0);
+  BOOST_CHECK(container2.find(id1Key1Cert2.getName()) == container2.end());
+}
+
+BOOST_AUTO_TEST_CASE(Errors)
+{
+  auto pibImpl = make_shared<PibMemory>();
+
+  CertificateContainer container(id1Key1Name, pibImpl);
+
+  BOOST_CHECK_THROW(container.add(id1Key2Cert1), std::invalid_argument);
+  BOOST_CHECK_THROW(container.remove(id1Key2Cert1.getName()), std::invalid_argument);
+  BOOST_CHECK_THROW(container.get(id1Key2Cert1.getName()), std::invalid_argument);
+}
+
+BOOST_AUTO_TEST_CASE(Iterator)
+{
+  auto pibImpl = make_shared<PibMemory>();
+
+  // start with an empty container
+  CertificateContainer container(id1Key1Name, pibImpl);
+  container.add(id1Key1Cert1);
+  container.add(id1Key1Cert2);
+
   std::set<Name> certNames;
   certNames.insert(id1Key1Cert1.getName());
   certNames.insert(id1Key1Cert2.getName());
@@ -76,6 +151,10 @@
     count++;
   }
   BOOST_CHECK_EQUAL(count, 2);
+
+  BOOST_CHECK(CertificateContainer::const_iterator() == CertificateContainer::const_iterator());
+  BOOST_CHECK(CertificateContainer::const_iterator() == container.end());
+  BOOST_CHECK(container.end() == CertificateContainer::const_iterator());
 }
 
 BOOST_AUTO_TEST_SUITE_END() // TestCertificateContainer
diff --git a/tests/unit-tests/security/pib/detail/identity-impl.t.cpp b/tests/unit-tests/security/pib/detail/identity-impl.t.cpp
new file mode 100644
index 0000000..10c7bb8
--- /dev/null
+++ b/tests/unit-tests/security/pib/detail/identity-impl.t.cpp
@@ -0,0 +1,149 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2013-2017 Regents of the University of California.
+ *
+ * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
+ *
+ * ndn-cxx library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
+ */
+
+#include "security/pib/detail/identity-impl.hpp"
+#include "security/pib/pib.hpp"
+#include "security/pib/pib-memory.hpp"
+#include "../pib-data-fixture.hpp"
+
+#include "boost-test.hpp"
+
+namespace ndn {
+namespace security {
+namespace pib {
+namespace detail {
+namespace tests {
+
+BOOST_AUTO_TEST_SUITE(Security)
+BOOST_AUTO_TEST_SUITE(Pib)
+BOOST_AUTO_TEST_SUITE(Detail)
+BOOST_FIXTURE_TEST_SUITE(TestIdentityImpl, ndn::security::tests::PibDataFixture)
+
+using security::Pib;
+
+BOOST_AUTO_TEST_CASE(Basic)
+{
+  auto pibImpl = make_shared<pib::PibMemory>();
+  IdentityImpl identity1(id1, pibImpl, true);
+
+  BOOST_CHECK_EQUAL(identity1.getName(), id1);
+}
+
+BOOST_AUTO_TEST_CASE(KeyOperation)
+{
+  auto pibImpl = make_shared<pib::PibMemory>();
+  IdentityImpl identity1(id1, pibImpl, true);
+  BOOST_CHECK_NO_THROW(IdentityImpl(id1, pibImpl, false));
+
+  // identity does not have any key
+  BOOST_CHECK_EQUAL(identity1.getKeys().size(), 0);
+
+  // get non-existing key, throw Pib::Error
+  BOOST_CHECK_THROW(identity1.getKey(id1Key1Name), Pib::Error);
+  // get default key, throw Pib::Error
+  BOOST_CHECK_THROW(identity1.getDefaultKey(), Pib::Error);
+  // set non-existing key as default key, throw Pib::Error
+  BOOST_REQUIRE_THROW(identity1.setDefaultKey(id1Key1Name), Pib::Error);
+
+  // add key
+  identity1.addKey(id1Key1.buf(), id1Key1.size(), id1Key1Name);
+  BOOST_CHECK_NO_THROW(identity1.getKey(id1Key1Name));
+
+  // new key becomes default key when there is no default key
+  BOOST_REQUIRE_NO_THROW(identity1.getDefaultKey());
+  const Key& defaultKey0 = identity1.getDefaultKey();
+  BOOST_CHECK_EQUAL(defaultKey0.getName(), id1Key1Name);
+  BOOST_CHECK(defaultKey0.getPublicKey() == id1Key1);
+
+  // remove key
+  identity1.removeKey(id1Key1Name);
+  BOOST_CHECK_THROW(identity1.getKey(id1Key1Name), Pib::Error);
+  BOOST_CHECK_THROW(identity1.getDefaultKey(), Pib::Error);
+
+  // set default key directly
+  BOOST_REQUIRE_NO_THROW(identity1.setDefaultKey(id1Key1.buf(), id1Key1.size(), id1Key1Name));
+  BOOST_REQUIRE_NO_THROW(identity1.getDefaultKey());
+  BOOST_CHECK_NO_THROW(identity1.getKey(id1Key1Name));
+
+  // check default key
+  const Key& defaultKey1 = identity1.getDefaultKey();
+  BOOST_CHECK_EQUAL(defaultKey1.getName(), id1Key1Name);
+  BOOST_CHECK(defaultKey1.getPublicKey() == id1Key1);
+
+  // add another key
+  identity1.addKey(id1Key2.buf(), id1Key2.size(), id1Key2Name);
+  BOOST_CHECK_EQUAL(identity1.getKeys().size(), 2);
+
+  // set default key through name
+  BOOST_REQUIRE_NO_THROW(identity1.setDefaultKey(id1Key2Name));
+  BOOST_REQUIRE_NO_THROW(identity1.getDefaultKey());
+  const Key& defaultKey2 = identity1.getDefaultKey();
+  BOOST_CHECK_EQUAL(defaultKey2.getName(), id1Key2Name);
+  BOOST_CHECK(defaultKey2.getPublicKey() == id1Key2);
+
+  // remove key
+  identity1.removeKey(id1Key1Name);
+  BOOST_CHECK_THROW(identity1.getKey(id1Key1Name), Pib::Error);
+  BOOST_CHECK_EQUAL(identity1.getKeys().size(), 1);
+
+  // set default key directly again, change the default setting
+  BOOST_REQUIRE_NO_THROW(identity1.setDefaultKey(id1Key1.buf(), id1Key1.size(), id1Key1Name));
+  const Key& defaultKey3 = identity1.getDefaultKey();
+  BOOST_CHECK_EQUAL(defaultKey3.getName(), id1Key1Name);
+  BOOST_CHECK(defaultKey3.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL(identity1.getKeys().size(), 2);
+
+  // remove all keys
+  identity1.removeKey(id1Key1Name);
+  BOOST_CHECK_THROW(identity1.getKey(id1Key1Name), Pib::Error);
+  BOOST_CHECK_EQUAL(identity1.getKeys().size(), 1);
+  identity1.removeKey(id1Key2Name);
+  BOOST_CHECK_THROW(identity1.getKey(id1Key2Name), Pib::Error);
+  BOOST_CHECK_EQUAL(identity1.getKeys().size(), 0);
+  BOOST_CHECK_THROW(identity1.getDefaultKey(), Pib::Error);
+}
+
+BOOST_AUTO_TEST_CASE(Errors)
+{
+  auto pibImpl = make_shared<pib::PibMemory>();
+
+  BOOST_CHECK_THROW(IdentityImpl(id1, pibImpl, false), Pib::Error);
+  IdentityImpl identity1(id1, pibImpl, true);
+
+  identity1.addKey(id1Key1.buf(), id1Key1.size(), id1Key1Name);
+  BOOST_CHECK_THROW(identity1.addKey(id1Key1.buf(), id1Key1.size(), id1Key1Name), Pib::Error);
+  BOOST_CHECK_THROW(identity1.addKey(id2Key1.buf(), id2Key1.size(), id2Key1Name), std::invalid_argument);
+  BOOST_CHECK_THROW(identity1.removeKey(id2Key1Name), std::invalid_argument);
+  BOOST_CHECK_THROW(identity1.getKey(id2Key1Name), std::invalid_argument);
+  BOOST_CHECK_THROW(identity1.setDefaultKey(id2Key1.buf(), id2Key1.size(), id2Key1Name), std::invalid_argument);
+  BOOST_CHECK_THROW(identity1.setDefaultKey(id2Key1Name), std::invalid_argument);
+}
+
+BOOST_AUTO_TEST_SUITE_END() // TestIdentityImpl
+BOOST_AUTO_TEST_SUITE_END() // Detail
+BOOST_AUTO_TEST_SUITE_END() // Pib
+BOOST_AUTO_TEST_SUITE_END() // Security
+
+} // namespace tests
+} // namespace detail
+} // namespace pib
+} // namespace security
+} // namespace ndn
diff --git a/tests/unit-tests/security/pib/detail/key-impl.t.cpp b/tests/unit-tests/security/pib/detail/key-impl.t.cpp
new file mode 100644
index 0000000..b25a870
--- /dev/null
+++ b/tests/unit-tests/security/pib/detail/key-impl.t.cpp
@@ -0,0 +1,164 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2013-2017 Regents of the University of California.
+ *
+ * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
+ *
+ * ndn-cxx library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
+ */
+
+#include "security/pib/detail/key-impl.hpp"
+#include "security/pib/pib.hpp"
+#include "security/pib/pib-memory.hpp"
+#include "../pib-data-fixture.hpp"
+
+#include "boost-test.hpp"
+
+namespace ndn {
+namespace security {
+namespace pib {
+namespace detail {
+namespace tests {
+
+BOOST_AUTO_TEST_SUITE(Security)
+BOOST_AUTO_TEST_SUITE(Pib)
+BOOST_AUTO_TEST_SUITE(Detail)
+BOOST_FIXTURE_TEST_SUITE(TestKeyImpl, ndn::security::tests::PibDataFixture)
+
+using security::Pib;
+
+BOOST_AUTO_TEST_CASE(Basic)
+{
+  auto pibImpl = make_shared<pib::PibMemory>();
+  KeyImpl key11(id1Key1Name, id1Key1.buf(), id1Key1.size(), pibImpl);
+
+  BOOST_CHECK_EQUAL(key11.getName(), id1Key1Name);
+  BOOST_CHECK_EQUAL(key11.getIdentity(), id1);
+  BOOST_CHECK_EQUAL(key11.getKeyType(), KeyType::EC);
+  BOOST_CHECK(key11.getPublicKey() == id1Key1);
+
+  KeyImpl key11Bak(id1Key1Name, pibImpl);
+  BOOST_CHECK_EQUAL(key11Bak.getName(), id1Key1Name);
+  BOOST_CHECK_EQUAL(key11Bak.getIdentity(), id1);
+  BOOST_CHECK_EQUAL(key11Bak.getKeyType(), KeyType::EC);
+  BOOST_CHECK(key11Bak.getPublicKey() == id1Key1);
+}
+
+BOOST_AUTO_TEST_CASE(CertificateOperation)
+{
+  auto pibImpl = make_shared<pib::PibMemory>();
+  KeyImpl key11(id1Key1Name, id1Key1.buf(), id1Key1.size(), pibImpl);
+  BOOST_CHECK_NO_THROW(KeyImpl(id1Key1Name, pibImpl));
+
+  // key does not have any certificate
+  BOOST_CHECK_EQUAL(key11.getCertificates().size(), 0);
+
+  // get non-existing certificate, throw Pib::Error
+  BOOST_CHECK_THROW(key11.getCertificate(id1Key1Cert1.getName()), Pib::Error);
+  // get default certificate, throw Pib::Error
+  BOOST_CHECK_THROW(key11.getDefaultCertificate(), Pib::Error);
+  // set non-existing certificate as default certificate, throw Pib::Error
+  BOOST_REQUIRE_THROW(key11.setDefaultCertificate(id1Key1Cert1.getName()), Pib::Error);
+
+  // add certificate
+  key11.addCertificate(id1Key1Cert1);
+  BOOST_CHECK_NO_THROW(key11.getCertificate(id1Key1Cert1.getName()));
+
+  // new certificate becomes default certificate when there was no default certificate
+  BOOST_REQUIRE_NO_THROW(key11.getDefaultCertificate());
+  const auto& defaultCert0 = key11.getDefaultCertificate();
+  BOOST_CHECK_EQUAL(defaultCert0.getName(), id1Key1Cert1.getName());
+  BOOST_CHECK_EQUAL(defaultCert0, id1Key1Cert1);
+
+  // remove certificate
+  key11.removeCertificate(id1Key1Cert1.getName());
+  BOOST_CHECK_THROW(key11.getCertificate(id1Key1Cert1.getName()), Pib::Error);
+  BOOST_CHECK_THROW(key11.getDefaultCertificate(), Pib::Error);
+
+  // set default certificate directly
+  BOOST_REQUIRE_NO_THROW(key11.setDefaultCertificate(id1Key1Cert1));
+  BOOST_REQUIRE_NO_THROW(key11.getDefaultCertificate());
+  BOOST_CHECK_NO_THROW(key11.getCertificate(id1Key1Cert1.getName()));
+
+  // check default cert
+  const auto& defaultCert1 = key11.getDefaultCertificate();
+  BOOST_CHECK_EQUAL(defaultCert1.getName(), id1Key1Cert1.getName());
+  BOOST_CHECK_EQUAL(defaultCert1, id1Key1Cert1);
+
+  // add another certificate
+  key11.addCertificate(id1Key1Cert2);
+  BOOST_CHECK_EQUAL(key11.getCertificates().size(), 2);
+
+  // set default certificate through name
+  BOOST_REQUIRE_NO_THROW(key11.setDefaultCertificate(id1Key1Cert2.getName()));
+  BOOST_REQUIRE_NO_THROW(key11.getDefaultCertificate());
+  const auto& defaultCert2 = key11.getDefaultCertificate();
+  BOOST_CHECK_EQUAL(defaultCert2.getName(), id1Key1Cert2.getName());
+  BOOST_CHECK_EQUAL(defaultCert2, id1Key1Cert2);
+
+  // remove certificate
+  key11.removeCertificate(id1Key1Cert1.getName());
+  BOOST_CHECK_THROW(key11.getCertificate(id1Key1Cert1.getName()), Pib::Error);
+  BOOST_CHECK_EQUAL(key11.getCertificates().size(), 1);
+
+  // set default certificate directly again, change the default setting
+  BOOST_REQUIRE_NO_THROW(key11.setDefaultCertificate(id1Key1Cert1));
+  const auto& defaultCert3 = key11.getDefaultCertificate();
+  BOOST_CHECK_EQUAL(defaultCert3.getName(), id1Key1Cert1.getName());
+  BOOST_CHECK_EQUAL(defaultCert3, id1Key1Cert1);
+  BOOST_CHECK_EQUAL(key11.getCertificates().size(), 2);
+
+  // remove all certificates
+  key11.removeCertificate(id1Key1Cert1.getName());
+  BOOST_CHECK_THROW(key11.getCertificate(id1Key1Cert1.getName()), Pib::Error);
+  BOOST_CHECK_EQUAL(key11.getCertificates().size(), 1);
+  key11.removeCertificate(id1Key1Cert2.getName());
+  BOOST_CHECK_THROW(key11.getCertificate(id1Key1Cert2.getName()), Pib::Error);
+  BOOST_CHECK_THROW(key11.getDefaultCertificate(), Pib::Error);
+  BOOST_CHECK_EQUAL(key11.getCertificates().size(), 0);
+}
+
+BOOST_AUTO_TEST_CASE(Errors)
+{
+  auto pibImpl = make_shared<pib::PibMemory>();
+
+  BOOST_CHECK_THROW(KeyImpl(id1Key1Name, pibImpl), Pib::Error);
+  KeyImpl key11(id1Key1Name, id1Key1.buf(), id1Key1.size(), pibImpl);
+  BOOST_CHECK_THROW(KeyImpl(id1Key1Name, id1Key1.buf(), id1Key1.size(), pibImpl), Pib::Error);
+
+  BOOST_CHECK_THROW(KeyImpl(Name("/wrong"), pibImpl), std::invalid_argument);
+  BOOST_CHECK_THROW(KeyImpl(Name("/wrong"), id1Key1.buf(), id1Key1.size(), pibImpl), std::invalid_argument);
+  Buffer wrongKey;
+  BOOST_CHECK_THROW(KeyImpl(id1Key2Name, wrongKey.buf(), wrongKey.size(), pibImpl), std::invalid_argument);
+
+  key11.addCertificate(id1Key1Cert1);
+  BOOST_CHECK_THROW(key11.addCertificate(id1Key1Cert1), Pib::Error);
+  BOOST_CHECK_THROW(key11.addCertificate(id1Key2Cert1), std::invalid_argument);
+  BOOST_CHECK_THROW(key11.removeCertificate(id1Key2Cert1.getName()), std::invalid_argument);
+  BOOST_CHECK_THROW(key11.getCertificate(id1Key2Cert1.getName()), std::invalid_argument);
+  BOOST_CHECK_THROW(key11.setDefaultCertificate(id1Key2Cert1), std::invalid_argument);
+  BOOST_CHECK_THROW(key11.setDefaultCertificate(id1Key2Cert1.getName()), std::invalid_argument);
+}
+
+BOOST_AUTO_TEST_SUITE_END() // TestKeyImpl
+BOOST_AUTO_TEST_SUITE_END() // Detail
+BOOST_AUTO_TEST_SUITE_END() // Pib
+BOOST_AUTO_TEST_SUITE_END() // Security
+
+} // namespace tests
+} // namespace detail
+} // namespace pib
+} // namespace security
+} // namespace ndn
diff --git a/tests/unit-tests/security/pib/identity-container.t.cpp b/tests/unit-tests/security/pib/identity-container.t.cpp
index b9af408..92420db 100644
--- a/tests/unit-tests/security/pib/identity-container.t.cpp
+++ b/tests/unit-tests/security/pib/identity-container.t.cpp
@@ -35,23 +35,89 @@
 
 BOOST_AUTO_TEST_SUITE(Security)
 BOOST_AUTO_TEST_SUITE(Pib)
-BOOST_AUTO_TEST_SUITE(TestIdentityContainer)
+BOOST_FIXTURE_TEST_SUITE(TestIdentityContainer, PibDataFixture)
 
 using pib::Pib;
 
-BOOST_FIXTURE_TEST_CASE(Basic, PibDataFixture)
+BOOST_AUTO_TEST_CASE(Basic)
 {
   auto pibImpl = make_shared<PibMemory>();
-  Pib pib("pib-memory", "", pibImpl);
 
-  Identity identity1 = pib.addIdentity(id1);
-  Identity identity2 = pib.addIdentity(id2);
+  // start with an empty container
+  IdentityContainer container(pibImpl);
+  BOOST_CHECK_EQUAL(container.size(), 0);
+  BOOST_CHECK_EQUAL(container.getLoadedIdentities().size(), 0);
 
-  IdentityContainer container = pib.getIdentities();
+  // add the first identity
+  Identity identity11 = container.add(id1);
+  BOOST_CHECK_EQUAL(identity11.getName(), id1);
+  BOOST_CHECK_EQUAL(container.size(), 1);
+  BOOST_CHECK_EQUAL(container.getLoadedIdentities().size(), 1);
+  BOOST_CHECK(container.find(id1) != container.end());
+
+  // add the same identity again
+  Identity identity12 = container.add(id1);
+  BOOST_CHECK_EQUAL(identity12.getName(), id1);
+  BOOST_CHECK_EQUAL(container.size(), 1);
+  BOOST_CHECK_EQUAL(container.getLoadedIdentities().size(), 1);
+  BOOST_CHECK(container.find(id1) != container.end());
+
+  // add the second identity
+  Identity identity21 = container.add(id2);
+  BOOST_CHECK_EQUAL(identity21.getName(), id2);
   BOOST_CHECK_EQUAL(container.size(), 2);
+  BOOST_CHECK_EQUAL(container.getLoadedIdentities().size(), 2);
   BOOST_CHECK(container.find(id1) != container.end());
   BOOST_CHECK(container.find(id2) != container.end());
 
+  // get identities
+  BOOST_REQUIRE_NO_THROW(container.get(id1));
+  BOOST_REQUIRE_NO_THROW(container.get(id2));
+  BOOST_CHECK_THROW(container.get(Name("/non-existing")), Pib::Error);
+
+  // check identity
+  Identity identity1 = container.get(id1);
+  Identity identity2 = container.get(id2);
+  BOOST_CHECK_EQUAL(identity1.getName(), id1);
+  BOOST_CHECK_EQUAL(identity2.getName(), id2);
+
+  // create another container from the same PibImpl
+  // cache should be empty
+  IdentityContainer container2(pibImpl);
+  BOOST_CHECK_EQUAL(container2.size(), 2);
+  BOOST_CHECK_EQUAL(container2.getLoadedIdentities().size(), 0);
+
+  // get key, cache should be filled
+  BOOST_REQUIRE_NO_THROW(container2.get(id1));
+  BOOST_CHECK_EQUAL(container2.size(), 2);
+  BOOST_CHECK_EQUAL(container2.getLoadedIdentities().size(), 1);
+
+  BOOST_REQUIRE_NO_THROW(container2.get(id2));
+  BOOST_CHECK_EQUAL(container2.size(), 2);
+  BOOST_CHECK_EQUAL(container2.getLoadedIdentities().size(), 2);
+
+  // remove a key
+  container2.remove(id1);
+  BOOST_CHECK_EQUAL(container2.size(), 1);
+  BOOST_CHECK_EQUAL(container2.getLoadedIdentities().size(), 1);
+  BOOST_CHECK(container2.find(id1) == container2.end());
+  BOOST_CHECK(container2.find(id2) != container2.end());
+
+  // remove another key
+  container2.remove(id2);
+  BOOST_CHECK_EQUAL(container2.size(), 0);
+  BOOST_CHECK_EQUAL(container2.getLoadedIdentities().size(), 0);
+  BOOST_CHECK(container2.find(id2) == container2.end());
+
+}
+
+BOOST_AUTO_TEST_CASE(Iterator)
+{
+  auto pibImpl = make_shared<PibMemory>();
+  IdentityContainer container(pibImpl);
+  container.add(id1);
+  container.add(id2);
+
   std::set<Name> idNames;
   idNames.insert(id1);
   idNames.insert(id2);
@@ -74,6 +140,10 @@
     count++;
   }
   BOOST_CHECK_EQUAL(count, 2);
+
+  BOOST_CHECK(IdentityContainer::const_iterator() == IdentityContainer::const_iterator());
+  BOOST_CHECK(IdentityContainer::const_iterator() == container.end());
+  BOOST_CHECK(container.end() == IdentityContainer::const_iterator());
 }
 
 BOOST_AUTO_TEST_SUITE_END() // TestIdentityContainer
diff --git a/tests/unit-tests/security/pib/identity.t.cpp b/tests/unit-tests/security/pib/identity.t.cpp
index 3704d92..49bd8da 100644
--- a/tests/unit-tests/security/pib/identity.t.cpp
+++ b/tests/unit-tests/security/pib/identity.t.cpp
@@ -22,6 +22,7 @@
 #include "security/pib/identity.hpp"
 #include "security/pib/pib.hpp"
 #include "security/pib/pib-memory.hpp"
+#include "security/pib/detail/identity-impl.hpp"
 
 #include "boost-test.hpp"
 #include "pib-data-fixture.hpp"
@@ -41,7 +42,8 @@
 
 BOOST_AUTO_TEST_CASE(ValidityChecking)
 {
-  // identity
+  using security::pib::detail::IdentityImpl;
+
   Identity id;
 
   BOOST_CHECK_EQUAL(static_cast<bool>(id), false);
@@ -52,7 +54,8 @@
   else
     BOOST_CHECK(true);
 
-  id = Identity(id1, make_shared<PibMemory>(), true);
+  auto identityImpl = make_shared<IdentityImpl>(id1, make_shared<PibMemory>(), true);
+  id = Identity(identityImpl);
 
   BOOST_CHECK_EQUAL(static_cast<bool>(id), true);
   BOOST_CHECK_EQUAL(!id, false);
@@ -63,41 +66,26 @@
     BOOST_CHECK(false);
 }
 
-BOOST_AUTO_TEST_CASE(KeyOperations)
+/**
+ * pib::Identity is a wrapper of pib::detail::IdentityImpl.  Since the functionalities of
+ * IdentityImpl have already been tested in detail/identity-impl.t.cpp, we only test the shared
+ * property of pib::Identity in this test case.
+ */
+BOOST_AUTO_TEST_CASE(Share)
 {
-  Identity identity1(id1, make_shared<PibMemory>(), true);
+  using security::pib::detail::IdentityImpl;
 
-  // Key does not exist, throw Error
+  auto identityImpl = make_shared<IdentityImpl>(id1, make_shared<pib::PibMemory>(), true);
+  Identity identity1(identityImpl);
+  Identity identity2(identityImpl);
+
+  identity1.addKey(id1Key1.buf(), id1Key1.size(), id1Key1Name);
+  BOOST_CHECK_NO_THROW(identity2.getKey(id1Key1Name));
+  identity2.removeKey(id1Key1Name);
   BOOST_CHECK_THROW(identity1.getKey(id1Key1Name), Pib::Error);
-  // Key name does not match identity name, throw Error
-  BOOST_CHECK_THROW(identity1.getKey(id2Key1Name), Pib::Error);
 
-  // Add key
-  Key key11 = identity1.addKey(id1Key1.buf(), id1Key1.size(), id1Key1Name);
-  BOOST_CHECK_NO_THROW(identity1.getKey(id1Key1Name));
-  // Key name does not match identity name, throw Error
-  BOOST_CHECK_THROW(identity1.addKey(id2Key1.buf(), id2Key1.size(), id2Key1Name), Pib::Error);
-
-  // Remove key
-  identity1.removeKey(id1Key1Name);
-  BOOST_CHECK_THROW(identity1.getKey(id1Key1Name), Pib::Error);
-  // Key name does not match identity name, throw Error
-  BOOST_CHECK_THROW(identity1.removeKey(id2Key1Name), Pib::Error);
-
-  // Default key does not exist, throw Error
-  BOOST_CHECK_THROW(identity1.getDefaultKey(), Pib::Error);
-
-  // Set default key but the key does not exist, throw Error
-  BOOST_CHECK_THROW(identity1.setDefaultKey(id1Key1Name), Pib::Error);
-  // Set default key
-  BOOST_REQUIRE_NO_THROW(identity1.setDefaultKey(id1Key1.buf(), id1Key1.size(), id1Key1Name));
-  BOOST_CHECK_NO_THROW(identity1.getDefaultKey());
-  BOOST_CHECK_EQUAL(identity1.getDefaultKey().getName(), id1Key1Name);
-
-  // Remove the default key
-  identity1.removeKey(id1Key1Name);
-  BOOST_CHECK_THROW(identity1.getKey(id1Key1Name), Pib::Error);
-  BOOST_CHECK_THROW(identity1.getDefaultKey(), Pib::Error);
+  identity1.setDefaultKey(id1Key1.buf(), id1Key1.size(), id1Key1Name);
+  BOOST_CHECK_NO_THROW(identity2.getDefaultKey());
 }
 
 BOOST_AUTO_TEST_SUITE_END() // TestIdentity
diff --git a/tests/unit-tests/security/pib/key-container.t.cpp b/tests/unit-tests/security/pib/key-container.t.cpp
index 812fab4..5b7961e 100644
--- a/tests/unit-tests/security/pib/key-container.t.cpp
+++ b/tests/unit-tests/security/pib/key-container.t.cpp
@@ -35,25 +35,106 @@
 
 BOOST_AUTO_TEST_SUITE(Security)
 BOOST_AUTO_TEST_SUITE(Pib)
-BOOST_AUTO_TEST_SUITE(TestKeyContainer)
+BOOST_FIXTURE_TEST_SUITE(TestKeyContainer, PibDataFixture)
 
 using pib::Pib;
 
-BOOST_FIXTURE_TEST_CASE(Basic, PibDataFixture)
+BOOST_AUTO_TEST_CASE(Basic)
 {
   auto pibImpl = make_shared<PibMemory>();
-  Pib pib("pib-memory", "", pibImpl);
 
-  Identity identity1 = pib.addIdentity(id1);
+  // start with an empty container
+  KeyContainer container(id1, pibImpl);
+  BOOST_CHECK_EQUAL(container.size(), 0);
+  BOOST_CHECK_EQUAL(container.getLoadedKeys().size(), 0);
 
-  Key key11 = identity1.addKey(id1Key1.buf(), id1Key1.size(), id1Key1Name);
-  Key key12 = identity1.addKey(id1Key2.buf(), id1Key2.size(), id1Key2Name);
+  // add the first key
+  Key key11 = container.add(id1Key1.buf(), id1Key1.size(), id1Key1Name);
+  BOOST_CHECK_EQUAL(key11.getName(), id1Key1Name);
+  BOOST_CHECK(key11.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL(container.size(), 1);
+  BOOST_CHECK_EQUAL(container.getLoadedKeys().size(), 1);
+  BOOST_CHECK(container.find(id1Key1Name) != container.end());
 
-  KeyContainer container = identity1.getKeys();
+  // add the same key again
+  Key key12 = container.add(id1Key1.buf(), id1Key1.size(), id1Key1Name);
+  BOOST_CHECK_EQUAL(key12.getName(), id1Key1Name);
+  BOOST_CHECK(key12.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL(container.size(), 1);
+  BOOST_CHECK_EQUAL(container.getLoadedKeys().size(), 1);
+  BOOST_CHECK(container.find(id1Key1Name) != container.end());
+
+  // add the second key
+  Key key21 = container.add(id1Key2.buf(), id1Key2.size(), id1Key2Name);
+  BOOST_CHECK_EQUAL(key21.getName(), id1Key2Name);
+  BOOST_CHECK(key21.getPublicKey() == id1Key2);
   BOOST_CHECK_EQUAL(container.size(), 2);
+  BOOST_CHECK_EQUAL(container.getLoadedKeys().size(), 2);
   BOOST_CHECK(container.find(id1Key1Name) != container.end());
   BOOST_CHECK(container.find(id1Key2Name) != container.end());
 
+  // get keys
+  BOOST_REQUIRE_NO_THROW(container.get(id1Key1Name));
+  BOOST_REQUIRE_NO_THROW(container.get(id1Key2Name));
+  Name id1Key3Name = v2::constructKeyName(id1, name::Component("non-existing-id"));
+  BOOST_CHECK_THROW(container.get(id1Key3Name), Pib::Error);
+
+  // check key
+  Key key1 = container.get(id1Key1Name);
+  Key key2 = container.get(id1Key2Name);
+  BOOST_CHECK_EQUAL(key1.getName(), id1Key1Name);
+  BOOST_CHECK(key1.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL(key2.getName(), id1Key2Name);
+  BOOST_CHECK(key2.getPublicKey() == id1Key2);
+
+  // create another container from the same PibImpl
+  // cache should be empty
+  KeyContainer container2(id1, pibImpl);
+  BOOST_CHECK_EQUAL(container2.size(), 2);
+  BOOST_CHECK_EQUAL(container2.getLoadedKeys().size(), 0);
+
+  // get key, cache should be filled
+  BOOST_REQUIRE_NO_THROW(container2.get(id1Key1Name));
+  BOOST_CHECK_EQUAL(container2.size(), 2);
+  BOOST_CHECK_EQUAL(container2.getLoadedKeys().size(), 1);
+
+  BOOST_REQUIRE_NO_THROW(container2.get(id1Key2Name));
+  BOOST_CHECK_EQUAL(container2.size(), 2);
+  BOOST_CHECK_EQUAL(container2.getLoadedKeys().size(), 2);
+
+  // remove a key
+  container2.remove(id1Key1Name);
+  BOOST_CHECK_EQUAL(container2.size(), 1);
+  BOOST_CHECK_EQUAL(container2.getLoadedKeys().size(), 1);
+  BOOST_CHECK(container2.find(id1Key1Name) == container2.end());
+  BOOST_CHECK(container2.find(id1Key2Name) != container2.end());
+
+  // remove another key
+  container2.remove(id1Key2Name);
+  BOOST_CHECK_EQUAL(container2.size(), 0);
+  BOOST_CHECK_EQUAL(container2.getLoadedKeys().size(), 0);
+  BOOST_CHECK(container2.find(id1Key2Name) == container2.end());
+}
+
+BOOST_AUTO_TEST_CASE(Errors)
+{
+  auto pibImpl = make_shared<PibMemory>();
+
+  KeyContainer container(id1, pibImpl);
+
+  BOOST_CHECK_THROW(container.add(id2Key1.buf(), id2Key1.size(), id2Key1Name), std::invalid_argument);
+  BOOST_CHECK_THROW(container.remove(id2Key1Name), std::invalid_argument);
+  BOOST_CHECK_THROW(container.get(id2Key1Name), std::invalid_argument);
+}
+
+BOOST_AUTO_TEST_CASE(Iterator)
+{
+  auto pibImpl = make_shared<PibMemory>();
+  KeyContainer container(id1, pibImpl);
+
+  container.add(id1Key1.buf(), id1Key1.size(), id1Key1Name);
+  container.add(id1Key2.buf(), id1Key2.size(), id1Key2Name);
+
   std::set<Name> keyNames;
   keyNames.insert(id1Key1Name);
   keyNames.insert(id1Key2Name);
@@ -77,6 +158,10 @@
     count++;
   }
   BOOST_CHECK_EQUAL(count, 2);
+
+  BOOST_CHECK(KeyContainer::const_iterator() == KeyContainer::const_iterator());
+  BOOST_CHECK(KeyContainer::const_iterator() == container.end());
+  BOOST_CHECK(container.end() == KeyContainer::const_iterator());
 }
 
 BOOST_AUTO_TEST_SUITE_END() // TestKeyContainer
diff --git a/tests/unit-tests/security/pib/key.t.cpp b/tests/unit-tests/security/pib/key.t.cpp
index 9391f53..afa65e7 100644
--- a/tests/unit-tests/security/pib/key.t.cpp
+++ b/tests/unit-tests/security/pib/key.t.cpp
@@ -22,6 +22,7 @@
 #include "security/pib/key.hpp"
 #include "security/pib/pib.hpp"
 #include "security/pib/pib-memory.hpp"
+#include "security/pib/detail/key-impl.hpp"
 
 #include "boost-test.hpp"
 #include "pib-data-fixture.hpp"
@@ -41,6 +42,8 @@
 
 BOOST_AUTO_TEST_CASE(ValidityChecking)
 {
+  using security::pib::detail::KeyImpl;
+
   Key key;
 
   BOOST_CHECK_EQUAL(static_cast<bool>(key), false);
@@ -51,7 +54,8 @@
   else
     BOOST_CHECK(true);
 
-  key = Key(id1Key1Name, id1Key1.buf(), id1Key1.size(), make_shared<PibMemory>());
+  auto keyImpl = make_shared<KeyImpl>(id1Key1Name, id1Key1.buf(), id1Key1.size(), make_shared<pib::PibMemory>());
+  key = Key(keyImpl);
 
   BOOST_CHECK_EQUAL(static_cast<bool>(key), true);
   BOOST_CHECK_EQUAL(!key, false);
@@ -62,27 +66,27 @@
     BOOST_CHECK(false);
 }
 
-BOOST_AUTO_TEST_CASE(CertificateOperations)
+/**
+ * pib::Key is a wrapper of pib::detail::KeyImpl.  Since the functionalities of KeyImpl
+ * have already been tested in detail/key-impl.t.cpp, we only test the shared property
+ * of pib::Key in this test case.
+ */
+
+BOOST_AUTO_TEST_CASE(Share)
 {
-  Key key11(id1Key1Name, id1Key1.buf(), id1Key1.size(), make_shared<PibMemory>());
+  using security::pib::detail::KeyImpl;
 
-  BOOST_CHECK_THROW(key11.getCertificate(id1Key1Cert1.getName()), Pib::Error);
-  key11.addCertificate(id1Key1Cert1);
-  BOOST_CHECK_NO_THROW(key11.getCertificate(id1Key1Cert1.getName()));
-  key11.removeCertificate(id1Key1Cert1.getName());
-  BOOST_CHECK_THROW(key11.getCertificate(id1Key1Cert1.getName()), Pib::Error);
+  auto keyImpl = make_shared<KeyImpl>(id1Key1Name, id1Key1.buf(), id1Key1.size(), make_shared<pib::PibMemory>());
+  Key key1(keyImpl);
+  Key key2(keyImpl);
 
-  BOOST_CHECK_THROW(key11.getDefaultCertificate(), Pib::Error);
-  BOOST_REQUIRE_THROW(key11.setDefaultCertificate(id1Key1Cert1.getName()), Pib::Error);
-  BOOST_REQUIRE_NO_THROW(key11.setDefaultCertificate(id1Key1Cert1));
-  BOOST_REQUIRE_NO_THROW(key11.getDefaultCertificate());
+  key1.addCertificate(id1Key1Cert1);
+  BOOST_CHECK_NO_THROW(key2.getCertificate(id1Key1Cert1.getName()));
+  key2.removeCertificate(id1Key1Cert1.getName());
+  BOOST_CHECK_THROW(key1.getCertificate(id1Key1Cert1.getName()), Pib::Error);
 
-  const auto& defaultCert = key11.getDefaultCertificate();
-  BOOST_CHECK(defaultCert.wireEncode() == id1Key1Cert1.wireEncode());
-
-  key11.removeCertificate(id1Key1Cert1.getName());
-  BOOST_CHECK_THROW(key11.getCertificate(id1Key1Cert1.getName()), Pib::Error);
-  BOOST_CHECK_THROW(key11.getDefaultCertificate(), Pib::Error);
+  key1.setDefaultCertificate(id1Key1Cert1);
+  BOOST_CHECK_NO_THROW(key2.getDefaultCertificate());
 }
 
 BOOST_AUTO_TEST_SUITE_END() // TestKey
diff --git a/tests/unit-tests/security/pib/pib-impl.t.cpp b/tests/unit-tests/security/pib/pib-impl.t.cpp
index 3103416..2677e9d 100644
--- a/tests/unit-tests/security/pib/pib-impl.t.cpp
+++ b/tests/unit-tests/security/pib/pib-impl.t.cpp
@@ -169,7 +169,7 @@
   BOOST_CHECK_EQUAL(this->pib.hasKey(this->id1Key1Name), true);
   BOOST_CHECK_EQUAL(this->pib.hasIdentity(this->id1), true);
   const Buffer& keyBits = this->pib.getKeyBits(this->id1Key1Name);
-  BOOST_CHECK_EQUAL_COLLECTIONS(keyBits.begin(), keyBits.end(), this->id1Key1.begin(), this->id1Key1.end());
+  BOOST_CHECK(keyBits == this->id1Key1);
   BOOST_CHECK_NO_THROW(this->pib.getDefaultKeyOfIdentity(this->id1));
   BOOST_CHECK_EQUAL(this->pib.getDefaultKeyOfIdentity(this->id1), this->id1Key1Name);
 
diff --git a/tests/unit-tests/security/pib/pib.t.cpp b/tests/unit-tests/security/pib/pib.t.cpp
index f947fed..de436b4 100644
--- a/tests/unit-tests/security/pib/pib.t.cpp
+++ b/tests/unit-tests/security/pib/pib.t.cpp
@@ -91,20 +91,46 @@
 BOOST_AUTO_TEST_CASE(IdentityOperations)
 {
   Pib pib("pib-memory", "", make_shared<PibMemory>());
+  BOOST_CHECK_EQUAL(pib.getIdentities().size(), 0);
 
+  // get non-existing identity, throw Pib::Error
   BOOST_CHECK_THROW(pib.getIdentity(id1), Pib::Error);
-  Identity identity1 = pib.addIdentity(id1);
+  // get default identity when it is not set yet, throw Pib::Error
+  BOOST_CHECK_THROW(pib.getDefaultIdentity(), Pib::Error);
+
+  // add identity
+  pib.addIdentity(id1);
   BOOST_CHECK_NO_THROW(pib.getIdentity(id1));
+  BOOST_CHECK_EQUAL(pib.getIdentities().size(), 1);
+
+  // new key becomes default key when there was no default key
+  BOOST_REQUIRE_NO_THROW(pib.getDefaultIdentity());
+  BOOST_CHECK_EQUAL(pib.getDefaultIdentity().getName(), id1);
+
+  // remove identity
   pib.removeIdentity(id1);
   BOOST_CHECK_THROW(pib.getIdentity(id1), Pib::Error);
-
   BOOST_CHECK_THROW(pib.getDefaultIdentity(), Pib::Error);
+  BOOST_CHECK_EQUAL(pib.getIdentities().size(), 0);
+
+  // set default identity
   BOOST_REQUIRE_NO_THROW(pib.setDefaultIdentity(id1));
   BOOST_REQUIRE_NO_THROW(pib.getDefaultIdentity());
   BOOST_CHECK_EQUAL(pib.getDefaultIdentity().getName(), id1);
+  BOOST_CHECK_EQUAL(pib.getIdentities().size(), 1);
+  BOOST_REQUIRE_NO_THROW(pib.setDefaultIdentity(id2));
+  BOOST_REQUIRE_NO_THROW(pib.getDefaultIdentity());
+  BOOST_CHECK_EQUAL(pib.getDefaultIdentity().getName(), id2);
+  BOOST_CHECK_EQUAL(pib.getIdentities().size(), 2);
+
+  // remove default identity
+  pib.removeIdentity(id2);
+  BOOST_CHECK_THROW(pib.getIdentity(id2), Pib::Error);
+  BOOST_CHECK_THROW(pib.getDefaultIdentity(), Pib::Error);
+  BOOST_CHECK_EQUAL(pib.getIdentities().size(), 1);
   pib.removeIdentity(id1);
   BOOST_CHECK_THROW(pib.getIdentity(id1), Pib::Error);
-  BOOST_CHECK_THROW(pib.getDefaultIdentity(), Pib::Error);
+  BOOST_CHECK_EQUAL(pib.getIdentities().size(), 0);
 }
 
 BOOST_AUTO_TEST_SUITE_END() // TestPib