security: introduce security API and framework