Secured by RSA Implementation Guide. Last Modified: August 2, 2013

Transcription

1 Secure VSA Secured by RSA Implementation Guide Partner Information Last Modified: August 2, 2013 Product Information Partner Name Cloudlink Solutions Web Site Product Name Version & Platform 2.01 and 2.1 Cloudlink is a end to end data encryption solution for data in flight and Product Description data at rest. This solution allows independent tenants, customers or departments to securely segregate and protect data in a virtual cloud environment. This could be for internal or government requirements.

2 Solution Summary Together, and RSA Data Protection Manager offer complete protection of data in motion and at rest. The security offered by DPM is complemented by the convenience, ease of use and costeffectiveness of the policy-based control provides. Large enterprises have multiple (often dozens or even hundreds of) departments, each requiring isolated and protected access to sensitive information. For example, an HR department records and maintains personal information on its employees whereas a Finance department maintains highly sensitive company data. HR systems and administrators should not necessarily have access to financial data and finance systems and analysts should not necessarily have access to employees personal information. Each department can therefore be considered a separate tenant in the enterprise s data center with its own requirements concerning data security in motion and at rest. These requirements may be internally imposed (e.g. by corporate policy) or externally imposed (e.g. by regulations such as PCI and HIPAA). As a result, the segregation and protection of each tenant s workloads and the data they consume when stored in and transmitted over shared infrastructure is a primary concern, regardless of whether the infrastructure is hosted in an enterprise data center (private cloud) or a public cloud. vnodes provide departments their own virtual encrypted storage, partitioning large multitenant storage into smaller volumes, each encrypted with its own key. Gateway grants the department exclusive control over the storage encryption key. Because encrypted information is only as secure as the keys used to encrypt it, it is vital that the potentially hundreds of keys maintained by an enterprise are handled with the utmost care. How it works Each vnode establishes its own storage volume. It generates a data encryption key (DEK) which it uses to encrypt all data stored on the volume, leveraging AES-NI for hardware acceleration if provided by the virtualization host s processors. The Gateway generates a key encryption key (KEK) for each vnode s secure storage volume and uses it to encrypt the volume s DEK. In order to unlock a vnode s storage, the Gateway retrieves the corresponding KEK and provides it to the vnode. The vnode then decrypts the volume s DEK and uses it to provide access to the stored data. To lock a storage volume, the Gateway removes the KEK from the vnode, resulting in the vnode no longer being able to access the DEK and provide access to the storage. By incorporating the RSA DPM Java client, each Gateway instance can entrust its storage KEKs to RSA DPM. uses the key archival resources of RSA DPM to store them securely. The KEKs correspond to the AES-256 with CBC encryption algorithm and are archived in a Security Class created specifically for this purpose (see RSA Key Manager Configuration, below). All communication between Gateway and RSA DPM occurs via a certificate-based mutuallyauthenticated secure session. Page: 2

3 Page: 3

4 Product Configuration for Interoperability RSA Key Manager Configuration To use RSA DPM to store encryption keys, ensure that an RSA DPM host is accessible by the Gateway via the Gateway s Private LAN network. To configure the RSA DPM for storage of encryption keys: 1. Log onto the RSA Data Protection Manager console. 2. Create an Afore identity Group. Note: All Diagrams in this document reflect generic names not the recommended customer or product name. Note: All Diagrams in this document reflect generic names not the recommended customer or product name. Page: 4

5 3. Under Identity management Create an identity that belongs to the previously created identity group. Click the choose file button and load a PKI client certificate with a.cer extension created or obtained by a third party. Page: 5

6 RESULT Page: 6

7 4. Create a security class object that belongs to the same RSA DPM identity group Duration Infinite Creating a security class object Keep clicking next adding any attributes if desired to finish and save. Page: 7

8 AFORE Solutions Configuration To configure RSA DPM as the key store location: 1. Open the Center on the Gateway using the secadmin user account. Note: Refer to the xx User Guide for details on accessing the Center console. 2. On the left side of the window, at the top of the VMs list in the Topology Tree, select the Gateway. 3. Click Security tab and then the Key Store tab. 4. To configure the to use RSA Data Protection Manager for encryption key storage, click the RSA DPM link in the Location panel. 5. In the RSA DPM Configuration panel, specify the RSA DPM parameters Host The RSA DPM host IP address. Port The TCP port number configured on the RSA DPM host (default 443). Security Class Name The name of the security class configured on the RSA DPM host for the RSA DPM client (for instructions on how to configure a security class for the RSA DPM client, see RSA Key Manager Configuration). Trust Certificate Client Certificate Password The RSA DPM server certificate. The RSA DPM client certificate. The password used during the RSA DPM client certificate creation. Important: Ensure that the correct RSA DPM server and client PKI certificates are created and saved on the RSA DPM server. Page: 8

9 RSA DPM Configuration panel in Center 6. Click Apply to save the parameters. Page: 9

10 Certification Checklist for 3 rd Party Applications Date Tested: July 30, 2013 Certification Environment Product Name Version Information Operating System RSA DPM 3.5 Microsoft Windows, Appliance and VM RSA DPM Java client 3.1 Microsoft Windows Afore 2.01 and 2.1 Linux Date Tested: June 6, 2012 Certification Environment Product Name Version Information Operating System RSA DPM 3.2 Microsoft Windows, Appliance and VM RSA DPM Java client 3.1 Microsoft Windows Afore 1.8 Linux RSA Java client API Functionality Partner Functions and Tests Key Create N/A Partner Product Creates Key Utilizes Key caching N/A Partner product encrypts data Create an empty key object N/A Partner product decrypts data Key Archival Partner product will not send any clear text data without the proper key. Key retrieval by key class N/A Key retrieval by key ID Key retrieval by Alias N/A Encrypt data N/A Decrypt data N/A FAL = Pass = Fail N/A = Not Applicable to Integration Page: 10

11 Appendix Document Title Description Location AFORE User Guide User reference manual for AFORE. Delivered with product. Term AES CBC Gateway vnode DEK KEK VM Meaning Advanced Encryption Standard - symmetric-key encryption algorithm, adopted by the U.S. Government to supersede the Data Encryption Standard (DES). Cypher-Block Chaining a mode of encryption virtual appliance installed at the enterprise and used to monitor performance and manage security of sensitive data in virtual environment. virtual appliance which provides encrypted storage to workloads in the virtual data center. Data Encryption Key Key Encryption Key Virtual Machine Page: 11