1.0 Introduction
This article describes how to integrate Bloombase Storesafe with Fortanix-Data-Security-Manager (DSM).
2.0 Configure Fortanix DSM
A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:
2.1 Signing Up
To get started with the Fortanix Data Security Manager (DSM) cloud service, you must register an account at <Your_DSM_Service_URL>. For example, https://eu.smartkey.io.
For detailed steps on how to set up the Fortanix DSM, refer to the User's Guide: Sign Up for Fortanix Data Security Manager SaaS documentation.
2.2 Creating an Account
Access the <Your_DSM_Service_URL> on the web browser and enter your credentials to log in to the Fortanix DSM.
Figure 1: Logging In
2.3 Creating a Group
Perform the following steps to create a group in the Fortanix DSM:
Click the Groups menu item in the DSM left navigation panel and click the + button on the Groups page to add a new group.
Figure 2: Add Groups
On the Adding new group page, enter the following details:
Title: Enter a title for your group.
Description (optional): Enter a short description for the group.
Click the SAVE button to create the new group.
The new group has been added to the Fortanix DSM successfully.
2.4 Creating an Application
Perform the following steps to create an application (app) in the Fortanix DSM:
Click the Apps menu item in the DSM left navigation panel and click the + button on the Apps page to add a new app.
Figure 3: Add Application
On the Adding new app page, enter the following details:
App name: Enter the name of your application.
Interface (optional): Select the KMIP option as interface type from the drop down menu.
ADD DESCRIPTION (optional): Enter a short description for the application.
Authentication method: Select the default API Key as the method of authentication from the drop down menu. For more information on these authentication methods, refer to User's Guide: Authentication documentation.
Assigning the new app to groups: Select the group created in Section 2.3: Creating a Group from the list.
Click the SAVE button to add the new application.
The new application has been added to the Fortanix DSM successfully.
2.5 Copying the App UUID
Perform the following steps to copy the app UUID from the Fortanix DSM:
Click the Apps menu item in the DSM left navigation panel and click the app created in Section 2.4: Creating an Application to go to the detailed view of the app.
On the INFO tab, click the VIEW API KEY DETAILS button.
From the API Key Details dialog box, copy the Username (app UUID) and Password to be used in Section 3.0 Configuring Bloombase Storesafe as the value of Common Name (CN) to generate the certificate.
3.0 Configuring Bloombase Storesafe
Perform the following steps:
On the Bloombase Storesafe Console, select OASIS KMIP Key Manager from the Bloombase Storesafe main menu.
Figure 4: OASIS KMIP Key Manager
Click Add.
On the Modify KMIP Key Manager page:
Fill in the name that you want to use to identify with this instance of Fortanix DSM as the KMIP Server.
For the Model field, select Generic.
Specify the Hostname/IP Address of the Fortanix DSM cluster.
Leave the Port as default 5696.
Leave the Timeout and Retry Count info as default unless you have a specific setting you want to use.
Leave the Username and Password as blank.
Click Submit to save the information.
Figure 5: Modifying the KMIP Key Manager
Select Create for the client keystore, to create a Rivest, Shamir, Adleman (RSA) Keypair, and a Certificate Signing Request (CSR).
Figure 6: Creating an RSA Keypair and a CSR Request
Specify the algorithm/key sizes you want for your keypair, the values for the certificate Distinguished Name (DN), and then click Generate to generate the certificate request.
Figure 7: Generating a Certificate Request
NOTE
You must specify the app UUID copied in the Section 2.5: Copying an App UUID as the CN of the certificate request.
Click Certificate Request to download the CSR and send it to your CA for certificate issuance.
Figure 8: Sending a Certificate Request
Upload the CA Public Certificate used to sign the CSR to the Trust Certificate Store.
Figure 9: Uploading the Trust Certificate
Upload the signed certificate to the Client Keystore.
Figure 10: Uploading the Signed Certificate
Upload the Fortanix DSM cluster certificate to the Trust Certificate Store.
Figure 11: Uploading the Fortanix DSM Cluster Certificate
Click Submit to save the configuration.
Figure 12: Submitting the Certificates
4.0 Updating the Authentication Method
Perform the following steps to change the authentication method:
Go to the detailed view of the app created in Section 2.4: Creating an Application and click the Change authentication method button and select the Certificate option to change the authentication method to Certificate.
Click the SAVE button.
On the Add certificate dialog box, click the UPLOAD NEW CERTIFICATE button to upload the certificate file or paste the content of the certificate generated in previous section.
Select both the check boxes to confirm your understanding about the action.
Click the UPDATE button to save the changes.
5.0 Creating a Security Object
Perform the following steps to generate an AES key in the Fortanix DSM:
Click the Security Objects menu item in the DSM left navigation panel and click the + button on the Security Objects page to add a security object.
Figure 13: Add Security Object
On the Add New Security Object page, enter the following details:
Security Object name: Enter the name of your security object.
Group: Select the group as created in Section 2.3: Creating a Group.
Select the GENERATE radio button.
Choose a type: Select the AES key type.
Key Size: Indicates the size of the key in bits.
Key operations permitted: Select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying.
Click the GENERATE button to create the new security object.
The new security object is added to the Fortanix DSM successfully.
6.0 Configuring Fortanix DSM KMIP Entity in Bloombase Storesafe
Perform the following steps:
In the Bloombase Console for the KMIP Key Manager, open the Fortanix DSM KMIP entity.
Figure 14: Fortanix DSM KMIP Entity
Click Test.
Figure 15: Testing the Connection
The successful test confirms that Bloombase Storesafe can authenticate and connect to Fortanix DSM.
Figure 16: Connection is Successful
To select the key created in Fortanix DSM in the Bloombase Storesafe Key Wrapper, click Create Key Wrapper.
Figure 17: Creating a Key Wrapper
Under Modify Key Wrapper, select the Fortanix DSM entity that you configured in Bloombase Storesafe in Section 3.0: Configuring Bloombase Storesafe and select the key created under the Object drop down menu and click Select Key.
Figure 18: Selecting the Key
Click Submit to submit the updated configuration.
Figure 19: Submitting the Updated Configuration
Confirm the key has been properly selected by clicking Find Key Wrapper, and then click Find.
Figure 20: Finding the Key
You can now use the Fortanix DSM KMIP server as a Key Management System (KMS) for all storage encryption implemented with Bloombase Storesafe. Refer to the Bloombase Storesafe documentation for implementing the specific storage encryption use case you have.