Using Fortanix Data Security Manager for InterSystems Cache using KMIP

Last Updated: August 31, 2021 14:16

FORTANIX DATA SECURITY MANAGER FOR INTERSYSTEMS CACHE USING KMIP.pdf
(2 MB)

Introduction

InterSystems Cache is a high-performance database that powers transaction processing applications around the world. It is used for everything from mapping a billion stars in the Milky Way, to processing a billion equity trades in a day, to managing smart energy grids.

InterSystems Cache powers customers’ most mission-critical applications with the ability to store, use, and analyze transactional and historical data concurrently in whatever forms required. High-speed SQL runs consistently and seamlessly across all data models.

Why Use Fortanix Data Security Manager (DSM) with InterSystems Cache

InterSystems Cache supports encryption of data at rest. It supports a keyring service that enables internal server components and plugins to securely store sensitive information for later retrieval.

Cryptographically secure generation and secure management of encryption keys are required for true security of data at rest encrypted by InterSystems Cache. Fortanix DSM with its KMIP support provides a secure and flexible solution for this.

InterSystems Cache KMIP keyring plugin authenticates to a KMIP enabled key management server using a client certificate. SDKMS supports clients/apps to authenticate using API Key, App Id, and certificate or just certificate.

Prerequisites

Fortanix DSM
InterSystems Management Console
Access to create a certificate for KMIP Server

Adding App in Fortanix Data Security Manager

Add an app in the Fortanix DSM in an appropriate group or a new group. For instructions on how to add a group or app please refer to the Fortanix DSM Getting Started Guide.
Figure 1: Create New App
Once you have added the application, note down its App-ID by copying App UUID from the App table view by clicking the icon for “Copy UUID” as shown below. You will need this App-ID for the certificate.
Figure 2: Copy UUID
If an App / Client needs to authenticate to Fortanix DSM using the only certificate, then the App ID needs to be embedded in the certificate in one of the following ways:
- Provided as the value of a custom OID in the certificate 1.3.6.1.4.1.49690.1.2.1
- Standard human-readable UUID encoding: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx provided as the value of CN.
CN example: a36bb135-8a49-46f8-979b-bc5bbd3e7f7e

Create a new certificate using the OpenSSL command which you will be using to upload in the Fortanix DSM app.

OpenSSL Command:
```
openssl req -newkey rsa:2048 -nodes -keyout sdkms.key -x509 -days 365 -out sdkms.crt
```
Figure 3: Create a new certificate
Now go to the Fortanix DSM app and change the Authentication method to Certificate.
Figure 4: Change the Authentication method to Certificate
Update the Certificate created above and upload the same in Fortanix DSM as per the following screenshot.
Figure 5: Upload Certificate

Enabling the Security in InterSystems Cache

Create a new SSL/TLS Configuration

Log in to the Management Console for IRIS.
Figure 6: IRIS Management Console
Once you log in you will see the InterSystems Management Console homepage.
Figure 7: InterSystems Management Portal
On the Cache instance that will communicate with the KMIP server, create an SSL/TLS configuration that will represent the instance to the KMIP server:
1. In the portal, go to the SSL/TLS Configurations page (Home > System Administration > Security > SSL/TLS Configurations).
  Figure 8: SSL/TLS Configuration page
On the SSL/TLS Configurations page (Figure 8), click the Create New Configuration button, which displays the New SSL/TLS Configuration page.
On the New SSL/TLS Configuration page, set up the SSL/TLS configuration. For the fields listed below, specify or select values as follows:
1. Enabled — Select this check box.
2. Type — Select Client.
3. Update the client certificate, the private key, which was created, and the certificate which was updated in the SDKMS portal.
Figure 9: Update the SSL/TLS Configuration
Click the Test icon on the Management portal (Figure 9).
Figure 10: Test server hostname
Update the Port number as 5696 and click OK.
Figure 11: Update port number
You will then receive the Success status of the connection and click Save to save it.
Figure 12: Connection Success Once configured, the management console for SSL/TLS configuration will be as follows:
Figure 13: Configuration success

Create KMIP Server Configuration Using Terminal

Start the Terminal and log in as a sufficiently privileged user.
Figure 14: Log in to Terminal
At the terminal prompt, go to the %SYS namespace and run ^SECURITY.
```
     zn "%SYS"
%SYS>do ^SECURITY
```
Figure 15: Run ^Security
In the ^SECURITY, select option 14) KMIP server setup.
In the KMIP server setup choices, select option 1) Create KMIP server.
At the Create KMIP server prompt, specify values for the following:
1. KMIP server to create? — The name of the KMIP server configuration.
2. Description? — A text description.
3. Server host DNS name? — The fully-qualified DNS name or IP address of the KMIP server.
4. TCP port number? — The port number on which the KMIP server accepts connections.
5. OASIS KMIP protocol version? — The number associated with your KMIP server’s supported version of the protocol. This is part of the information that you have received from the vendor that provides the KMIP server.
6. SSL/TLS Configuration name? — The name of the SSL/TLS configuration that you created in the previous step.
Figure 16: KMIP Server Setup

Select option 1) Create KMIP Server and update the requested information:

KMIP Server to create? SDKMS
Description? SDKMS
Server host DNS Name? sdkms.fortanix.com 
TCP Port number? 5696 => 5696
OASIS KMIP protocol version
0) 1.0
1) 1.1
2) 1.2
3) 1.3
4) 1.4
OASIS KMIP protocol version? 2 => 2
SSL/TLS configuration name? KMIP => SDKMS
Non-blocking I/O? Yes => Yes
Auto-reconnect? No => Yes
I/O timeout, in seconds? 10 => 10
Log KMIP messages? No => Yes
Debug SSL/TLS? No => Yes
Confirm creation of KMIP server SDKMS? Yes => Yes
KMIP server SDKMS created

Figure 17: Create KMIP Server You can list the KMIP server by selecting option 4) Detailed list KMIP server.

Figure 18: List the KMIP Server

Create a New Key in KMIP Server

To activate a database encryption key from a KMIP server:

For the relevant instance, start the Terminal and log in as a sufficiently privileged user.
At the terminal prompt, go to the %SYS namespace and run ^EncryptionKey.
```
     zn "%SYS"
%SYS>do ^EncryptionKey
```
Figure 19: Run Encryption key
Select Option 5) Manage KMIP server and you will be prompted the KMIP Server name.
In the following screenshot, the KMIP server we have is SDKMS.
We can list the keys in KMIP Server (Option 1), create a Key (Option 2), and Destroy the key (Option 3).
Figure 20: KMIP server - SDKMS
Select Option 2) Create new key on KMIP server.
Figure 21: Create new key on KMIP server The key is created but not activated as seen in Figure 21.
Since the key is now created in the KMIP Server, we can see the same in Fortanix DSM Portal as shown in the following screenshot.
Figure 22: Key created in Fortanix DSM Portal

Activate the Data-Element Encryption Key from a KMIP Server