Implementing BLOB and Property Encryption

General
, , , , ,
1

If you want to encrypt the BLOB and properties, either in a new or an existing application; the attached implementation guide will help you step by step. The document also includes a deployment plan to make sure the encryption is applied correctly in other environments.

@MITTS

Contents:

  1. General
    1. Pre-Project Considerations
  2. Setup
    1. Step 1: Configure KeyStore
    2. Step 2: Activate KeyStore
  3. Encryption of BLOB
    1. Removal of class instances
    2. Encrypt BLOB
  4. Encryption of exposed properties
    1. Access Control Policy
    2. Column Length
  5. Encryption in Exposed Properties – Issues and Design Patterns
    1. Section Rules – Visibility conditions in expressions
    2. Validation Rules
    3. Data Transforms/Activities
    4. Full Text Search
    5. Reporting
  6. BIX
  7. Deployment

Encryption - BLOB and exposed properties.pdf (788 KB)

2

@mowam - Good post on encryption of BLOB data. But I am unable to visualize the usecase in this context. Also, why don’t we use the password option for all the properties inside the BLOB and this is also a kind of encryption? Pls help me to understand on password Vs this encrypting option.

3

@Ravi Kumar Pisupati as you know in Pega you can do the same thing in several ways. Encrypting the BLOB has these advantages:

  • Will encrypt all the properties for you, so its quicker to implement,
  • If you later on add new properties to your class; they will be encrypted by default.

I hope this helps.

4

@MohamedMowafy

Hi, can we use any type keystore for Platform cipher? I’ve created a Java keystore, but it doesn’t show on the keystore field, seems it only support Amazon KMS if we want to use Platform cipher?

5

@lokw9603

Yes, Pega supports keystore from custom sources, please refer to this documentation:

If this still doesn’t work, I would recommend to raise a ticket with Pega support.

Please update this post once you get a resolution; in case others have the same issue.

6

@MohamedMowafy

Thanks for the reply.

In your document, it is mentioned, the data instances must be deleted from the system, can we not deleted them and use encryptPropertyvalue to encrypt the BLOB.

Also for existing work objects that has exposed property prior to encryption being turn on, do we use encryptPropertyValue to encrypt them? Thanks.

7

@MohamedMowafy

created a keystore and try to use it in Data Encryption settings. Got error "robotic_keystore is not of type Amazon Key Management service.

error screen shot.png
error screen shot.png1193×837 49.1 KB

8

@lokw9603

  1. Instances need to be deleted as class level BLOB encryption check box only gets enabled if there are no instances in the class.

Above is what is recommended OOTB and supported for BLOB from what we are aware of

  1. Again Access control policy is the recommended way forward. If you follow approach 1 then when you save a new record then any exposed property will be governed by access control policy. Alternatively for already created work objects you can try creating an access control policy for the exposed property and try and save the BLOB again and see if the exposed property gets encrypted or not.
9

@Salil

deleted all instances, created the access control policy for the exposed column. But the varchar column still can be viewed in plain text; i.e. it is not encrypted. I checked the systemout.log file, seems the CustomCipher class is called; saw the “encrypting” and “decrypting” output. Any advise on what could be wrong? How can i check super.encrypt is called?

thanks.

here is the CustomCipher.java

package com.fepoc;

import com.pega.pegarules.exec.internal.util.crypto.PRCipherBase;

public class CustomCipher extends com.pega.pegarules.exec.internal.util.crypto.PRCipherBase {

private static final byte a = {

(byte)0x9a, (byte)0x86, (byte)0x5b, (byte)0xe1, (byte)0x64, (byte)0xf7,

(byte)0x69, (byte)0xd4, (byte)0x00, (byte)0x96, (byte)0x04, (byte)0x68,

(byte)0xff, (byte)0xd1, (byte)0x8e, (byte)0xed,

};

private static final byte b = null;

private static final String c = “************”;

public CustomCipher() {

init(c, a, b);

}

public byte encrypt(byte aInput) {

System.out.println(“encrypting”);

return super.encrypt(aInput);

}

public byte decrypt(byte aInput) {

System.out.println(“decrypting”);

return super.decrypt(aInput);

}

}