Platform cipher - Customer data key (CDK) cache management

General
, , ,
1

As per the documentation: (Ref: Pegasystems Documentation )

  1. Pega Platform creates an initial customer data key (CDK) based Customer master key (CMK) (configured in KMS/KeyStore instance).
  2. The CDKs are stored in encrypted format in the Pega database. On node start up, KMS is called to decrypt the CDKs stored in the Pega database, using your master key.
  3. Customer data key (CDK) is used by Pega Platform for actual encryption and decryption purpose.

We are looking answers for below questions. Please suggest

  1. Is generated Customer data key (CDK) is stored in cache memory as well for quick access? or it referred each time from database for data encryption/decryption?
  2. What is the duration (in minutes/hours/second) for which Customer data key (CDK) is maintained in cache memory ?
  3. What is the impact of the server restart with respect to the Customer data key (CDK) maintenance/initialization?

Thank you in advance.

Regards,

Abhinay

2

Any thoughts on this will be appreciated. Thank you

3

Still waiting for the response/comments, can anyone please suggest. Thank you ​​​​​​​

4

Any thoughts on this will be appreciated. Thank you​​​​​​​

5

@AbhinayU , provided answers below inline

1.Is generated Customer data key (CDK) is stored in cache memory as well for quick access? or it referred each time from database for data encryption/decryption?
ans) CDKs cached in encrypted form to avoid frequent DB access.
2.What is the duration (in minutes/hours/second) for which Customer data key (CDK) is maintained in cache memory ?
ans) We are using size based cache eviction policy so old cache entry will be removed once cache is full.
3. What is the impact of the server restart with respect to the Customer data key (CDK) maintenance/initialization?
ans) The server restart clears the CDK cache. CDKs will be loadded to cache on demand. CDK cache does not face any issue with server restart.

6

Thank you @sivar1 ​​​​​​​ for your response.

7

@AbhinayU I will check to see if our SME can help provide a response for you.