LDT Use Cases

This section describes various LDT scenarios using the CTE APIs.

Suspend/Resume Rekey

The LDT rekey operation can be paused and resumed on the protected LDT clients. Run the ldtpause API with "paused": true to pause, and "paused": false to resume the operation.

API

/v1/transparent-encryption/clients/{id}/ldtpause

Sample

{
    "paused": <true/false>
}

Key Rotation

On a path guarded using an LDT policy, you can create a new version of the key used for encryption. This triggers the rekey operation on the client for the GaurdPath using the rotated key.

API

/v1/vault/keys2/{id}/versions

Decrypting LDT-protected GuardPoints

This section describes steps to decrypt an LDT-protected GuardPoint using the CTE APIs.

To decrypt an LDT-protected GuardPoint:

1. Get the LDT policy currently being used by the GuardPoint.

   Run the API

   get /v1/transparent-encryption/clients/<client-name>/guardpoints

   Copy

   Example

   get /v1/transparent-encryption/clients/ldt-client-name/guardpoints

   Copy

   This API returns the list of GuardPoints applied to the client. Copy the value of LDT "policy_name" (for example, ldt-policy) applied to the desired LDT GuardPoint.

2. Get the key linked to the LDT policy.

   Run the API

   get /v1/transparent-encryption/policies/<ldt-policy-name>/ldtkeyrules

   Copy

   Example

   get /v1/transparent-encryption/policies/ldt-policy/ldtkeyrules

   Copy

   This API returns the LDT key rules of the LDT policy. Copy the value of "key_id" (for example, current-key). This key is used to encrypt the LDT GuardPoint.

3. Clone the current (latest) version of the key to a non-versioned CTE key.

   Run the API

   post /v1/vault/keys2/<current-key-name>/clone

   Copy

   Request Parameters

   {
       "newKeyName": "<clone-key-name>",
       "meta":
       {
           "cte":
           {
               "persistent_on_client":true,
               "cte_versioned":false,
               "encryption_mode":"<enc-mode>"
           }
       }
   }

   Copy
   

   Note

   Make sure that "cte_versioned" is set to false.

   Example

   post /v1/vault/keys2/current-key/clone
   {
       "newKeyName": "cloned-key",
       "meta":
       {
           "cte":
           {
               "persistent_on_client":true,
               "cte_versioned":false,
               "encryption_mode":"CBC"}
           }
   }

   Copy

   A new key with the specified name (for example, cloned-key) is created with version 0.

4. Create a new LDT policy (for example, new-ldt-policy). In "ldt_key_rules", set:

   • The cloned key (cloned-key) as the "key_id" for "current_key".

   • clear_key as the "key_id" for "transformation_key".

   Run the API

   post /v1/transparent-encryption/policies

   Copy

   Request Parameters

   {
      "name":"<new-ldt-policy-name>",
      "policy_type":"LDT",
      "never_deny":false,
      "security_rules":[
         {
            "effect":"permit,applykey",
            "action":"key_op"
         },
         {
            "effect":"permit,applykey,audit",
            "action":"all_ops",
            "partial_match":true
         }
      ],
      "ldt_key_rules":[
         {
            "resource_set_id":"<resource-set>",
            "current_key":{
               "key_id":"<clone-key-name>"
            },
            "transformation_key":{
               "key_id":"clear_key"
            }
         }
      ]
   }

   Copy

   Example

   post /v1/transparent-encryption/policies
   {
      "name":"new-ldt-policy",
      "policy_type":"LDT",
      "never_deny":false,
      "security_rules":[
         {
            "effect":"permit,applykey",
            "action":"key_op"
         },
         {
            "effect":"permit,applykey,audit",
            "action":"all_ops",
            "partial_match":true
         }
      ],
      "ldt_key_rules":[
         {
            "resource_set_id":"",
            "current_key":{
               "key_id":"cloned-key"
            },
            "transformation_key":{
               "key_id":"clear_key"
            }
         }
      ]
   }

   Copy

   A new LDT policy with the name new-ldt-policy is created.

5. Remove the LDT GuardPoint.

   Run the API

   patch /v1/transparent-encryption/clients/<client-name>/guardpoints/<GuardPoint-resource-id>/unguard/

   Copy

   Example

   patch /v1/transparent-encryption/clients/ldt-client-name/guardpoints/a724ed5d-b5c5-45f3-8b8f-77ec3ec976d1/unguard

   Copy

6. On the CTE client, remove the existing CTE-LDT attributes on the GuardPoint.

   Run the Command

   voradmin ldt attr delete <GuardPoint>

   Copy

   Example

   voradmin ldt attr delete /ldt_path

   Copy

   The LDT metadata has been removed from all files in the GuardPoint /ldt_path.

7. Create a new GuardPoint for the directory using the new policy.

   Run the API

   post /v1/transparent-encryption/clients/<client-name>/guardpoints

   Copy

   Request Parameters

   {
       "guard_paths":["/<GuardPath>"],
       "guard_point_params":
       {
           "is_idt_capable_device":false,
           "guard_point_type":"directory_auto",
           "policy_id":"<new-ldt-policy-name>",
           "preserve_sparse_regions":true
       }
   }

   Copy

   Example

   post /v1/transparent-encryption/clients/ldt-client-name/guardpoints
   {
       "guard_paths":["/ldt_path"],
       "guard_point_params":
       {
           "is_idt_capable_device":false,
           "guard_point_type":"directory_auto",
           "policy_id":"new-ldt-policy",
           "preserve_sparse_regions":true
       }
   }

   Copy

8. Wait for the rekey to complete. You can check the rekey status, as described below.

   Run the API

   get /v1/transparent-encryption/clients/<client-name>/guardpoints

   Copy

   Example

   get /v1/transparent-encryption/clients/ldt-client-name/guardpoints

   Copy

   When the "rstatus" status becomes "Rekeyed", the rekey (decryption) is complete.

   

   Note

   • If you have selected directory_auto, data transformation begins as soon as the client gets the new policy information from the key manager.

   • If you have selected directory_manual, use the secfsd -guard <GuardPoint> command on the client to begin data transformation.

9. Remove the GuardPoint. This ensures rekey is no longer triggered for any new data added to the specified GuardPath.

   Run the API

   patch /v1/transparent-encryption/clients/<client-name>/guardpoints/<GuardPoint-resource-id>/unguard/

   Copy

   Example

   patch /v1/transparent-encryption/clients/ldt-client-name/guardpoints/77ec9ec67d3-c5b5-435f-7b8f-a275de45e/unguard

   Copy