Please Note:

LDT Use Cases

This section describes various LDT scenarios using the CTE APIs.

Suspend/Resume Rekey

The LDT rekey operation can be paused and resumed on the protected LDT clients. Run the ldtpause API with "paused": true to pause, and "paused": false to resume the operation.

API

/v1/transparent-encryption/clients/{id}/ldtpause

Sample

{
    "paused": <true/false>
}

Key Rotation

On a path guarded using an LDT policy, you can create a new version of the key used for encryption. This triggers the rekey operation on the client for the GaurdPath using the rotated key.

API

/v1/vault/keys2/{id}/versions

Decrypting LDT-protected GuardPoints

This section describes steps to decrypt an LDT-protected GuardPoint using the CTE APIs.

To decrypt an LDT-protected GuardPoint:

Get the LDT policy currently being used by the GuardPoint.
Run the API
```
get /v1/transparent-encryption/clients/<client-name>/guardpoints
```
Example
```
get /v1/transparent-encryption/clients/ldt-client-name/guardpoints
```
This API returns the list of GuardPoints applied to the client. Copy the value of LDT "policy_name" (for example, ldt-policy) applied to the desired LDT GuardPoint.
Get the key linked to the LDT policy.
Run the API
```
get /v1/transparent-encryption/policies/<ldt-policy-name>/ldtkeyrules
```
Example
```
get /v1/transparent-encryption/policies/ldt-policy/ldtkeyrules
```
This API returns the LDT key rules of the LDT policy. Copy the value of "key_id" (for example, current-key). This key is used to encrypt the LDT GuardPoint.

Clone the current (latest) version of the key to a non-versioned CTE key.

Run the API

post /v1/vault/keys2/<current-key-name>/clone

Request Parameters

{
    "newKeyName": "<clone-key-name>",
    "meta":
    {
        "cte":
        {
            "persistent_on_client":true,
            "cte_versioned":false,
            "encryption_mode":"<enc-mode>"
        }
    }
}

Note

Make sure that "cte_versioned" is set to false.

Example

post /v1/vault/keys2/current-key/clone
{
    "newKeyName": "cloned-key",
    "meta":
    {
        "cte":
        {
            "persistent_on_client":true,
            "cte_versioned":false,
            "encryption_mode":"CBC"}
        }
}

A new key with the specified name (for example, cloned-key) is created with version 0.

Create a new LDT policy (for example, new-ldt-policy). In "ldt_key_rules", set:

The cloned key (cloned-key) as the "key_id" for "current_key".
clear_key as the "key_id" for "transformation_key".

Run the API

post /v1/transparent-encryption/policies

Request Parameters

{
   "name":"<new-ldt-policy-name>",
   "policy_type":"LDT",
   "never_deny":false,
   "security_rules":[
      {
         "effect":"permit,applykey",
         "action":"key_op"
      },
      {
         "effect":"permit,applykey,audit",
         "action":"all_ops",
         "partial_match":true
      }
   ],
   "ldt_key_rules":[
      {
         "resource_set_id":"<resource-set>",
         "current_key":{
            "key_id":"<clone-key-name>"
         },
         "transformation_key":{
            "key_id":"clear_key"
         }
      }
   ]
}

Example

post /v1/transparent-encryption/policies
{
   "name":"new-ldt-policy",
   "policy_type":"LDT",
   "never_deny":false,
   "security_rules":[
      {
         "effect":"permit,applykey",
         "action":"key_op"
      },
      {
         "effect":"permit,applykey,audit",
         "action":"all_ops",
         "partial_match":true
      }
   ],
   "ldt_key_rules":[
      {
         "resource_set_id":"",
         "current_key":{
            "key_id":"cloned-key"
         },
         "transformation_key":{
            "key_id":"clear_key"
         }
      }
   ]
}

A new LDT policy with the name new-ldt-policy is created.

Remove the LDT GuardPoint.

Run the API

patch /v1/transparent-encryption/clients/<client-name>/guardpoints/<GuardPoint-resource-id>/unguard/

Example

patch /v1/transparent-encryption/clients/ldt-client-name/guardpoints/a724ed5d-b5c5-45f3-8b8f-77ec3ec976d1/unguard

On the CTE client, remove the existing CTE-LDT attributes on the GuardPoint.
Run the Command
```
voradmin ldt attr delete <GuardPoint>
```
Example
```
voradmin ldt attr delete /ldt_path
```
The LDT metadata has been removed from all files in the GuardPoint /ldt_path.

Create a new GuardPoint for the directory using the new policy.

Run the API

post /v1/transparent-encryption/clients/<client-name>/guardpoints

Request Parameters

{
    "guard_paths":["/<GuardPath>"],
    "guard_point_params":
    {
        "is_idt_capable_device":false,
        "guard_point_type":"directory_auto",
        "policy_id":"<new-ldt-policy-name>",
        "preserve_sparse_regions":true
    }
}

Example

post /v1/transparent-encryption/clients/ldt-client-name/guardpoints
{
    "guard_paths":["/ldt_path"],
    "guard_point_params":
    {
        "is_idt_capable_device":false,
        "guard_point_type":"directory_auto",
        "policy_id":"new-ldt-policy",
        "preserve_sparse_regions":true
    }
}

Wait for the rekey to complete. You can check the rekey status, as described below.
Run the API
```
get /v1/transparent-encryption/clients/<client-name>/guardpoints
```
Example
```
get /v1/transparent-encryption/clients/ldt-client-name/guardpoints
```
When the "rstatus" status becomes "Rekeyed", the rekey (decryption) is complete.
Note
- If you have selected directory_auto, data transformation begins as soon as the client gets the new policy information from the key manager.
- If you have selected directory_manual, use the secfsd -guard <GuardPoint> command on the client to begin data transformation.

Remove the GuardPoint. This ensures rekey is no longer triggered for any new data added to the specified GuardPath.

Run the API

patch /v1/transparent-encryption/clients/<client-name>/guardpoints/<GuardPoint-resource-id>/unguard/

Example

patch /v1/transparent-encryption/clients/ldt-client-name/guardpoints/77ec9ec67d3-c5b5-435f-7b8f-a275de45e/unguard

Suggest A Change

LDT Use Cases

Suspend/Resume Rekey

Key Rotation

Decrypting LDT-protected GuardPoints

On this page