LDT Use Cases

This section describes various LDT scenarios using the CTE APIs.

Suspend/Resume Rekey

The LDT rekey operation can be paused and resumed on the protected LDT clients. Run the ldtpause API with "paused": true to pause, and "paused": false to resume the operation.

API

/v1/transparent-encryption/clients/{id}/ldtpause

Sample

{
    "paused": <true/false>
}

Key Rotation

On a path guarded using an LDT policy, you can create a new version of the key used for encryption. This triggers the rekey operation on the client for the GaurdPath using the rotated key.

API

/v1/vault/keys2/{id}/versions

Decrypting LDT-protected GuardPoints

This section describes steps to decrypt an LDT-protected GuardPoint using the CTE APIs.

To decrypt an LDT-protected GuardPoint:

1. Get the LDT policy currently being used by the GuardPoint.

   Run the API

   get /v1/transparent-encryption/clients/<client-name>/guardpoints
   

   Example

   get /v1/transparent-encryption/clients/ldt-client-name/guardpoints
   

   This API returns the list of GuardPoints applied to the client. Copy the value of LDT "policy_name" (for example, ldt-policy) applied to the desired LDT GuardPoint.

2. Get the key linked to the LDT policy.

   Run the API

   get /v1/transparent-encryption/policies/<ldt-policy-name>/ldtkeyrules
   

   Example

   get /v1/transparent-encryption/policies/ldt-policy/ldtkeyrules
   

   This API returns the LDT key rules of the LDT policy. Copy the value of "key_id" (for example, current-key). This key is used to encrypt the LDT GuardPoint.

3. Clone the current (latest) version of the key to a non-versioned CTE key.

   Run the API

   post /v1/vault/keys2/<current-key-name>/clone
   

   Request Parameters

   {
       "newKeyName": "<clone-key-name>",
       "meta":
       {
           "cte":
           {
               "persistent_on_client":true,
               "cte_versioned":false,
               "encryption_mode":"<enc-mode>"
           }
       }
   }
   

   Note

   Make sure that "cte_versioned" is set to false.

   Example

   post /v1/vault/keys2/current-key/clone
   {
       "newKeyName": "cloned-key",
       "meta":
       {
           "cte":
           {
               "persistent_on_client":true,
               "cte_versioned":false,
               "encryption_mode":"CBC"}
           }
   }
   

   A new key with the specified name (for example, cloned-key) is created with version 0.

4. Create a new LDT policy (for example, new-ldt-policy). In "ldt_key_rules", set:

   • The cloned key (cloned-key) as the "key_id" for "current_key".

   • clear_key as the "key_id" for "transformation_key".

   Run the API

   post /v1/transparent-encryption/policies
   

   Request Parameters

   {
      "name":"<new-ldt-policy-name>",
      "policy_type":"LDT",
      "never_deny":false,
      "security_rules":[
         {
            "effect":"permit,applykey",
            "action":"key_op"
         },
         {
            "effect":"permit,applykey,audit",
            "action":"all_ops",
            "partial_match":true
         }
      ],
      "ldt_key_rules":[
         {
            "resource_set_id":"<resource-set>",
            "current_key":{
               "key_id":"<clone-key-name>"
            },
            "transformation_key":{
               "key_id":"clear_key"
            }
         }
      ]
   }
   

   Example

   post /v1/transparent-encryption/policies
   {
      "name":"new-ldt-policy",
      "policy_type":"LDT",
      "never_deny":false,
      "security_rules":[
         {
            "effect":"permit,applykey",
            "action":"key_op"
         },
         {
            "effect":"permit,applykey,audit",
            "action":"all_ops",
            "partial_match":true
         }
      ],
      "ldt_key_rules":[
         {
            "resource_set_id":"",
            "current_key":{
               "key_id":"cloned-key"
            },
            "transformation_key":{
               "key_id":"clear_key"
            }
         }
      ]
   }
   

   A new LDT policy with the name new-ldt-policy is created.

5. Remove the LDT GuardPoint.

   Run the API

   patch /v1/transparent-encryption/clients/<client-name>/guardpoints/<GuardPoint-resource-id>/unguard/
   

   Example

   patch /v1/transparent-encryption/clients/ldt-client-name/guardpoints/a724ed5d-b5c5-45f3-8b8f-77ec3ec976d1/unguard
   

6. On the CTE client, remove the existing CTE-LDT attributes on the GuardPoint.

   Run the Command

   voradmin ldt attr delete <GuardPoint>
   

   Example

   voradmin ldt attr delete /ldt_path
   

   The LDT metadata has been removed from all files in the GuardPoint /ldt_path.

7. Create a new GuardPoint for the directory using the new policy.

   Run the API

   post /v1/transparent-encryption/clients/<client-name>/guardpoints
   

   Request Parameters

   {
       "guard_paths":["/<GuardPath>"],
       "guard_point_params":
       {
           "is_idt_capable_device":false,
           "guard_point_type":"directory_auto",
           "policy_id":"<new-ldt-policy-name>",
           "preserve_sparse_regions":true
       }
   }
   

   Example

   post /v1/transparent-encryption/clients/ldt-client-name/guardpoints
   {
       "guard_paths":["/ldt_path"],
       "guard_point_params":
       {
           "is_idt_capable_device":false,
           "guard_point_type":"directory_auto",
           "policy_id":"new-ldt-policy",
           "preserve_sparse_regions":true
       }
   }
   

8. Wait for the rekey to complete. You can check the rekey status, as described below.

   Run the API

   get /v1/transparent-encryption/clients/<client-name>/guardpoints
   

   Example

   get /v1/transparent-encryption/clients/ldt-client-name/guardpoints
   

   When the "rstatus" status becomes "Rekeyed", the rekey (decryption) is complete.

   Note

   • If you have selected directory_auto, data transformation begins as soon as the client gets the new policy information from the key manager.
   • If you have selected directory_manual, use the secfsd -guard <GuardPoint> command on the client to begin data transformation.

9. Remove the GuardPoint. This ensures rekey is no longer triggered for any new data added to the specified GuardPath.

   Run the API

   patch /v1/transparent-encryption/clients/<client-name>/guardpoints/<GuardPoint-resource-id>/unguard/
   

   Example

   patch /v1/transparent-encryption/clients/ldt-client-name/guardpoints/77ec9ec67d3-c5b5-435f-7b8f-a275de45e/unguard