Persistent Key Caching

The persistent key cache is a secure cache on the client’s disk that stores keys exported from the Key Manager. This cache is used when a key does not exist in the symmetric/asymmetric key cache. The key cache is not transferable between users. Symmetric and asymmetric keys can be cached in the persistent cache.

All versions other than the retired or wiped version of the key are cached in the persistent cache. Caching of EC keys in the persistent cache is not supported. If you in advance that your server will be unavailable for some time, you can pre-load keys to ensure that your persistent key cache will be populated when you need it. You can use the session.refreshCache("keyName") API to download the key to the persistent key store.

When a persistent cache file is created, the file name uses keycache_ as the prefix followed by the NAE username. For example, the cache name for user1 will be: keycache_user1. If the username contains upper case letters, those letters are preceded by #. For example, cache name for MyUser will be: keycache_#my#user.

Now, let's consider a scenario where a user, user1 is created within a domain, domain1. The username is specified as: domain1||user1

When a persistent cache file is created for a domain user, the | symbol is replaced with _. For example, the naming convention of the persistent cache file for the domain user, domain1||user1 will be: keycache_domain1__user1

Persistent key cache file can be shared in multiple NAE sessions in a single or multiple JVM instances. User must create a new persistent cache file if:

• CADP for Java provider version is upgraded from version 8.10.2 or lower.

• Java 7 is upgraded to Java 8, 10, 11, 12,14, 15, or 17.

How it works

The client uses the persistent cache to search for a key if it is not found in symmetric/asymmetric key cache. If the key is not found in persistent cache, the client connects to Key Manager for the key. The following scenarios describe how the persistent cache feature works:

Scenario 1: The key is not found in the persistent cache

The client attempts to connect to Key Manager, if the connection is successful and the key is found, the key is exported and stored in the persistent and the symmetric/asymmetric cache. If the key is not found or connection fails, the application throws an exception.

Scenario 2: The key is found in the persistent cache

If the key has expired in the persistent cache, the client tries to connect to the server. If the connection is successful, the key's information is updated in the persistent and the symmetric/asymmetric cache. If the connection is successful, but the key is not found on Key Manager, the key is deleted from the persistent cache. If the connection fails, the key's expiry time is updated to that of the next persistent cache expiry interval. The key is copied to the symmetric/asymmetric cache.

Note

When the client attempts to connect to Key Manager in the above scenarios, and if the connection fails; the existing key in the persistent cache is not deleted.

Related parameters

• Symmetric_Key_Cache_Enabled

• Asymmetric_Key_Cache_Enabled

• Symmetric_Key_Cache_Expiry

• Persistent_Cache_Enabled

• Persistent_Cache_Directory

• Persistent_Cache_Expiry_Keys

• Persistent_Cache_Max_Size