User Guide

The CipherTrust Application Data Protection for JAVA (CADP for Java) provides an interface for key management operations, as well as application-level encryption of sensitive data. The solution can protect both unstructured data types such as - Excel and PDF files and structured data types such as - credit card numbers, social security numbers, national ID numbers, and passwords. Encryption takes places as soon as the data is generated or first processed, and remains secure across its entire life-cycle.

General system architecture

The CADP for Java solution consists of two main components:

• CADP for Java Provider

  The CADP for Java Provider are the jar files and the properties files used for configuration. The CADP for Java Provider requires:

  • Java Virtual Machine (JVM) with support for SSL and Java Cryptographic Extensions (JCE).

  • Oracle Java version 8 (minimum 1.8.0_111), 10, 11 (including OpenJDK and Amazon Corretto), 12 (including OpenJDK and Azul Java), 14 (including OpenJDK), 15 (including OpenJDK), 17 (including OpenJDK), 19 (including OpenJDK), 21 (including OpenJDK) or IBM Java 8 (minimum 8.0.6.25).

• Key Manager

  The CADP for Java is compatible with CipherTrust Manager 2.11.1 and higher versions.

Install the CADP for Java Provider on all the back-end servers that will be making requests for cryptographic operations or key management. All applications, servlets, or scripts see a conventional JCE interface and issue simple Java–based (JCE) commands to the Key Manager to perform cryptographic operations. Our CADP for Java provider is not dependent on the underlying back-end server.

Cryptography support

CADP for Java enables your Java client to perform cryptographic operations either by requesting that operations be performed on the Key Manager (remote mode) or by caching keys on the client and performing crypto locally (local mode).

• Remote Mode: The CADP for Java Provider sends the crypto request over your network to the Key Manager using either tcp or ssl protocol. The Key Manager checks for proper authorization, performs the cryptographic operation, and returns the data to the calling application. Remote crypto mode creates an extremely simple, scalable, and secure solution to the challenges of back-end data encryption, integrity checking, and fingerprinting. To minimize the performance impact of remote operations, the provider uses long-lived and configurable sessions with the Key Manager. Connection pools are created for each session, so your application can have multiple connection pools. As a result, very low latencies and high throughputs can be achieved.

• Local Mode: The CADP for Java Provider authenticates to the Key Manager, exports, and then stores a key - either in process memory or on disk, for a limited time. Cryptography is performed by the local JCE provider (typically SunJCE). This solution may be ideal for secured clients when network latency is a high, or when local encryption speeds meet performance requirements.

Supported cryptographic operations

• Encryption/Decryption

• Sign/SignVerify

• MAC/MACVerify

Key management support

CADP for Java operates over any of these protocols:

• NAE-XML: A flavor of XML specific to the Key Manager

• KMIP: The OASIS Key Management Interoperability Protocol, supported by Key Manager

Key management using NAE-XML

The Key Manager is pre-configured for the NAE-XML protocol. When KMIP is not configured, management requests, like key create, export, and delete calls, occur over the NAEXML protocol. To perform key management over NAE-XML, configure NAE_Port in the CADP_for_JAVA.properties file and use the APIs prefaced with NAE such as NAEKey, NAECertificate.

Key management using KMIP

Key Manager can be configured as KMIP servers, so the CADP for Java client can operate with these servers. CADP for Java offers support for the following KMIP features:

• Managed Objects such as Symmetric Keys, Asymmetric Keys, Secret Data, Templates, and Certificates

• Operations such as Create, Register, Export/Get, Delete, and Manage Lifecycle

• Attributes

• Multiple Operations

Services offered