How to Run a Demo

A full demo environment is provided to allow you test drive DPG, see how it is installed, and use its features to protect sensitive data using a Helm Chart.

With this demo, we also provide a Sample Application Server to experience end to end DPG functionalities.

Sample Application Details

Supported API URL: /api/sample/resource/{id}

Supported Methods

• POST Method: Allows you add any data (irrespective of structure) in JSON format based on {id}. This method returns the same JSON body in response. The JSON body is saved in the internal cache of the APPlication Server.

• GET Method: Allows you to fetch data for a given {id}.

• PATCH Method: Allows you to modify the entire JSON body for a given {id}.

• DELETE Method: Allows you to delete the entry for a given {id}.

Prerequisites

• A Kubernetes environment is deployed and working.

• Helm is installed. Refer to https://helm.sh/docs/intro/install/ for details.

• Your Kubernetes environment and orchestrator has access to the ciphertrust-data-protection-gateway repository. For any repositories related issue, contact dpg.admin@thalesgroup.com.

  This repository contains the following images:

  • DPG (with latest tag): thalesgroup/ciphertrust-data-protection-gateway:latest

  • Sample Application Server (with appserver tag): thalesgroup/ciphertrust-data-protection-gateway:appserver

• CipherTrust Manager is installed. Refer to CipherTrust Manager Deployment for details.

Deploy Demo Environment using Helm Charts

Deploy Application Server

1. Create a namespace for your deployment, for example, myspace.

   kubectl create namespace myspace

2. Configure current-context by updating your local kubeconfig file.

   aws eks --region <aws_region> update-kubeconfig --name <dpg-cluster_name> -n myspace

3. Download and copy the following files:

   • deployment.yaml to <target_directory>\templates.

   • values.yaml to <target_directory>.

   • Chart.yaml to <target_directory>.

   Note

   To download the files, right-click each link and click Save Link As.

4. Navigate to the <target_directory>.

5. Install Sample APPlication Server in your namespace. For this demo, we will use dpgdemo as the Helm release name.

   helm install dpgdemo . -n myspace

   The status DEPLOYED indicates the installation is successful.

6. Verify the deployment with the following command.

   helm list -n myspace

   The output should list the deployed Helm releases, dpgdemo.

   The Sample Application Server is deployed successfully and ready to use.

Test Drive Sample Application Server

Post Request

Syntax

<Method> <Request URL> <Header name> <Header value> <JSON Body>

Request Parameters

Sample Request

The value of {id} should be unique.

http://<instanceip>:32082/api/sample/resource/{id}
{
"ssn": "123-45-6789",
"creditAccount": "123456789",
"creditCard":[ 
  {
    "number": "5252-5252-5252-5252",
    "cvv": "111",
    "expiry": "03/24"
    }
              ]
}       

Sample Response

{
"ssn": "123-45-6789",
"creditAccount": "123456789",
"creditCard":[ 
  {
    "number": "5252-5252-5252-5252",
    "cvv": "111",
    "expiry": "03/24"
    }
              ]
}       

In the above sample, the Sample Application Server returned the original data without modifying it.

Create Policies, Configurations, Registration Token on the CipherTrust Manager

Before deploying DPG, ensure that the following steps are performed from the CipherTrust Manager.

1. Create character sets

2. Create protection policies

3. Create DPG policy

4. Create application

To do so, use any of these options:

• CipherTrust Manager UI

• CipherTrust Manager API Playground

Deploy DPG

1. Download and replace the following files:

   • deployment.yaml to <target_directory>\templates.

   • values.yaml to <target_directory>.

   Note

   • These files contain the references of both Sample Application Server and DPG.

   • To download the files, right-click each link and click Save Link As.

2. Navigate to the <target_directory>and run the following command to upgrade the deployment :

   helm upgrade dpgdemo . -n myspace

Test Drive DPG

Post Request

Syntax

<Method> <Request URL> <Header name> <Header value> <JSON Body>

Request Parameters

Sample Request

http://<instanceip>:32082/api/sample/resource/{id}
{

"ssn": "123-45-6789",
"creditAccount": "123456789",
"creditCard":[ 
  {

    "number": "5252-5252-5252-5252",
    "cvv": "111",
    "expiry": "03/24"

    }
              ]
}       

Sample Response

{
"creditAccount": "123456789",
"creditCard": [
  {
"cvv": "200010163",
"expiry": "03/24",
"number": "5252-5252-5252-5252"
}
],
"ssn": "123-45-6789"
}       

In this sample, DPG is protecting the CVV number (111) in the post request and returns ciphertext (200010163). Here, first six digits are the policy header.

Get Request

Syntax

<Method> <Request URL>

Request Parameters

Sample Request

http://<instanceip>:32082/api/sample/resource/{id}

Sample Response

{
"creditAccount": "123456789",
"creditCard": [
  {
"cvv": "111",
"expiry": "03/24",
"number": "5252-5252-5252-5252"
}
],
"ssn": "123-45-6789"
}       

In this sample, DPG is revealing the CVV number (111) in the get request.