How to Run a Demo

A full demo environment is provided to allow you test drive DPG, see how it is installed, and use its features to protect sensitive data using a Helm Chart.

With this demo, we also provide a Sample Application Server to experience end to end DPG functionalities.

Sample Application Details

Supported API URL: /api/sample/resource/{id}

Supported Methods

• POST Method: Allows you add any data (irrespective of structure) in JSON format based on {id}. This method returns the same JSON body in response. The JSON body is saved in the internal cache of the APPlication Server.

• GET Method: Allows you to fetch data for a given {id}.

• PATCH Method: Allows you to modify the entire JSON body for a given {id}.

• DELETE Method: Allows you to delete the entry for a given {id}.

Prerequisites

• A Kubernetes environment is deployed and working.

• Helm is installed. Refer to https://helm.sh/docs/intro/install/ for details.

• CipherTrust Manager is up and running. Refer to CipherTrust Manager Deployment for details.

DPG Image Repository

The ciphertrust-data-protection-gateway repository contains the following images for DPG 1.3.0:

• DPG (with 1.3.0 tag): thalesciphertrust/ciphertrust-data-protection-gateway:1.3.0

• DPG (with latest tag): thalesciphertrust/ciphertrust-data-protection-gateway:latest

  The image path with the latest tag always points to the latest release.

• Sample Application Server (with appserver tag): thalesciphertrust/ciphertrust-data-protection-gateway:appserver

Deploy Demo Environment using Helm Charts on AWS

Deploy Application Server

1. Create a namespace for your deployment, for example, myspace.

   kubectl create namespace <myspace>

2. Configure current-context by updating your local kubeconfig file.

   aws eks --region <aws_region> update-kubeconfig --name <dpg-cluster_name> -n myspace

3. Download and copy the following files:

   • deployment.yaml to <target_directory>/templates.

   • values.yaml to <target_directory>.

   • Chart.yaml to <target_directory>.

   Note

   To download the files, right-click each link and click Save Link As.

4. Navigate to the <target_directory>.

5. Install Sample APPlication Server in your namespace. For this demo, we will use dpgdemo as the Helm release name.

   helm install dpgdemo . -n myspace

   The status DEPLOYED indicates the installation is successful.

6. Verify the deployment with the following command.

   helm list -n myspace

   The output should list the deployed Helm releases, dpgdemo.

   The Sample Application Server is deployed successfully and ready to use.

Test Drive Sample Application Server

Post Request

Syntax

<Method> <Request URL> <Header name> <Header value> <JSON Body>

Request Parameters

Sample Request

The value of {id} should be unique.

http://<instanceip>:32082/api/sample/resource/{id}
{
"ssn": "123-45-6789",
"creditAccount": "123456789",
"creditCard":[ 
  {
    "number": "5252-5252-5252-5252",
    "cvv": "111",
    "expiry": "03/24"
    }
              ]
}       

Sample Response

{
"ssn": "123-45-6789",
"creditAccount": "123456789",
"creditCard":[ 
  {
    "number": "5252-5252-5252-5252",
    "cvv": "111",
    "expiry": "03/24"
    }
              ]
}       

In the above sample, the Sample Application Server returned the original data without modifying it.

Create Policies, Configurations, Registration Token on the CipherTrust Manager

Before deploying DPG, ensure that the following steps are performed from the CipherTrust Manager UI.

1. Create Character Set

2. Create User Set

3. Create Masking Format

4. Create Access Policy

5. Create Protection Policy

6. Create DPG Policy

7. Define Application

The detailed instructions are available in the Application Data Protection Admin Guide. You can also perform these steps though the CipherTrust Manager's RESTful API. Refer to CipherTrust Manager API Playground for detailed instructions.

Deploy DPG

1. Download and replace the following files:

   • deployment.yaml to <target_directory>/templates

   • values.yaml to <target_directory>

   Note

   • These files contain the references of both Sample Application Server and DPG.

   • To download the files, right-click each link and click Save Link As.

   • The servercrt and serverkey parameters of the values.yaml file are required only when TLS_ENABLEDis set to true.

2. Update the values of kms and reg_token fields in the values.yaml file.

   Here,

   • KMS is the IP address of your CipherTrust Manager instance.

   • reg_token is the token generated on the CipherTrust Manager while defining Applications. This token is used to register DPG clients on the CipherTrust Manager.

3. Navigate to the <target_directory> and run the following command to upgrade the deployment:

   helm upgrade dpgdemo . -n myspace

Test Drive DPG

Post Request

Syntax

<Method> <Request URL> <Header name> <Header value> <JSON Body>

Request Parameters

Sample Request

http://<instanceip>:32082/api/sample/resource/{id}
{

"ssn": "123-45-6789",
"creditAccount": "123456789",
"creditCard":[ 
  {

    "number": "5252-5252-5252-5252",
    "cvv": "111",
    "expiry": "03/24"

    }
              ]
}       

Sample Response

{
"creditAccount": "123456789",
"creditCard": [
  {
"cvv": "1001000163",
"expiry": "03/24",
"number": "5252-5252-5252-5252"
}
],
"ssn": "123-45-6789"
}       

In this sample, DPG is protecting the CVV number (111) in the post request and returns ciphertext (1001000163). Here, first seven digits represent the version header bytes.

Get Request

Syntax

<Method> <Request URL>

Request Parameters

Sample Request using Curl

You can use any of the supported authentication methods to send request to DPG. For this demo, we are using Basic authentication scheme.

Sample Request

curl --user <username>:<password> http://<instanceip>:32082/api/sample/resource/{id}

Sample Response

{
"creditAccount": "123456789",
"creditCard": [
  {
"cvv": "111",
"expiry": "03/24",
"number": "5252-5252-5252-5252"
}
],
"ssn": "123-45-6789"
}       

DPG takes the following parameters into account while revealing the data:

• Protection Policy: Determines how to protect and reveal data. It comprises of key, cipher, access policy, and character set needed to protect/reveal data.

• User: Username in the authorization header.

If the user in the authorization header is not part of any user set or authorization header is not specified, the access policy uses the default format to reveal data.

In this sample, DPG is revealing the data as plaintext, that is 111.