/hazelcast-documentation/src/main/docbook/manual/content/network/Encryption.xml

https://bitbucket.org/gabral6_gmailcom/hazelcast · XML · 136 lines · 87 code · 10 blank · 39 comment · 0 complexity · ebbfe7878611df3fc8a7caacca67fbaa MD5 · raw file

  1. <?xml version='1.0' encoding='UTF-8'?>
  2. <!--
  3. ~ Copyright (c) 2008-2013, Hazelcast, Inc. All Rights Reserved.
  4. ~
  5. ~ Licensed under the Apache License, Version 2.0 (the "License");
  6. ~ you may not use this file except in compliance with the License.
  7. ~ You may obtain a copy of the License at
  8. ~
  9. ~ http://www.apache.org/licenses/LICENSE-2.0
  10. ~
  11. ~ Unless required by applicable law or agreed to in writing, software
  12. ~ distributed under the License is distributed on an "AS IS" BASIS,
  13. ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14. ~ See the License for the specific language governing permissions and
  15. ~ limitations under the License.
  16. -->
  17. <sect2 xml:id="Encryption" version='5.0' xmlns='http://docbook.org/ns/docbook'
  18. xmlns:xi="http://www.w3.org/2001/XInclude"
  19. xmlns:xlink="http://www.w3.org/1999/xlink"
  20. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  21. xsi:schemaLocation="http://docbook.org/ns/docbook http://www.docbook.org/xml/5.0/xsd/docbook.xsd
  22. http://www.w3.org/1999/xlink http://www.w3.org/1999/xlink.xsd">
  23. <title>Encryption</title>
  24. <para>
  25. Hazelcast allows you to encrypt entire socket level communication among all Hazelcast
  26. members. Encryption is based on
  27. <link xlink:href="http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/CryptoSpec.html">Java
  28. Cryptography Architecture
  29. </link>
  30. and both symmetric and asymmetric encryption are supported.
  31. In symmetric encryption, each node uses the same key, so the key is shared.
  32. Here is a sample configuration for symmetric encryption:
  33. <programlisting language="xml"><![CDATA[<hazelcast>
  34. ...
  35. <network>
  36. ...
  37. <!--
  38. Make sure to set enabled=true
  39. Make sure this configuration is exactly the same on
  40. all members
  41. -->
  42. <symmetric-encryption enabled="true">
  43. <!--
  44. encryption algorithm such as
  45. DES/ECB/PKCS5Padding,
  46. PBEWithMD5AndDES,
  47. Blowfish,
  48. DESede
  49. -->
  50. <algorithm>PBEWithMD5AndDES</algorithm>
  51. <!-- salt value to use when generating the secret key -->
  52. <salt>thesalt</salt>
  53. <!-- pass phrase to use when generating the secret key -->
  54. <password>thepass</password>
  55. <!-- iteration count to use when generating the secret key -->
  56. <iteration-count>19</iteration-count>
  57. </symmetric-encryption>
  58. </network>
  59. ...
  60. </hazelcast>
  61. ]]></programlisting>
  62. In asymmetric encryption, public and private key pair is used. Data is encrypted with
  63. one of these keys and decrypted with the other.
  64. The idea is that each node has to have its own private key and other trusted members'
  65. public key. So that means, for each member, we should do the followings:
  66. <itemizedlist>
  67. <listitem>
  68. <para>Pick a unique name for the member. We will use the name as the key alias. Let's name them as member1,
  69. member2...memberN.
  70. </para>
  71. </listitem>
  72. <listitem>
  73. <para>Generate the keystore and the private key for the member1.
  74. <literal>keytool -genkey -alias member1 -keyalg RSA -keypass thekeypass -keystore keystore -storetype
  75. JKS
  76. </literal>
  77. Remember all the parameters you used here because you will need this information when
  78. you configure asymmetric-encryption in your hazelcast.xml file.
  79. </para>
  80. </listitem>
  81. <listitem>
  82. <para>Create a public certificate file so that we can add it to the other members' keystore
  83. <literal>keytool -export -alias member1 -keypass thekeypass -storepass thestorepass -keystore keystore
  84. -rfc -file member1.cer
  85. </literal>
  86. </para>
  87. </listitem>
  88. <listitem>
  89. <para>Now take all the other members' public certificates, and add (import) them into member1's keystore
  90. <programlisting language="java"><![CDATA[ keytool -import -alias member2 -file member2.cer -keystore keystore -storepass thestorepass
  91. keytool -import -alias member3 -file member3.cer -keystore keystore -storepass thestorepass
  92. ...
  93. keytool -import -alias memberN -file memberN.cer -keystore keystore -storepass thestorepass
  94. ]]></programlisting>
  95. </para>
  96. </listitem>
  97. </itemizedlist>
  98. You should repeat these steps for each trusted member in your cluster.
  99. Here is a sample configuration for asymmetric encryption:
  100. <programlisting language="xml"><![CDATA[<hazelcast>
  101. ...
  102. <network>
  103. ...
  104. <!--
  105. Make sure to set enabled=true
  106. -->
  107. <asymmetric-encryption enabled="true">
  108. <!-- encryption algorithm -->
  109. <algorithm>RSA/NONE/PKCS1PADDING</algorithm>
  110. <!-- private key password -->
  111. <keyPassword>thekeypass</keyPassword>
  112. <!-- private key alias -->
  113. <keyAlias>member1</keyAlias>
  114. <!-- key store type -->
  115. <storeType>JKS</storeType>
  116. <!-- key store password -->
  117. <storePassword>thestorepass</storePassword>
  118. <!-- path to the key store -->
  119. <storePath>keystore</storePath>
  120. </asymmetric-encryption>
  121. </network>
  122. ...
  123. </hazelcast>
  124. ]]></programlisting>
  125. </para>
  126. </sect2>