Chapter 2. Encrypting Cluster Transport

1. The first node in the Data Grid cluster, the coordinator node, generates a secret key.
2. A joining node performs certificate authentication with the coordinator to mutually verify identity.
3. The joining node requests the secret key from the coordinator node. That request includes the public key for the joining node.
4. The coordinator node encrypts the secret key with the public key and returns it to the joining node.
5. The joining node decrypts and installs the secret key.
6. The node joins the cluster, encrypting and decrypting messages with the secret key.

1. Nodes install the secret key from a keystore on the Data Grid classpath at startup.
2. Node join clusters, encrypting and decrypting messages with the secret key.

Procedure

1. Create a keystore with certificate chains that enables Data Grid to verify node identity.

2. Place the keystore on the classpath for each node in the cluster.

   For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

3. Add the SSL_KEY_EXCHANGE and ASYM_ENCRYPT protocols to a JGroups stack in your Data Grid configuration, as in the following example:

   <infinispan>
       <jgroups>
            <stack name="encrypt-tcp" extends="tcp"> 1
              <SSL_KEY_EXCHANGE keystore_name="mykeystore.jks" 2
                                keystore_password="changeit" 3
                                stack.combine="INSERT_AFTER"
                                stack.position="VERIFY_SUSPECT"/> 4
              <ASYM_ENCRYPT asym_keylength="2048" 5
                       asym_algorithm="RSA" 6
                       change_key_on_coord_leave = "false" 7
                       change_key_on_leave = "false" 8
                       use_external_key_exchange = "true" 9
                       stack.combine="INSERT_AFTER"
                       stack.position="SSL_KEY_EXCHANGE"/> 10
            </stack>
       </jgroups>
       <cache-container name="default" statistics="true">
         <transport cluster="${infinispan.cluster.name}"
                    stack="encrypt-tcp" 11
                    node-name="${infinispan.node.name:}"/>
      </cache-container>
   </infinispan>

   1

   Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack for Data Grid.

   2

   Names the keystore that nodes use to perform certificate authentication.

   3

   Specifies the keystore password.

   4

   Uses the stack.combine and stack.position attributes to insert SSL_KEY_EXCHANGE into the default TCP stack after the VERIFY_SUSPECT protocol.

   5

   Specifies the length of the secret key that the coordinator node generates. The default value is 2048.

   6

   Specifies the cipher engine the coordinator node uses to generate secret keys. The default value is RSA.

   7

   Configures Data Grid to generate and distribute a new secret key when the coordinator node changes.

   8

   Configures Data Grid to generate and distribute a new secret key when nodes leave.

   9

   Configures Data Grid nodes to use the SSL_KEY_EXCHANGE protocol for certificate authentication.

   10

   Uses the stack.combine and stack.position attributes to insert ASYM_ENCRYPT into the default TCP stack after the SSL_KEY_EXCHANGE protocol.

   11

   Configures the Data Grid cluster to use the secure JGroups stack.

Procedure

1. Create a keystore that contains a secret key.

2. Place the keystore on the classpath for each node in the cluster.

   For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

3. Add the SYM_ENCRYPT protocol to a JGroups stack in your Data Grid configuration, as in the following example:

   <infinispan>
       <jgroups>
            <stack name="encrypt-tcp" extends="tcp"> 1
              <SYM_ENCRYPT keystore_name="myKeystore.p12" 2
                           keystore_type="PKCS12" 3
                           store_password="changeit" 4
                           key_password="changeit" 5
                           alias="myKey" 6
                           stack.combine="INSERT_AFTER"
                           stack.position="VERIFY_SUSPECT"/> 7
            </stack>
       </jgroups>
       <cache-container name="default" statistics="true">
         <transport cluster="${infinispan.cluster.name}"
                    stack="encrypt-tcp" 8
                    node-name="${infinispan.node.name:}"/>
      </cache-container>
   </infinispan>

   1

   Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack for Data Grid.

   2

   Names the keystore from which nodes obtain secret keys.

   3

   Specifies the keystore type. JGroups uses JCEKS by default.

   4

   Specifies the keystore password.

   5

   Specifies the secret key password.

   6

   Specifies the secret key alias.

   7

   Uses the stack.combine and stack.position attributes to insert SYM_ENCRYPT into the default TCP stack after the VERIFY_SUSPECT protocol.

   8

   Configures the Data Grid cluster to use the secure JGroups stack.