Chapter 2. Encrypting Cluster Transport

1. The first node in the Data Grid cluster, the coordinator node, generates a secret key.
2. A joining node performs certificate authentication with the coordinator to mutually verify identity.
3. The joining node requests the secret key from the coordinator node. That request includes the public key for the joining node.
4. The coordinator node encrypts the secret key with the public key and returns it to the joining node.
5. The joining node decrypts and installs the secret key.
6. The node joins the cluster, encrypting and decrypting messages with the secret key.

1. Nodes install the secret key from a keystore on the Data Grid classpath at startup.
2. Node join clusters, encrypting and decrypting messages with the secret key.

Procedure

1. Create a keystore with certificate chains that enables Data Grid to verify node identity.

2. Place the keystore on the classpath for each node in the cluster.

   For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

3. Add the SSL_KEY_EXCHANGE and ASYM_ENCRYPT protocols to a JGroups stack in your Data Grid configuration, as in the following example:

   <infinispan>
     <jgroups>
       <!-- Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack. -->
       <stack name="encrypt-tcp" extends="tcp">
         <!-- Adds a keystore that nodes use to perform certificate authentication. -->
         <!-- Uses the stack.combine and stack.position attributes to insert SSL_KEY_EXCHANGE into the default TCP stack after VERIFY_SUSPECT. -->
         <SSL_KEY_EXCHANGE keystore_name="mykeystore.jks"
                           keystore_password="changeit"
                           stack.combine="INSERT_AFTER"
                           stack.position="VERIFY_SUSPECT"/>
         <!-- Configures ASYM_ENCRYPT -->
         <!-- Uses the stack.combine and stack.position attributes to insert ASYM_ENCRYPT into the default TCP stack before pbcast.NAKACK2. -->
         <!-- The use_external_key_exchange = "true" attribute configures nodes to use the `SSL_KEY_EXCHANGE` protocol for certificate authentication. -->
         <ASYM_ENCRYPT asym_keylength="2048"
                       asym_algorithm="RSA"
                       change_key_on_coord_leave = "false"
                       change_key_on_leave = "false"
                       use_external_key_exchange = "true"
                       stack.combine="INSERT_BEFORE"
                       stack.position="pbcast.NAKACK2"/>
       </stack>
     </jgroups>
     <cache-container name="default" statistics="true">
       <!-- Configures the cluster to use the JGroups stack. -->
       <transport cluster="${infinispan.cluster.name}"
                  stack="encrypt-tcp"
                  node-name="${infinispan.node.name:}"/>
     </cache-container>
   </infinispan>

Procedure

1. Create a keystore that contains a secret key.

2. Place the keystore on the classpath for each node in the cluster.

   For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

3. Add the SYM_ENCRYPT protocol to a JGroups stack in your Data Grid configuration.