이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 2. Encrypting Cluster Transport


Secure cluster transport so that nodes communicate with encrypted messages. You can also configure Data Grid clusters to perform certificate authentication so that only nodes with valid identities can join.

2.1. Data Grid Cluster Security

To secure cluster traffic, you configure Data Grid nodes to encrypt JGroups message payloads with secret keys.

Data Grid nodes can obtain secret keys from either:

  • The coordinator node (asymmetric encryption).
  • A shared keystore (symmetric encryption).

Retrieving secret keys from coordinator nodes

You configure asymmetric encryption by adding the ASYM_ENCRYPT protocol to a JGroups stack in your Data Grid configuration. This allows Data Grid clusters to generate and distribute secret keys.

Important

When using asymmetric encryption, you should also provide keystores so that nodes can perform certificate authentication and securely exchange secret keys. This protects your cluster from man-in-the-middle (MitM) attacks.

Asymmetric encryption secures cluster traffic as follows:

  1. The first node in the Data Grid cluster, the coordinator node, generates a secret key.
  2. A joining node performs certificate authentication with the coordinator to mutually verify identity.
  3. The joining node requests the secret key from the coordinator node. That request includes the public key for the joining node.
  4. The coordinator node encrypts the secret key with the public key and returns it to the joining node.
  5. The joining node decrypts and installs the secret key.
  6. The node joins the cluster, encrypting and decrypting messages with the secret key.

Retrieving secret keys from shared keystores

You configure symmetric encryption by adding the SYM_ENCRYPT protocol to a JGroups stack in your Data Grid configuration. This allows Data Grid clusters to obtain secret keys from keystores that you provide.

  1. Nodes install the secret key from a keystore on the Data Grid classpath at startup.
  2. Node join clusters, encrypting and decrypting messages with the secret key.

Comparison of asymmetric and symmetric encryption

ASYM_ENCRYPT with certificate authentication provides an additional layer of encryption in comparison with SYM_ENCRYPT. You provide keystores that encrypt the requests to coordinator nodes for the secret key. Data Grid automatically generates that secret key and handles cluster traffic, while letting you specify when to generate secret keys. For example, you can configure clusters to generate new secret keys when nodes leave. This ensures that nodes cannot bypass certificate authentication and join with old keys.

SYM_ENCRYPT, on the other hand, is faster than ASYM_ENCRYPT because nodes do not need to exchange keys with the cluster coordinator. A potential drawback to SYM_ENCRYPT is that there is no configuration to automatically generate new secret keys when cluster membership changes. Users are responsible for generating and distributing the secret keys that nodes use to encrypt cluster traffic.

2.2. Configuring Cluster Transport with Asymmetric Encryption

Configure Data Grid clusters to generate and distribute secret keys that encrypt JGroups messages.

Procedure

  1. Create a keystore with certificate chains that enables Data Grid to verify node identity.
  2. Place the keystore on the classpath for each node in the cluster.

    For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

  3. Add the SSL_KEY_EXCHANGE and ASYM_ENCRYPT protocols to a JGroups stack in your Data Grid configuration, as in the following example:

    <infinispan>
        <jgroups>
             <stack name="encrypt-tcp" extends="tcp"> 1
               <SSL_KEY_EXCHANGE keystore_name="mykeystore.jks" 2
                                 keystore_password="changeit" 3
                                 stack.combine="INSERT_AFTER"
                                 stack.position="VERIFY_SUSPECT"/> 4
               <ASYM_ENCRYPT asym_keylength="2048" 5
                        asym_algorithm="RSA" 6
                        change_key_on_coord_leave = "false" 7
                        change_key_on_leave = "false" 8
                        use_external_key_exchange = "true" 9
                        stack.combine="INSERT_AFTER"
                        stack.position="SSL_KEY_EXCHANGE"/> 10
             </stack>
        </jgroups>
        <cache-container name="default" statistics="true">
          <transport cluster="${infinispan.cluster.name}"
                     stack="encrypt-tcp" 11
                     node-name="${infinispan.node.name:}"/>
       </cache-container>
    </infinispan>
    1
    Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack for Data Grid.
    2
    Names the keystore that nodes use to perform certificate authentication.
    3
    Specifies the keystore password.
    4
    Uses the stack.combine and stack.position attributes to insert SSL_KEY_EXCHANGE into the default TCP stack after the VERIFY_SUSPECT protocol.
    5
    Specifies the length of the secret key that the coordinator node generates. The default value is 2048.
    6
    Specifies the cipher engine the coordinator node uses to generate secret keys. The default value is RSA.
    7
    Configures Data Grid to generate and distribute a new secret key when the coordinator node changes.
    8
    Configures Data Grid to generate and distribute a new secret key when nodes leave.
    9
    Configures Data Grid nodes to use the SSL_KEY_EXCHANGE protocol for certificate authentication.
    10
    Uses the stack.combine and stack.position attributes to insert ASYM_ENCRYPT into the default TCP stack after the SSL_KEY_EXCHANGE protocol.
    11
    Configures the Data Grid cluster to use the secure JGroups stack.

Verification

When you start your Data Grid cluster, the following log message indicates that the cluster is using the secure JGroups stack:

[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack <encrypted_stack_name>

Data Grid nodes can join the cluster only if they use ASYM_ENCRYPT and can obtain the secret key from the coordinator node. Otherwise the following message is written to Data Grid logs:

[org.jgroups.protocols.ASYM_ENCRYPT] <hostname>: received message without encrypt header from <hostname>; dropping it

Reference

The example ASYM_ENCRYPT configuration in this procedure shows commonly used parameters. Refer to JGroups documentation for the full set of available parameters.

2.3. Configuring Cluster Transport with Symmetric Encryption

Configure Data Grid clusters to encrypt JGroups messages with secret keys from keystores that you provide.

Procedure

  1. Create a keystore that contains a secret key.
  2. Place the keystore on the classpath for each node in the cluster.

    For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

  3. Add the SYM_ENCRYPT protocol to a JGroups stack in your Data Grid configuration, as in the following example:

    <infinispan>
        <jgroups>
             <stack name="encrypt-tcp" extends="tcp"> 1
               <SYM_ENCRYPT keystore_name="myKeystore.p12" 2
                            keystore_type="PKCS12" 3
                            store_password="changeit" 4
                            key_password="changeit" 5
                            alias="myKey" 6
                            stack.combine="INSERT_AFTER"
                            stack.position="VERIFY_SUSPECT"/> 7
             </stack>
        </jgroups>
        <cache-container name="default" statistics="true">
          <transport cluster="${infinispan.cluster.name}"
                     stack="encrypt-tcp" 8
                     node-name="${infinispan.node.name:}"/>
       </cache-container>
    </infinispan>
    1
    Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack for Data Grid.
    2
    Names the keystore from which nodes obtain secret keys.
    3
    Specifies the keystore type. JGroups uses JCEKS by default.
    4
    Specifies the keystore password.
    5
    Specifies the secret key password.
    6
    Specifies the secret key alias.
    7
    Uses the stack.combine and stack.position attributes to insert SYM_ENCRYPT into the default TCP stack after the VERIFY_SUSPECT protocol.
    8
    Configures the Data Grid cluster to use the secure JGroups stack.

Verification

When you start your Data Grid cluster, the following log message indicates that the cluster is using the secure JGroups stack:

[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack <encrypted_stack_name>

Data Grid nodes can join the cluster only if they use SYM_ENCRYPT and can obtain the secret key from the shared keystore. Otherwise the following message is written to Data Grid logs:

[org.jgroups.protocols.SYM_ENCRYPT] <hostname>: received message without encrypt header from <hostname>; dropping it

Reference

The example SYM_ENCRYPT configuration in this procedure shows commonly used parameters. Refer to JGroups documentation for the full set of available parameters.

Red Hat logoGithubRedditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

© 2024 Red Hat, Inc.