Include the URL of your launchpad blueprint:
This effort will enhance Barbican by adding a crypto plugin to allow use of Atalla ESKM from HP. Atalla ESKM is a HSM appliance for generating and managing cryptographic keys. By adding an optional plugin to Barbican, users have the option of integrating OpenStack with existing or new Atalla ESKM installations.
Deployers of an OpenStack cloud may have, or wish to have an Atalla ESKM Appliance for key management. In this case, it is desirable to utilise the appliance alongside the new OpenStack installation for enhanced security.
The proposed changes to Barbican are, creation of an optional plugin to talk to an ESKM appliance. This plugin will be based of off the CryptoPlugin base and encapsulate all necessary functionality. The plugin will communicate over a secure network link to a remote appliance using a vendor specific protocol.
No changes to the core of Barbican are required.
Alternatively, Atalla ESKM supports the KMIP industry standard protocol for key exchange. KMIP is something planned for Barbican in the future but at the time of writing has not yet been implemented.
This change touches sensitive data (tokens, keys, and user data) since it will pass key data through to an ESKM server and receive the results prior to encryption. User data is protected using a key encryption key and 256 bit AES CBC encryption. The key encryption key is never stored and is fetched on demand from the ESKM appliance.
This change utilises encryption algorithms from the ‘cryptography’ python module but does not introduce any additional cryptographic dependencies into Barbican.
This change requires a network connection to be established between Barbican and an ESKM appliance. This connection is protected using TLSv1 and client identification certificates. Key material is transmitted over this connection.
A performance impact is introduced by this change, communication over a network link to a remote ESKM appliance may take time. This is multiplied by the need to request a key encryption key from ESKM as part of all requests. This performance impact is accepted in return for the improved security gained by not caching the key encryption key locally.
The following new config options are added, they are specific to the plugin and need not be used otherwise. All options live within the ‘eskm_crypto_plugin’ group.
|eskm_crypto_plugin.crt_file_path||ESKM client certificate file path.|
|eskm_crypto_plugin.key_file_path||ESKM client key file.|
|eskm_crypto_plugin.key_password||ESKM client key password.|
|eskm_crypto_plugin.user_name||ESKM user name.|
|eskm_crypto_plugin.user_pass||ESKM user password.|
|eskm_crypto_plugin.eskm_host||ESKM host IPs, comma separated.|
|eskm_crypto_plugin.eskm_port||ESKM port number.|
No compulsory dependencies are introduced, but an Atalla ESKM appliance must be available if a deployer wishes to use this plugin.
A suite of unit tests will be produced to test the new code.
Documentation may need updating to reflect the existence of the plugin and its configuration options.