docs/images/happy_path_ik_cached.svg

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentScriptType="application/ecmascript" contentStyleType="text/css" height="532px" preserveAspectRatio="none" style="width:577px;height:532px;" version="1.1" viewBox="0 0 577 532" width="577px" zoomAndPan="magnify"><defs/><g><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="35" x2="35" y1="65.29" y2="339.1753"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="158.5" x2="158.5" y1="65.29" y2="339.1753"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="412" x2="412" y1="65.29" y2="339.1753"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="489" x2="489" y1="65.29" y2="339.1753"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="553" x2="553" y1="65.29" y2="339.1753"/><rect fill="#FEFECE" height="30.29" style="stroke: #A80036; stroke-width: 1.5;" width="54" x="8" y="34"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="40" x="15" y="54.3027">Caller</text><rect fill="#FEFECE" height="30.29" style="stroke: #A80036; stroke-width: 1.5;" width="54" x="8" y="338.1753"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="40" x="15" y="358.478">Caller</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="57" x="127.5" y="62.3027">Asherah</text><path d="M138.5,21 L138.5,45 M138.5,33 L155.5,33 " fill="none" style="stroke: #A80036; stroke-width: 2.0;"/><ellipse cx="167.5" cy="33" fill="#FEFECE" rx="12" ry="12" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="57" x="127.5" y="351.478">Asherah</text><path d="M138.5,358.4653 L138.5,382.4653 M138.5,370.4653 L155.5,370.4653 " fill="none" style="stroke: #A80036; stroke-width: 2.0;"/><ellipse cx="167.5" cy="370.4653" fill="#FEFECE" rx="12" ry="12" style="stroke: #A80036; stroke-width: 2.0;"/><rect fill="#FEFECE" height="30.29" style="stroke: #A80036; stroke-width: 1.5;" width="56" x="386" y="30"/><rect fill="#FEFECE" height="30.29" style="stroke: #A80036; stroke-width: 1.5;" width="56" x="382" y="34"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="42" x="389" y="54.3027">Cache</text><rect fill="#FEFECE" height="30.29" style="stroke: #A80036; stroke-width: 1.5;" width="56" x="386" y="338.1753"/><rect fill="#FEFECE" height="30.29" style="stroke: #A80036; stroke-width: 1.5;" width="56" x="382" y="342.1753"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="42" x="389" y="362.478">Cache</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="68" x="452" y="62.3027">Metastore</text><path d="M471,13 C471,3 489,3 489,3 C489,3 507,3 507,13 L507,39 C507,49 489,49 489,49 C489,49 471,49 471,39 L471,13 " fill="#FEFECE" style="stroke: #000000; stroke-width: 1.5;"/><path d="M471,13 C471,23 489,23 489,23 C489,23 507,23 507,13 " fill="none" style="stroke: #000000; stroke-width: 1.5;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="68" x="452" y="351.478">Metastore</text><path d="M471,364.4653 C471,354.4653 489,354.4653 489,354.4653 C489,354.4653 507,354.4653 507,364.4653 L507,390.4653 C507,400.4653 489,400.4653 489,400.4653 C489,400.4653 471,400.4653 471,390.4653 L471,364.4653 " fill="#FEFECE" style="stroke: #000000; stroke-width: 1.5;"/><path d="M471,364.4653 C471,374.4653 489,374.4653 489,374.4653 C489,374.4653 507,374.4653 507,364.4653 " fill="none" style="stroke: #000000; stroke-width: 1.5;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="29" x="536" y="62.3027">KMS</text><ellipse cx="553.5" cy="33" fill="#FEFECE" rx="12" ry="12" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="541.5" x2="565.5" y1="47" y2="47"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="29" x="536" y="351.478">KMS</text><ellipse cx="553.5" cy="370.4653" fill="#FEFECE" rx="12" ry="12" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="541.5" x2="565.5" y1="384.4653" y2="384.4653"/><polygon fill="#A80036" points="147,92.4165,157,96.4165,147,100.4165,151,96.4165" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="35" x2="153" y1="96.4165" y2="96.4165"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="100" x="42" y="91.6426">encrypt payload</text><polygon fill="#A80036" points="400,121.543,410,125.543,400,129.543,404,125.543" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="159" x2="406" y1="125.543" y2="125.543"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="229" x="166" y="120.769">get IK from protected memory cache</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="159" x2="201" y1="179.6694" y2="179.6694"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="201" x2="201" y1="179.6694" y2="192.6694"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="160" x2="201" y1="192.6694" y2="192.6694"/><polygon fill="#A80036" points="170,188.6694,160,192.6694,170,196.6694,166,192.6694" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="217" x="166" y="174.8955">generate DRK and encrypt using IK</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="159" x2="201" y1="221.7959" y2="221.7959"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="201" x2="201" y1="221.7959" y2="234.7959"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="160" x2="201" y1="234.7959" y2="234.7959"/><polygon fill="#A80036" points="170,230.7959,160,234.7959,170,238.7959,166,234.7959" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="173" x="166" y="217.022">use DRK to encrypt payload</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="159" x2="201" y1="279.0488" y2="279.0488"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="201" x2="201" y1="279.0488" y2="292.0488"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="160" x2="201" y1="292.0488" y2="292.0488"/><polygon fill="#A80036" points="170,288.0488,160,292.0488,170,296.0488,166,292.0488" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="171" x="166" y="259.1484">package encrypted payload</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="180" x="166" y="274.2749">with encrypted DRK in a DRR</text><polygon fill="#A80036" points="46,317.1753,36,321.1753,46,325.1753,42,321.1753" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="40" x2="158" y1="321.1753" y2="321.1753"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="68" x="52" y="316.4014">return DRR</text><rect fill="#DDDDDD" height="111.7402" rx="5" ry="5" style="stroke: #000000; stroke-width: 1.0;" width="301" x="11" y="409.4653"/><text fill="#000000" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="35" x="22" y="429.8022">Type</text><text fill="#000000" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="83" x="67" y="429.8022">Description</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="21" x="21" y="446.0581">MK</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="208" x="66" y="446.0581">Master Key, root key from KMS</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="17" x="21" y="462.3481">SK</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="197" x="66" y="462.3481">System Key, encrypted by MK</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="13" x="21" y="478.6382">IK</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="232" x="66" y="478.6382">Intermediate Key, encrypted by SK</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="28" x="21" y="494.9282">DRK</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="205" x="66" y="494.9282">Data Row Key, encrypted by IK</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="28" x="21" y="511.2183">DRR</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="236" x="66" y="511.2183">encrypted data and encrypted DRK</text><line style="stroke: #000000; stroke-width: 1.0;" x1="17" x2="306" y1="416.4653" y2="416.4653"/><line style="stroke: #000000; stroke-width: 1.0;" x1="17" x2="306" y1="432.7554" y2="432.7554"/><line style="stroke: #000000; stroke-width: 1.0;" x1="17" x2="306" y1="449.0454" y2="449.0454"/><line style="stroke: #000000; stroke-width: 1.0;" x1="17" x2="306" y1="465.3354" y2="465.3354"/><line style="stroke: #000000; stroke-width: 1.0;" x1="17" x2="306" y1="481.6255" y2="481.6255"/><line style="stroke: #000000; stroke-width: 1.0;" x1="17" x2="306" y1="497.9155" y2="497.9155"/><line style="stroke: #000000; stroke-width: 1.0;" x1="17" x2="306" y1="514.2056" y2="514.2056"/><line style="stroke: #000000; stroke-width: 1.0;" x1="17" x2="17" y1="416.4653" y2="514.2056"/><line style="stroke: #000000; stroke-width: 1.0;" x1="62" x2="62" y1="416.4653" y2="514.2056"/><line style="stroke: #000000; stroke-width: 1.0;" x1="306" x2="306" y1="416.4653" y2="514.2056"/><!--
@startuml

skinparam shadowing false

legend left
|= Type |= Description |
| MK | Master Key, root key from KMS |
| SK | System Key, encrypted by MK |
| IK | Intermediate Key, encrypted by SK |
| DRK | Data Row Key, encrypted by IK |
| DRR | encrypted data and encrypted DRK |
endlegend

participant Caller
boundary Asherah
collections Cache
database Metastore
entity KMS

Caller -> Asherah : encrypt payload
Asherah -> Cache : get IK from protected memory cache
|||
Asherah -> Asherah : generate DRK and encrypt using IK
Asherah -> Asherah : use DRK to encrypt payload
Asherah -> Asherah : package encrypted payload \nwith encrypted DRK in a DRR
Asherah -> Caller : return DRR

@enduml

PlantUML version 1.2018.05(Sat May 05 20:00:17 GMT 2018)
(GPL source distribution)
Java Runtime: Java(TM) SE Runtime Environment
JVM: Java HotSpot(TM) 64-Bit Server VM
Java Version: 1.8.0_161-b12
Operating System: Linux
OS Version: 4.9.125-linuxkit
Default Encoding: ANSI_X3.4-1968
Language: en
Country: US
--></g></svg>