Running into a possible situation where a client I am working with is requesting that all data that leaves the servers should be encrypted and here, we are talking of hundreds of Linux servers spanning across data centers and also includes public and private cloud offerings.

I understand IPSec based tunnels could have worked had we talked about a handful of servers but here, I have failed at finding a solution that is easy to scale and deploy, something that doesn't warrant changes to applications.

I have looked at tcpcrypt and have searched the web looking for proprietary offerings(TLS based) if they fit the use case - looked at CipherCloud, Safenet and CertesNetworks but I doubt if any of the offerings fit the requirement. Many offerings talk of gateway based encryption but that leaves data over local network unencrypted.

Is there a solution that quite literally fits the task? (or am I trying to bite more than I can chew?)

  • It might be helpful to know why each and every stream of traffic needs to be encrypted at the server level. Is it web traffic? What kinds of applications are involved (custom, COTS)? Can the data be encrypted and sent over non-encrypted channels? You talk about what you can't find, but you don't define the requirements. – schroeder Mar 10 '15 at 5:34
  • Step 1: define the data classification of the data being sent. Step 2: define appropriate protections for each data classification. Step 3: now find out where you need to encrypt. It's doubtful that everything needs to be encrypted. – schroeder Mar 10 '15 at 5:35
  • @schroeder I questioned the same thing but looks like the client is skeptical as "cloud" is involved. The applications are more or less custom. And about the transfer of data, since cloud providers will be involved, the encrypted data will be sent over internet to other end(which could be a different cloud provider or on-premises server) where the data has to be decrypted before it hits another application/database. – Prasoon Mar 10 '15 at 5:59

Just remember the fact that 'end to end' encryption doesn't necessary mean that every single link needs to be encrypted.

E.g. Payment request is encrypted in client browser using app-3 public key. Corresponding private key resides in a HSM.

Client Browser (encrypted payload) -> reverse proxy -> web -> app1 -> app2 -> app3

Payload is decrypted in app3 using HSM. If this is what the client needs to protect, you can literally leave everything in the path in the clear and the data is still safe.

So ask your client where are the important exit points of the data where encryption should be enforced.

  • Assuming we are talking of app server and database here, the client is concerned that any data that goes out of app server destined to the database(on a different network) is encrypted as the data leaves the server. – Prasoon Mar 10 '15 at 8:31
  • In that case, databases like MSSQL can use SSL, so all database queries 'leaving' the server for the SQL server is encrypted. Even if someone SPANs a network port and capture all traffic in wireshark, they will not be able to see what your app server is writing to the database. This would have satisfied their requirement of end-to-end encryption of the data. However, if customer is really looking at layered encryption, then it is a whole different thing. – Ken Mar 10 '15 at 8:40
  • Did not know that MSSQL could use SSL in an isolated way. I think the client is interested in a solution that is agnostic of "kind of data" and works more for "any" data and that was why I was looking at something like tcpcrypt which will encrypt data over transport layer. – Prasoon Mar 10 '15 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.