The Unvired Digital Enterprise Platform (UDEP) encrypts all configuration and messages before persistence. Industry best practices are followed for the encryption. All data for a company is AES 256 encrypted (the same technology your bank uses to secure your transactions) and decrypted with a symmetric key. Each company has its own symmetric key so that data across companies can never be accessed under any circumstances. Further to secure the keys, they are stored in key files in a landscape that is physically separate from the servers running the UDEP. For e.g. in an AWS environment, they are stored in S/3. The passwords to these key files are stored separately after encrypting with a landscape key.

To further harden this, UDEP is now fully integrated with the VaultProject from Hashicorp. From the Hashicorp website: “Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Vault handles leasing, key revocation, key rolling, and auditing. Through a unified API, users can access an encrypted Key/Value store and network encryption-as-a-service, or generate AWS IAM/STS credentials, SQL/NoSQL databases, X.509 certificates, SSH credentials, and more.”

So how exactly does UDEP use Vault?

The passwords for the key files are now stored in Vault.  Each company has its own password stored in Vault. The access tokens for Vault are passed to UDEP via environment variables. These access tokens have tightly configured policies to ensure that the tokens can only access and perform the permitted operations.

Additionally, the auth tokens can be response wrapped. In this case, the real tokens are inserted in a “cubby hole” in Vault and a temporary one-time access token is instead configured for UDEP. UDEP unwraps the token and then uses the “real access token” to access the keys. In case the unwrap operation fails, this indicates that some other operator has intercepted the key and the system can be shut down immediately and the vault sealed to prevent any further compromise. This also ensures that the environment variables that are configured are practically useless for a hacker as they cannot be reused.

To prevent leakage of data in case a token is compromised, the tokens can also be configured to be renewable periodically. Issued tokens can be revoked and then access of keys via these tokens is not permitted.

Further UDEP also supports rotating keys used via Vault. Keys of all companies can be rotated and ensures that your data is as secure as required.

To summarize:

1. Keys are stored in a separate Vault.
2. Access is provided via response wrapped one time tokens.
3. Access tokens can be periodic to facilitate revocation in case of a compromise.
4. Keys can be rotated according to your security policy.
5. Vault provides a detailed audit log that records all access operations for monitoring and verification.

So with the UDEP and Vault integration, all your configuration information and business data is protected to the maximum. Stay safe.