The Porticor Virtual Private Data solution includes two or three major components:

Transcription

1 Architecture The Porticor solution offers a rich variety of cloud encryption capabilities. Your project s needs and characteristics will determine the right choices for your application. The Porticor Virtual Private Data solution includes two or three major components: Porticor s Virtual Key Management Service (PVKM) a unique and patented key management technology which is provided as a service. PVKM is stronger than hardware, thanks to patented technologies such as Split-Key Encryption and Homomorphic Key Management (read more about it in this white paper) A Porticor Virtual Appliance (one or more for high availability), implemented inside your cloud account and used as part of the scenarios below An (optional) Porticor Encryption Agent, which may be installed and used on one or more of your Virtual Machines (your servers)

2 The diagram above represents an overview of the deployment options. Some of the most common deployment types are discussed below.

3 One of the more common uses of Porticor is an inline full disk encryption. In such implementation, a protected server mounts an encrypted disk which is attached to a Porticor Virtual Appliance. This scenario is ideal for the following requirements: 3 4 When you want absolutely no change to applications running on the protected server it simply mounts a virtual encrypted disk. No encryption agent or other software is installed on the server. Porticor handles all encryption/decryption and key management transparently. Keys are never seen by your cloud server

4 A Porticor Encryption Agent is installed on the customer's server, and communicates with a Porticor Virtual Appliance to obtain encryption keys (using our split-key technology). Such communication rarely takes place, essentially only whenever a new disk is created, or when the server is restarted. This option is ideal for IaaS deployments with the following requirements: 3 if you wish none of the data to go through the Porticor Virtual Appliance; for example this alternative is a great fit for high-performance disks, such as directly attached SSD. No encryption agent or other software is installed on the server. The master key is never seen by your cloud server, and the Agent only sees low value and temporary API keys. No change to the application is needed, though you accept an installation on your cloud Server.

5 A protected application will use Porticor's RESTful API to manage its own cryptographic keys, and use those keys to encrypt particularly sensitive data items. A Porticor Key Management RESTful API enables greater flexibility. For example, by connecting directly to a database encryption scheme, or feeding an application with encryption keys securely. This solution is ideal for: A Key Management RESTful API solution can be clustered across multiple Porticor Virtual Appliances, both for capacity and reliability. The API is engineered so that operations in a single session can be directed to different appliances. Database level encryption. Using the RESTful API, Porticor can integrate directly with the database for encryption of data, even in AWS RDS. (See PostgreSQL example, or MySQL) A Key Management RESTful API solution can be clustered across multiple Porticor Virtual Appliances, both for capacity and reliability. The API is engineered so that operations in a single session can be directed to different appliances. Most of our customers find that one (or more) of these deployment types is ideal for them. In some cases, particularly complex security needs or regulatory compliance requirements dictate different setups. Please contact us to determine the right deployment for your particular needs.