Enhancing Security in the Configuration Phase

Updated on 2024-07-04 GMT+08:00

View PDF

Setting Environment Variables Securely

Sensitive information exists in HUAWEI_KMS_INFO. You are advised to set the environment variables as follows:

Set temporary environment variables: When an encrypted database is used, run the export command to set environment variables. After the database is used, run the unset command to clear environment variables. In this method, OS logs may record sensitive information. You are advised to use process-level environment variables or JDBC APIs to set connection parameters.
Set process-level environment variables: In the application code, set environment variables through programming APIs. The following are examples of setting environment variables in different programming languages:
1. C/C++: setenv(name, value)
2. Go: os.Setenv(name, value)
3. Java does not support the setting of process-level environment variables. Connection parameters can be set only through the JDBC APIs.

Verifying External Key Management Service Identity

When the database driver accesses Huawei Cloud KMS, to prevent attackers from masquerading as the KMS, the CA certificate can be used to verify the validity of the key server during the establishment of HTTPS connections between the database driver and the KMS. Therefore, you need to configure the CA certificate in advance. If the CA certificate is not configured, the key management service identity will not be verified. The configuration method is as follows:

In the Huawei Cloud scenario, add the following parameters to the environment variables:

export HUAWEI_KMS_INFO='Other parameters, iamCaCert=Path/IAM CA certificate file, kmsCaCert=Path/KMS CA certificate file'

Most browsers automatically download a CA certificate of a website and provide the certificate export function. Some websites (such as https://www.ssleye.com/ssltool/certs_down.html) provide the function of automatically downloading CA certificates. However, the CA certificates may be unavailable due to proxy or gateway in the local environment. Therefore, you are advised to use a browser to download the CA certificate. You can perform the following steps:

CAUTION:

The RESTful API is used to access the KMS. When you enter the URL of the API in the address box of the browser, ignore the failure page in 2. The browser has automatically downloaded the CA certificate in advance even if the failure page is displayed.

Enter the domain name: Open a browser. In the Huawei Cloud scenario, enter the IAM service domain name (iam.cn-north-4.myhuaweicloud.com/v3/auth/tokens) and KMS domain name (kms.cn-north-4.myhuaweicloud.com/v1.0).
Search for a certificate: Each time you enter a domain name, find the SSL connection information and click the information to view the certificate content.
Export the certificate. On the Certificate Viewer page, certificates may be classified into multiple levels. You only need to select the upper-level certificate of the domain name and click Export to generate a certificate file, that is, the required certificate file.
Upload the certificate: Upload the exported certificate to the application and set the preceding parameters.

Parent topic: Setting Encrypted Equality Query

Previous topic: Using Go Driver to Operate an Encrypted Database

Next topic: Encrypted Functions and Stored Procedures

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot