Deploying for high-availability
This mode offers high availability through redundancy and load-balancing.
The KMS servers are stateless, so they can simply be scaled horizontally by connecting them to the same database and fronting them with a load balancer.
Configuring the load balancer¶
Since the KMS servers are stateless, any load-balancing strategy may be selected, such as a simple round-robin.
When the Cosmian KMS servers are configured to export an HTTPS port (as is the case when running inside a confidential VM):
- all the Cosmian KMS servers should expose the same server certificate on their HTTPS port
- and the load balancer should be configured as an SSL load balancer (HAProxy is a good example of a high-performance SSL load balancer)
Selecting the database¶
The KMS server has support for PostgreSQL, Maria DB, and MySQL, as well as Redis, using the Redis-with-Findex configuration.
Redis with Findex offers the ability to use Redis as a database with application-level encryption: all data is encrypted (using AES 256 GCM) by the KMS servers before being sent to Redis. Findex is a Cosmian cryptographic algorithm used to build encrypted indexes on encrypted data, also stored in Redis. This allows the KMS to perform fast encrypted queries on encrypted data. Redis with Findex offers post-quantum resistance on encrypted data and encrypted indexes.
Redis-with-Findex is most useful when:
- KMS servers are run inside a confidential VM or an enclave. In this case, the secret used to encrypt the Redis data and indexes is protected by the VM or enclave and cannot be recovered at runtime by inspecting the KMS servers’ memory.
- KMS servers are run by a trusted party but the Redis backend is managed by an untrusted third party.
Redis-with-Findex should be selected to run the Cosmian KMS in the cloud or any other zero-trust environment.
Configuring the database¶
The database parameters may be configured either:
- using options on the command line that is used to start the KMS server
- via a TLS connection when the KMS server is started in bootstrap mode. Database parameters may contain sensitive information, such as passwords: providing them on a TLS connection is more secure than specifying them in plain text on the command line.
Configuring the database via the bootstrap TLS Connection should be selected to run the Cosmian KMS in the cloud or any other zero-trust environment.
Configuring the database via the bootstrap server¶
Configuring the database via the bootstrap TLS connection is described in the bootstrap server documentation.
Configuring the database via the command line¶
- PostgreSQL, use
- MySQL or MariaDB, use
- Redis (with-Findex), use
and specify the database URL with the
For Redis with Findex, the
--redis-findex-label options must also be specified:
redis-master-passwordis the password from which keys will be derived (using Argon 2) to encrypt the Redis data and indexes.
redis-findex-labelis a public arbitrary label that can be changed to rotate the Findex ciphertexts without changing the password/key.
redis-master-password is the password from which a key will be derived (using Argon 2) to encrypt the Redis data and indexes.
redis-findex-label is a public arbitrary label that can be changed to rotate the Findex ciphertexts without changing the password/key.
Setting up a PostgreSQL database
Before running the server, a dedicated database with a dedicated user should be created on the PostgreSQL instance. These sample instructions create a database called
kms owned by a user
kms_user with password
Connect to psql under user
Using a certificate to authenticate to MySQL or Maria DB¶
Use a certificate to authenticate to MySQL or Maria DB with the
--mysql-user-cert-file option on the command line. Specify the certificate file name and mount the file to docker.
Say the certificate is called
cert.p12 and is in a directory called
/certificate on the host disk.