Page History

...

• HSM Profile Management (Admin only)

  • Add HSM Profile: Configure connection to HSM devices (PKCS#11-compliant)
  • Profile Scoping: User-owned, zone-level, or global (systempublic) profiles
  • Profile Validation: Health check on configured HSM connections
  • Sensitive data encryption: PINs and passwords are encrypted via DBEncryptionUtil before storage

• KMS Key Management

  • Key Creation: Create KMS keys (KEKs) bound to an HSM profile, zone, and account
  • Key Update: Enable/disable keys, update name and description
  • Key Deletion: Soft-delete keys (only if not in use by volumes or wrapped keys)
  • Key Listing: List keys with filtering by purpose, zone, state, and account

• Key Rotation

  • Same-HSM Rotation: Create a new KEK version in the same HSM with a new label
  • Cross-HSM Migration: Create a new KEK version in a different HSM profile
  • Transaction Atomicity: Database updates for new KEK version and key profile are wrapped in a Transaction.execute() block; orphaned HSM keys are cleaned up on DB failure
  • Background Rewrap: Gradual re-encryption of wrapped keys in configurable batches

• Volume Encryption Integration

  • DEK Generation: Generate random DEKs (configurable size via kms.dek.size.bits) and wrap them with the active KEK version
  • DEK Unwrapping: Unwrap DEKs on demand for volume access (plaintext DEKs are zeroized after use)
  • Volume Migration: Migrate legacy passphrase-encrypted volumes to KMS encryption

• Plugin Architecture

  • DatabaseKMSProvider: Database-backed KEK storage with AES/GCM/NoPadding encryption via DBEncryptionUtil
  • PKCS11HSMProvider: PKCS#11 HSM integration with per-profile session pooling and AES/CBC/PKCS5Padding wrapping

• Concurrency & Cluster Safety

  • Bounded thread pool for KMS operations: ThreadPoolExecutor(core=2, max=100, keepAlive=60s, SynchronousQueue) with daemon threads
  • Cluster-aware rewrap: GlobalLock("kms.rewrap.worker") prevents duplicate rewrap work across management server nodes
  • ScheduledExecutorService (replaces java.util.Timer) for robust periodic rewrap scheduling

...

1. User-Owned Profile: account_id set → visible only to that account
2. Zone Admin Profile: zone_id set, account_id NULL → visible to all accounts in that zone
3. Global Admin Profile: zone_id NULL, account_id NULL, system is_public = TRUE → visible to all accounts in all zones

...

...