Skip to main content
Version: 2022

Encryption in Indicium

Storing encryption keys​

In some cases, Indicium needs access to a secure location for storing encryption keys:

  • when using the Encrypt and Decrypt process actions
  • when scaling to multiple Indicium instances.
warning

It is very important to back up these keys. If you lose these keys, the encrypted data in the database can no longer be used and cannot be recovered in any way.

The Thinkwise platform has several options to setup the storage of the encryption keys:

If this setup has not been performed, calling the Encrypt and Decrypt process actions in your application results in an error.

Store encryption keys on Azure​

When using Indicium on Azure, the encryption keys must be stored in a Key Vault:

  1. Create a Key Vault on the Azure Portal.

  2. Add an "Access Policy" to it to allow the Indicium instance Web App access.

  3. Select the Identity menu in the Indicium Web App.

  4. Check whether the Identity setting System Assigned is enabled.

  5. In the Key Vault, select +Add Access Policy from the Access Policy menu on the left-hand side.

  6. In the Secret permissions field, select the "Get", "List", and "Set" permissions.

  7. In the Select principal field, select your Indicium Web App.

  8. Click Add. You are automatically returned to the Access Policy screen.

  9. Click Save to save the new access policy.

Add access policyAdd access policy

To use the newly created Key Vault, you must set the KeyVaultSecretUrl setting in the Indicium Web App.

In the appsettings.json configuration file, this KeyVaultSecretUrl setting can be configured directly:

  "DataProtectionSettings": {
    "AzureKeyVault": {
      "KeyVaultSecretUrl": "<key vault secret url>"
    }
  }

Alternatively, you can store this setting in the App Service:

  1. In the App Service, select Settings > Configuration from the menu.

  2. Add the following Application settings:

Name: DataProtectionSettings:AzureKeyVault:KeyVaultSecretUrl

Value: https://<name-of-the-key-vault>.vault.azure.net/secrets/<secret-name>

When the Key Vault url is configured, Indicium will automatically create a key. Every 90 days, Indicium creates a new version within this key.

warning

Do not delete old versions! When deleting old versions, Indicium cannot decrypt the old data.

Store encryption keys on-premise​

warning

When using an on-premise server:

  • Store the encryption keys in a safe location. If you lose the keys, the encrypted data becomes useless.
  • Make regular backups of the encryption keys.

In the appsettings.json configuration file, you can configure the location directly:

  "DataProtectionSettings": {
    "LocalFileSystem": {
      "StorageLocation": "D:\\iis-dataprotection\\indicium-keys",
    }
  }

Store encryption keys on-premise with Azure Key Vault​

You can also use on-premise with Azure Key Vault. This consists of:

  • Create a new "App registration" in the Azure portal.
  • Create an Azure Key Vault.
  • Configure some settings in the appsettings.json configuration file.
  1. In Azure Active Directory, select App registrations to create the registration.

After creating the registration, you can find the Application (client) ID and the Tenant id in the Overview menu. These IDs will be used later.

  1. From the Certificates & secrets menu, add a new "Client secret".

  2. Copy or make a note of the secret value (not the secret id), this value is used in the last step.

  3. Create a Key Vault from the Azure Portal.

  4. Add an "Access Policy" to it to allow the Indicium instance Web App access.

  5. In the Key Vault, select +Add Access Policy from the Access Policy menu on the left-hand side.

  6. In the Secret permissions field, select the "Get", "List", and "Set" permissions.

  7. In the Select principal field, select the "App registration" you created in the first step.

  8. Click Add. You are automatically returned to the Access Policy screen.

  9. Click Save to save the new access policy.

  10. To use the newly created Key Vault, add the following section to the appsettings.json configuration file, and specify the values for TenantId, ClientId, and ClientSecret.

  "DataProtectionSettings": {
    "AzureKeyVault": {
      "TenantId": "<tenant id>",
      "ClientId": "<client id>",
      "ClientSecret": "<tenant id value>",
      "KeyVaultSecretUrl": "<key vault secret url>"
    }
  }

Store encryption keys on AWS​

When using Indicium on AWS, encryption keys must be saved in the AWS Secrets Manager.

To give the Elastic BeanStalk EC2 instance access to the Secrets Manager:

  1. In your Elastic Beanstalk EC2 instance, select the Security tab.

  2. Click the Identity and Access Management (IAM) link.

  3. Click Add permissions.

  4. Click Create inline policy.

  5. In the JSON tab, paste the JSON code fragment below.

  6. Click Save to save the new policy. Indicium can now access the AWS Secrets manager.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:CreateSecret"
            ],
            "Resource": "arn:aws:secretsmanager:<region>:<account-id>:secret:<secret-prefix>-*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "secretsmanager:ListSecrets",
            "Resource": "*"
        }
    ]
}

In the above JSON code fragment:

  • Replace region with, for example, “eu-west-1”.
  • Replace account-id with your account number.
  • Replace secret-prefix with the prefix you want your encryption keys in the Secrets Manager to be named.

For example, if your prefix is “indicium/dataprotection-test”, you should give access to “indicium/dataprotection-test-*” with the wildcard character.

  1. In the appsettings.json configuration file, add the following code:
  "DataProtectionSettings": {
    "AwsSecretManager": {
      "SecretPrefix": "indicium/dataprotection-test"
    }
  }

Indicium will automatically add a new key with the configured prefix every 90 days.

warning

Do not delete old keys! When deleting old keys, Indicium cannot decrypt the old data.

Was this page helpful?