Skip to main content
LinkedIn
Copied!

Table of Contents

Encrypting system data by using a custom key management service

Version:

Only available versions of this content are shown in the dropdown

Encrypt system data using an encryption key that is sourced from a Custom Key management service (KMS) that is accessed from a data page. For system data encryption, you can only use the Custom Key management service.

The master key in the custom KMS must be a 128-bit AES key.

  1. Create an activity that accesses the custom KMS, configures a CustomMasterKey object, and loads the master key into KeyStoreUtils.

    1. In the header of Dev Studio, click Create Technical Activity .

    2. In the Apply to (class) field, enter Data-Admin-Security-Keystore, and then click Create and open.

    3. In an activity step, in the Method field, enter Java, and in the Java Source field, enter a code snippet similar to the example in step 1 of the sample activity pzSampleGetCustomMasterKey.

      Instead of the first Java command shown in the sample, your activity can use a Connect-REST step that accesses the master key from the custom KMS.
    4. Click Save.

  2. Create a data page that is loaded by the activity that you created in step 1.

    1. In the header of Dev Studio, click Create Data Model Data Page .

    2. In the Apply to (class) field, enter Data-Admin-Security-Keystore, and then click Create and open.

    3. In the Object type field, enter Data-Admin-Security-Keystore.

    4. In the Mode list, select Read-Only.

    5. In the Scope list, select Node.

    6. In the Source list, select Activity.

    7. In the Activity name field, enter the name of the activity that you created in step 1.

    8. On the Parameters tab, select the Pass current parameter page check box.

    9. Click Save.

  3. Create a keystore that is loaded from the data page that you created in step 2.

    1. In the header of Dev Studio, click Create Security Keystore .

    2. In the Keystore location field, press the Down arrow key, and under KEY MANAGEMENT SYSTEM (KMS) FOR SYSTEM DATA ENCRYPTION, select Custom – Source master key from other KMS using a data page.

    3. In the Source data page field, enter the name of the data page that you created in step 2.

    4. Click Save.

  4. Identify and activate the key for system data encryption.

    1. In the header of Dev Studio, click Configure System Settings Data Encryption .

    2. In the System data encryption section, in the Keystore field, enter the name of the keystore that you created in step 3.

    3. Click Activate.

Did you find this content helpful?

Have a question? Get answers now.

Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.

Ready to crush complexity?

Experience the benefits of Pega Community when you log in.

We'd prefer it if you saw us at our best.

Pega Community has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice
Contact us