Application Protector C

Protegrity Application Protector (AP) C Overview

The Protegrity Application Protector (AP) C provides APIs that integrate with customer applications to protect, unprotect, and reprotect sensitive data. The AP C can be used with any customer application that is developed using the C programming language.

The AP C has the following protection and security access methods:

• Get product version
• Check access rights for the user
• Protect
• Unprotect
• Reprotect

Features of AP C

The following are the various features of AP C.

Supported C standards and compilers

The AP C supports GCC versions 9.3.1 and higher for all operating systems.

Trusted applications

The AP C can be accessed only by trusted applications. Any application that protects, unprotects, or reprotects data must first be created as a trusted application.

For more information about how to make an application trusted, refer to Creating a Trusted Application.

Session validity

A session is valid until the XCTerminateLib API is called in the application.

Note: XCInitLib, XCOpenSession, XCCloseSession, and XCTerminateLib must each be called once per single process.

Audit logs

• Each session generates audit records for every protection function call and data element.

• Single Data Item Operations

  • Examples:
    • 1 protect operation with data element a and count 1 → 1 audit log
    • 5 protect operations with data element b and count 5 → 5 audit logs
    • 1000 unprotect operations with data element a and count 1000 → 1000 audit logs

• Bulk Data Item Operations

  • Every protect, unprotect, and reprotect operation generates audit log events.
  • Example: 2 bulk protect operations with bulk size 3, the same data elements, and the same session → 1 audit log with count 6

• Initialization Logs

  • An audit log is generated each time a trusted application is initialized, indicating whether the initialization was successful or not.
  • Initialization audit logs are created only after the xcpep.plm file is loaded.
  • Audits are generated in ESA Audit Store for Security Officer access.

Protector status audit logs

While the protector is running, a status log is sent to Discover at an interval of 60 seconds, which can be viewed using the pty_insight_analytics\*protector_status_* index on Discover.
For more information about the status logs, refer to Protectors status index.

The protector status dashboard displays the protector connectivity status through a pie chart and a table visualization. This dashboard uses status logs sent by the protector, so the protector which performed at least one security operation shows up on this dashboard.
For more information about the protector status dashboard, refer to Protector Status Dashboard index.

Error handling

If AP C is used to perform a security operation on a single data item, then the function returns a non-zero error code in case of any error. Similarly, if AP C is used to perform a bulk security operation, then a non-zero error code is returned for each failed item in the bulk result array. The calling application must check the return code after every AP C function call.

For more information about the log return codes, refer to Log return codes.