Application Protector C on

Understanding the Architecture

Mon, 01 Jan 0001 00:00:00 +0000

This page describes the architecture, the individual components, and the workflow of the Protegrity Application Protector (AP) solution.

Architecture and Workflow

The following figure illustrates the deployment architecture of the Application Protector (AP).

The following table describes the components of the AP deployment architecture.

Component	Description
Customer Application	Built in supported programming languages and integrates with AP for data protection.
Application Protector	Core protection engine that enforces security policies and performs data protection operations.
Configuration File (config.ini)	Contains initialization parameters passed to AP during startup.
Package Enforcement and Deployment	Downloads policy packages from the RP Agent and executes protection operations, such as, protect, unprotect, and reprotect.
Log Forwarder	Collects logs from AP and forwards them to the Audit Store for centralized auditing.
Resilient Package (RP) Agent	Standalone process that retrieves policy packages from ESA and shares them with AP processes using shared memory IPC.

The following steps describe the workflow of a sample AP deployment in the production environment.

System Requirements

Mon, 01 Jan 0001 00:00:00 +0000

The following table lists the minimum hardware configurations.

Hardware Component	Configuration Details
CPU	Depends on the application.
Disk Space	Under 200 MB - including LogForwarder, RP Agent, and AP C.
RAM	Memory usage depends on the AP flavor and application behavior. Refer to AP C.

Preparing the Environment

Mon, 01 Jan 0001 00:00:00 +0000

Preparing the Environment for AP C Installation

Before installing Protegrity Application Protector (AP) C on a Linux platform, ensure the following prerequisites are met:

Prerequisites

The Enterprise Security Administrator (ESA) is installed, configured, and running.
The IP address or host name of the Load Balancer, Proxy, or ESA is noted.
The Policy Management (PIM) is initialized on the ESA, creating cryptographic keys and the policy repository for data protection.
For more information about initializing the PIM, refer to Initializing the Policy Management.
A trusted application is created and configured in the ESA for the application that will use AP C. For more information, refer to Creating a Trusted Application.

Installing the AP C Protector

Mon, 01 Jan 0001 00:00:00 +0000

Extracting the Setup Scripts and Package

To extract the setup scripts and package:

Download the ApplicationProtector_Linux-ALL-64_x86-64_GCC-9.3.1_<version>.tgz file to any location on the machine where you want to install the protector.
Extract the AP C installation package using the following command.
```
tar –xvf ApplicationProtector_Linux-ALL-64_x86-64_GCC-9.3.1_<version>.tgz
```
The following setup files are extracted:
- ApplicationProtector_Linux-ALL-64_x86-64_GCC-9.3.1_<version>.tgz
- signatures/ApplicationProtector_Linux-ALL-64_x86-64_GCC-9.3.1_<version>.sig
Verify the digital signature of the signed AP C build.
For more information about verifying the signed AP C build, refer to Verification of Signed Protector Build.
Extract the AP C installation package again using the following command.
```
tar –xvf ApplicationProtector_Linux-ALL-64_x86-64_GCC-9.3.1_<version>.tgz
```
The following setup files are extracted:
- LogforwarderSetup_Linux_x64_<version>.sh
- RPAgentSetup_Linux_x64_<version>.sh
- XCDevSetup_Linux_x64_<version>.sh
- XCSamplesSetup_Linux_x64_<version>.sh

Installing Log Forwarder on Linux

The steps to install the Log Forwarder on a Linux platform using the Interactive mode or through the Silent mode are described in this section.

Configuring the Protector

Mon, 01 Jan 0001 00:00:00 +0000

Configuring AP C on Linux

To configure the AP C on the Linux platform:

Set the library path before running protect, unprotect or reprotect operations.
```
export LD_LIBRARY_PATH=/opt/protegrity/sdk/c/bin
```
This makes the xcpep.plm file accessible to the Application Protector C SDK before your application initializes.
Ensure that the config.ini file exists in this location before starting the application. AP C resolves the config.ini file path relative to the library path:
- AP C automatically looks for the configuration file at -

Using the AP C APIs

Mon, 01 Jan 0001 00:00:00 +0000

The process to use the AP C protect, unprotect, and reprotect methods are described on this page.

It is assumed that the ESA is already available.

The tasks can be divided in the following order.

Create the data elements and data store in the Policy Management on the ESA Web UI.
Create the member sources and roles.
Configure the policy.
Configure the trusted application.
Add a trusted application to the data store.
Install the AP C.
Run the sample application.

Creating a data element and data store

Determine how the data needs to be protected either by using encryption or tokenization before running the application. Protection and unprotection methods are available for both.

Application Protector C APIs

Mon, 01 Jan 0001 00:00:00 +0000

The Protegrity Application Protector (AP) C provides APIs that integrate with the customer application to protect, unprotect, and reprotect sensitive data. A session must be created to run the AP C.

Note:

The AP C APIs can be invoked by a valid Policy User.

The AP C supports only the byte data type.

The following diagram represents the basic flow of a session.

The following sections provide detailed information of the various structures and functions used by the Protegrity Application Protector C.