Additional Topics on

Memory Usage of the AP Java

Mon, 01 Jan 0001 00:00:00 +0000

The memory used for the different policy sizes using a sample HelloWorld java application is described in this section. This is a sample memory usage. You can use this as a reference for memory usage in the AP Java for different policy sizes.

Sample application

The following is a sample HelloWorld.java application.

/* HelloWorld.java
*
* This is sample program demonstrating the usage of Java SDK API
*
* Configure Trusted Application policy in ESA with
* - Application name: lib.HelloWorld
* - Application user: <SYSTEM USER>
*
* Compiled as : javac -cp .:<PATH_TO_INSTALL_DIR>/sdk/java/lib/ApplicationProtectorJava.jar HelloWorld.java
* Run as :
* java -cp .:<PATH_TO_INSTALL_DIR>/sdk/java/lib/ApplicationProtectorJava.jar HelloWorld policyUser dataElement inputData
*
* Use either Token Elements or NoEncryption as dataElement while running this code.
*/

package lib;

import com.protegrity.ap.java.Protector;
import com.protegrity.ap.java.ProtectorException;
import com.protegrity.ap.java.SessionObject;

public class HelloWorld {

 public static void performProtectionOperation(
 String policyUser, String dataElement, String inputData) throws ProtectorException {

 String[] input = {inputData};
 String[] protectedOutput = new String[input.length];
 String[] unprotectedOutput = new String[input.length];

 // Initialize Java SDK Protector
 Protector protector = Protector.getProtector();

 // Create a new protection operation session for policyUser
 SessionObject session = protector.createSession(policyUser);
 // Get Java SDK Version
 System.out.println("Java SDK Version:" + protector.getVersion());

 // Perform Protect Operation
 boolean res = protector.protect(session, dataElement, input, protectedOutput);
 if (!res) {
 System.out.println(protector.getLastError(session));
 } else {
 System.out.println("Protected Data:");
 for (String out : protectedOutput) {
 System.out.print(out + " ");
 }
 System.out.println();
 }

 // Perform Unprotect Operation
 res = protector.unprotect(session, dataElement, protectedOutput, unprotectedOutput);
 if (!res) {
 System.out.println(protector.getLastError(session));
 } else {
 System.out.println("Unprotected Data:");
 for (String out : unprotectedOutput) {
 System.out.print(out + " ");
 }
 System.out.println();
 }
 }

 public static void main(String[] args) throws ProtectorException {

 if (args.length == 3) {
 System.out.println(
 "Testing input data "
 + args[2]
 + " "
 + "with dataElement "
 + args[1]
 + " "
 + "and policyUser "
 + args[0]);

 performProtectionOperation(args[0], args[1], args[2]);

 } else {
 System.out.println(
 " Usage : java -cp .:<PATH_TO_INSTALL_DIR>/sdk/java/lib/ApplicationProtectorJava.jar HelloWorld PolicyUser DataElement Data");
 System.out.println(
 " Example : java -cp .:<PATH_TO_INSTALL_DIR>/sdk/java/lib/ApplicationProtectorJava.jarr HelloWorld user1 TE_AN_SLT13_L0R0_N"
 + " Protegrity");
 System.exit(0);
 }
 }
}

Expected memory usage

The process to find the policy size and expected memory usage for different policy sizes used by the java application is described in this section.

DevOps Approach for Application Protector Java

Mon, 01 Jan 0001 00:00:00 +0000

The DevOps approach enables immutable package deployment. It uses a REST API call to download packages from the ESA in an encrypted format.

Note: The RP Agent should not be installed for immutable package deployments using DevOps.

For more information about package deployment approaches, refer to Resilient Package Deployment.

A REST API call is used to download the package on your local machine. Configure the package path in the config.ini file within the DevOps section and the decryptor class.

Application Protector API Return Codes

Mon, 01 Jan 0001 00:00:00 +0000

When an application is developed using the APIs of the Protegrity Application Protector Suite, you may encounter the Application Protector API Return Codes. For more information about log return codes, refer to Log return codes.

Sample Log for AP Return Codes

The following is a sample log generated in Discover on the Audit Store Dashboards in the ESA.

Protection audit logs are stored in the Audit Store. Select the pty_insight_*audit* index to view the protection logs.

Config.ini file for Application Protector

Mon, 01 Jan 0001 00:00:00 +0000

The Application Protector can be configured using the config.ini file. By default, this file is located in the <installation directory>/sdk/<protector>/data/ directory.

The various configurations required for setting up the Application Protector are described in this section.

Sample config.ini file

The following represents a sample config.ini file.

# -----------------------------
# Protector configuration
# ----------------------------- 
[protector]

# Cadence determines how often the protector connects with shared memory to fetch the policy updates in background.
# Default is 60 seconds. So by default, every 60 seconds protector tries to fetch the policy updates.
#
# Default 60.
cadence = 60

# The time during which an session object is valid. Default = 15 minutes.
session.sessiontimeout = 15

###############################################################################
# Log Provider Config
###############################################################################
[log]

# In case that connection to fluent-bit is lost, set how audits/logs are handled
# 
# drop : (default) Protector throws logs away if connection to the fluentbit is lost
# error : Protector returns error without protecting/unprotecting 
# data if connection to the fluentbit is lost
mode = drop

# Host/IP to fluent-bit where audits/logs will be forwarded from the protector
#
# Default localhost
host = localhost

Different configurations for Application Protector

The following are the various configurations:

Multi-node Application Protector Architecture

Mon, 01 Jan 0001 00:00:00 +0000

The multi-node Application Protector (AP) architecture, its individual components, and how logs are collected using the Log Forwarder are described in this section.

The following figure describes the multi-node AP architecture.

For example, some AP nodes are connected to an ESA, which includes the Audit Store component. Each AP node contains a Log Forwarder, RP Agent, and AP instance for sending logs to the ESA.

Protector: The AP can be configured using the config.ini file.
For more information about the configurations, refer to Config.ini file for Application Protector.

Uninstalling the Application Protector

Mon, 01 Jan 0001 00:00:00 +0000

Uninstalling Application Protector (AP) Java from Linux

This section outlines the steps to uninstall the various components of AP Java from a Linux platform.

Uninstalling the Log Forwarder from Linux

Note: To preserve all the configurations while upgrading the Log Forwarder, ensure all the files present under the /opt/protegrity/logforwarder/data/config.d directory are backed up.

To uninstall the Log Forwarder from a Linux platform:

Navigate to the /opt/protegrity/logforwarder/bin directory.
Stop the Log Forwarder using the following command.