oat-sa/extension-tao-encryption

Tao Encryption

Tao Encryption

This article describes the functioning of tao encryption, focusing of encryption of sensitive data information on a database level., _(*1)

Installation

You can add the Tao Encryption as a standard TAO extension to your current TAO instance., _(*2)

 $ composer require oat-sa/extension-tao-encryption

Encrypted services supported

1. Results Encryption

• #### Setup scripts for Tao Server instance

Encrypt

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupAsymmetricKeys' generate

Note:, _(*3)

This command will generate two keys (public and private) and save them on the filesystem., _(*4)

Note:, _(*5)

On Client Tao instance. You have to copy the public key., _(*6)

Note:, _(*7)

On Server Tao instance. You need both keys, _(*8)

Decrypt

In order to decrypt your results use the following script by passing a delivery id., _(*9)

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\DecryptResults' -d <delivery_id>

Or by passing the -all argument, _(*10)

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\DecryptResults' -all

Note:, _(*11)

This command will decrypt results and store in the delivery result storage setup., _(*12)

• #### Setup scripts for Tao Client instance

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupEncryptedResultStorage'

• #### Sync Encrypted Result (Run on Server and client) In order to sync encrypted results the script needs to be run on the server tao instance and client as well.

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupEncryptedSyncResult'
 ```

![alt text](docs/result_encryption.png)

### 2. Test State data encryption

- #### Setup scripts for Tao Client instance

In order to use the encrypted state test service you have to run the following command on tao client instance:

```bash
 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupEncryptedStateStorage'

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupEncryptedMonitoringService'

This service it's using the symmetric algorithm in order to encrypt information., _(*13)

, _(*14)

3. User Encryption

• #### Setup scripts for Tao Client instance

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupEncryptedUser'

• #### Setup scripts for Tao Server instance

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupUserEventSubscription'

• #### Both Instances

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupUserSynchronizer'

Note:, _(*15)

You should ran this command on client tao instance, _(*16)

, _(*17)

4. Setup Encrypted File Systems

• #### Setup scripts for Tao Client instance

 $ sudo -u www-data php index.php "oat\taoEncryption\scripts\tools\SetupEncryptedFileSystem" -f private -e taoEncryption/symmetricEncryptionService -k taoEncryption/symmetricFileKeyProvider

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupDeliveryEncrypted'

• #### Setup scripts for Tao Server instance

 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupUserApplicationKey'
 ```

```bash
 $ sudo -u www-data php index.php 'oat\taoEncryption\scripts\tools\SetupRdfDeliveryEncrypted'

Note:, _(*18)

Extra You can make TAO file systems encrypted. The following command line enables encryption for the private file system, using the service registered with ID taoEncryption/symmetricEncryptionService for data encryption/decryption., _(*19)

sudo -u www-data php index.php "oat\taoEncryption\scripts\tools\SetupEncryptedFileSystem" -f private -e taoEncryption/symmetricEncryptionService

, _(*20)