Acra: database protection suite

What is Acra

Acra helps you easily secure your databases in distributed, microservice-rich environments. It allows you to selectively encrypt sensitive records with strong multi-layer cryptography, detect potential intrusions and SQL injections and cryptographically compartmentalize data stored in large sharded schemes. Acra’s security model guarantees that if your database or your application get compromised, they will not leak sensitive data or decryption keys.

Acra gives you tools for encrypting the data on the application’s side into a special cryptographic container, storing it in the database, and then decrypt it in a secure compartmented area (separate virtual machine/container). The cryptographic design ensures that no secret (password, key, anything) leaked from the application or database will be sufficient for decryption of the protected data chunks that originate from it.

Acra was built with specific user experiences in mind:

• quick and easy integration of security instrumentation;
• cryptographic protection of data in the threat model where all the other parts of the infrastructure could be compromised, but as long as AcraServer isn’t compromised, the data is safe;
• proper abstraction of all cryptographic processes: you’re safe from the risk of selecting the wrong key length or algorithm padding;
• secure default settings to get you going;
• intrusion detection to let you know early that something wrong is going on;
• high degree of configurability to create the perfect balance between the extra security features and performance;
• automation/ops-friendly: most of Acra’s features were built to be easily configured/automated using a configuration automation environment.
• limited attack surface: to compromise an Acra-powered app, an attacker will need to compromise a separate compartmented server, AcraServer – more specifically – its key storage and database;
• easy to try: you can experience the full might of Acra without committing to its installation using Docker containers.

Acra is a continuously developing security tool. And as any proper security tool, it requires enormous human efforts for validation of the methods, code, and finding possible infrastructural weaknesses. Although we do run Acra in production in several instances, we’re constantly enhancing and improving it as we go. This is done to ensure that the provided security benefits are not rendered useless through implementation problems or increased complexity.

Cryptography

Acra relies on our cryptographic library Themis, which implements high-level cryptosystems based on the best available open-source implementations of the most reliable ciphers. Acra does not contain any self-made cryptographic primitives or obscure ciphers. Instead, to deliver its unique guarantees, Acra relies on the combination of well-known ciphers and smart key management scheme.

How does Acra work?

After successfully deploying and integrating Acra into your application, follow the 4 steps below:

• Your app talks to AcraConnector, local daemon, via PostgreSQL/MySQL driver. AcraConnector emulates your normal PostgreSQL/MySQL database, forwards all requests to AcraServer over a secure channel, and expects a plaintext output back.
• Then AcraConnector forwards it over the initial database connection to the application. It is connected to AcraServer via Secure Session or TLS, which ensures that the plaintext goes over a protected channel. It is highly desirable to run AcraConnector via a separate user to compartmentalize it from the client-facing code.
• AcraServer is the core entity that provides decryption services for all the encrypted envelopes that come from the database and then re-packs the database answers for the application. AcraCensor is a part of AcraServer that allows customizing the firewall rules for all the requests coming to the MySQL database.
• To write the protected data to the database, you can use AcraWriter library, which generates AcraStructs and helps you integrate it as a type into your ORM or database management code. You will need Acra’s public key to do that. AcraStructs generated by AcraWriter are not readable by it — only the server has the right keys to decrypt it.
• You can connect to both AcraConnector and the database directly when you don’t need encrypted reads/writes. However, increased performance might cost you some design elegance (which is sometimes perfectly fine when it’s a conscious decision).

Acra also has additional smaller components like AcraCensor firewall and a lightweight HTTP web server for managing AcraServer’s certain configuration options AcraWebConfig. To better understand the architecture and data flow, please refer to Architecture and data flow section in the official documentation.

The typical Acra workflow looks like this:

• The app encrypts some data using AcraWriter, generating AcraStruct with AcraServer public key and updates the database.
• The app sends SQL request through AcraConnector, which forwards it to AcraServer.
• AcraServer passes each query through AcraCensor (currently only works with MySQL databases), which can be configured to blacklist or whitelist some queries. AcraServer forwards the allowed queries to the database.
• Upon receiving the answer, AcraServer tries to detect the encrypted envelopes (AcraStructs). If it succeeds, AcraServer decrypts payload and replaces the AcraStructs with plaintext answer, which is then returned to AcraConnector over a secure channel.
• AcraConnector then provides an answer to the application, as if no complex security tool was ever working within the system.

Install && Use

Copyright 2015 Cossack Labs Limited