search

mojaloop / project

Repo to track product development issues for the Mojaloop project.
Other
23 stars 15 forks source link

Security Certificate Management #3717

Open ei-nghon-phoo opened 9 months ago

ei-nghon-phoo commented 9 months ago

User Story

As a hub operator, I want to upload and manage JWS certificates for each DFSP so that I can ensure the security of the switch and the integrity of trusted transactions among DFSP.

Technical Design for the certificate management

certificate mangement technical design.png

Certificate workflow

Tasks

tw-sithumyo commented 8 months ago

hello Ma @TW-Ei-Nghon-Phoo , based on the recent discussion with Ko @myo-min-htet and Ko @tw-aungthawaye , we will be uploading .cer file instead of .pem format... and cert-managment-bc internal service will be responsible for generate .pem file instead using uploaded cer file

ei-nghon-phoo commented 8 months ago

noted, will update the UI and spec

tw-sithumyo commented 8 months ago

admin ui and service integration in docker-compose-cross-cutting

https://github.com/mojaloop/platform-shared-tools/pull/52

ei-nghon-phoo commented 6 months ago

history

Security Management with JWS certificates

In JWS security management, Public and private keys are generated by a certificate authority for DFSP. This signature can be validated by any participant, including the hub and DFSPs involved in the transaction. Successful validation is crucial for a transaction to proceed., and the Public key certificate can be decoded to extract information such as time validity, issuer certificate authority, and the signature creation algorithm.

Acceptance Criteria:

  1. Certificate Upload:

    • Hub operators with the assigned privilege should be able to upload public key certificates for each DFSP.
    • Only users with the proper privileges should be able to upload and view certificates.
    • The uploaded file format must adhere to the expected format (DFSPID-pub.pem); otherwise, an appropriate error message, such as "Invalid file format. Please use the correct format (DFSPID-pub.pem)," should be displayed.

  2. Certificate Information:

    • The UI should display essential information related to the certificates, including Signature Algorithm, Certificate Authority (Issuer), time validity (Not Before, Not After), and a downloadable link for the certificate file.

  3. Security Management with JWS:

    • Each participant DFSP should have only one associated public key certificate.
    • If the signature validation fails during a transaction, the transaction should not be successful.
    • If a transaction fails due to signature validation, monitoring personnel should receive a proper error code and message, indicating the reason for the failure.
    • DFSPs must securely hold their private keys, ensuring the confidentiality and integrity of their cryptographic key material.

  4. Certificate Renewal:

    • Before the expiration of the current certificate, users should be able to upload a new certificate.
    • The UI should reflect the information according to the new certificate after a successful upload.
    • The system should notify relevant parties if the certificate is approaching expiration.
image.png

UI Design

Design File

ei-nghon-phoo commented 6 months ago

history

Security Management with JWS certificates

In JWS security management, Public and private keys are generated by a certificate authority for DFSP. This signature can be validated by any participant, including the hub and DFSPs involved in the transaction. Successful validation is crucial for a transaction to proceed., and the Public key certificate can be decoded to extract information such as time validity, issuer certificate authority, and the signature creation algorithm.

Acceptance Criteria:

  1. Certificate Upload:

    • Hub operators with the assigned privilege should be able to upload public key certificates for each DFSP.
    • Only users with the proper privileges should be able to upload and view certificates.
    • The uploaded file format must adhere to the expected format (DFSPID-pub.pem); otherwise, an appropriate error message, such as "Invalid file format. Please use the correct format (DFSPID-pub.pem)," should be displayed.

  2. Certificate Information:

    • The UI should display essential information related to the certificates, including Signature Algorithm, Certificate Authority (Issuer), time validity (Not Before, Not After), and a downloadable link for the certificate file.

  3. Security Management with JWS:

    • Each participant DFSP should have only one associated public key certificate.
    • If the signature validation fails during a transaction, the transaction should not be successful.
    • If a transaction fails due to signature validation, monitoring personnel should receive a proper error code and message, indicating the reason for the failure.
    • DFSPs must securely hold their private keys, ensuring the confidentiality and integrity of their cryptographic key material.

  4. Certificate Renewal:

    • Before the expiration of the current certificate, users should be able to upload a new certificate.
    • The UI should reflect the information according to the new certificate after a successful upload.
    • The system should notify relevant parties if the certificate is approaching expiration.
image.png

UI Design

Design File

JulieG19 commented 5 months ago

@TW-Ei-Nghon-Phoo , is the team working on this ticket?/Can you please provide updates? Thanks!

smthitsaworks commented 5 months ago

@JulieG19 , yes TW team member @tw-sithumyo is working on this ticket. We divided into five parts under this ticket. 1.1 CSR signing from Key Management SVC 1.2 SecureStorage (mongo, local directory, redis, vault) 1.3 Maker/Checker design confirmation 1.4 integration with participant-bc with key-management-svc 1.5 Admin UI changes

The focal Dev can finish the above two tasks during Sprint 1. The rest tasks will be focused in next Sprints.

JulieG19 commented 5 months ago

@bushjames, is this the ticket you have concerned about?

bushjames commented 5 months ago

@JulieG19 this ticket raised my concerns. This is related to JWS key management and is worthy of a review by the DA.