[NIFI-3890] Create Key Management Controller Service

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Abandoned
• Affects Version/s: 1.2.0
• Component/s: Extensions
• Labels: encryption key-management metadata security
• Assignee: Unassigned
• Reporter: Andy LoPresto
• Created: 12/May/17 20:24
• Updated: 03/Jan/24 02:57
• Resolved: 03/Jan/24 02:57

Description

Similar to the KeyProvider interface and various backing implementations for the EncryptedWriteAheadProvenanceRepository, a generic KeyManagementControllerService should be made available so that other controller services, reporting tasks, and processors can reference it and retrieve the necessary keys to perform their cryptographic operations.

It can be backed by a variety of implementations (file-based, static, database, HSM, etc.).

It should have extensive auditing and granular access controls to restrict both user interaction and component interaction.

Issue Links

• depends upon: NIFI-4139 Refactor KeyProvider interface from provenance module to framework-level service
• Is contained by: NIFI-5458 Improve NiFi TLS and certificate management
• is depended upon by: NIFI-3889 EncryptContent processor should add encryption metadata as attributes
• is depended upon by: NIFI-3929 Allow external key management for EncryptContent processor
• is related to: NIFI-6617 Implement Encrypted Repository Shared Configuration
• is related to: NIFI-1995 Support keystores with multiple certificates by exposing alias selection in configuration
• relates to: NIFI-10667 Add Private Key Controller Service