Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Showing
1 changed file
with
28 additions
and
19 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,20 +1,29 @@ | ||
## Overview | ||
|
||
## locker phases | ||
|
||
### phase 1 | ||
working locker | ||
- configuration: pull configuration from toml file and environment variables | ||
- cards api: ability to perform add, retrieve, delete card actions | ||
- jwe + jws: encryption and signing middleware with keys passed in [`configuration`] | ||
- master key to be passed in configuration | ||
- key custodian: add support to decrypt the master key before starting the server | ||
|
||
### phase 2 | ||
- tenant api for adding and deleting tenants | ||
- add support for *kms* encryption on the environment variables | ||
- adding logging and metrics for locker | ||
- tenant specific jwe public key storage and utilizing key_id for identification | ||
- docker + kubernetes setup for infra deployment | ||
|
||
### phase 3 (optional) | ||
- add support for key rotation | ||
The Hyperswitch Card Vault (Tartarus) is a highly performant and a secure vault to save sensitive data such as payment card details, bank account details etc. | ||
|
||
It is designed in an polymorphic manner to handle and store any type of sensitive information making it highly scalable with extensive coverage of payment methods and processors. | ||
|
||
Tartarus is built with a GDPR compliant personal identifiable information (PII) storage and secure encryption algorithms to be fully compliant with PCI DSS requirements. | ||
|
||
Here's a quick guide to [Get Started](https://github.com/NishantJoshi00/tartarus/blob/main/docs/guides/setup.md) with setting up Tartarus. | ||
|
||
### How does Tartarus work? | ||
|
||
- Your application will communicate with Tartarus via a middleware. | ||
- All requests and responses to and from the middleware are signed and encrypted with the JWS and JWE algorithms. | ||
- The locker supports CRD APIs on the /data and /cards endpoints - <API Reference to be linked> | ||
- Cards are stored against the combination of merchant and customer identifiers. | ||
- Internal hashing checks are in place to avoid data duplication. | ||
|
||
![General Work Flow](https://drive.google.com/file/d/17zDZpVRIKd1r1WmgJL0HMyxIZCeZV_V1/view?usp=sharing) | ||
|
||
### Key Hierarchy | ||
|
||
- Master Key - AES generated key to that is encrypted/decrypted by the custodian keys to run the locker and associated configurations. | ||
- Custodian Keys - AES generated key that is used to encrypt and decrypt the master key. It broken into two keys (key 1 and key 2) and available with two custodians to enhance security. | ||
|
||
![Key Hierarchy](https://drive.google.com/file/d/1-kyrFL72nJ41lx2WTVvgH69_mUey3F4S/view?usp=sharing) | ||
|
||
### Setup Guide | ||
Follow this guide to setup Tartarus - [Get Started](https://github.com/NishantJoshi00/tartarus/blob/main/docs/guides/setup.md) |