| Documentation | Python sample project | Ruby sample project | Examples |
|---|
Acra helps you easily secure your databases in distributed, microservice-rich environments. It allows you to selectively encrypt sensitive records with strong multi-layer cryptography, detect potential intrusions and SQL injections and cryptographically compartmentalize data stored in large sharded schemes. Acra's security model guarantees that if your database or your application become compromised, they will not leak sensitive data, or keys to decrypt them.
Acra gives you means to encrypt the data on the application's side into a special cryptographic container, and store it in the database and then decrypt in secure compartmented area (separate virtual machine/container). Cryptographic design ensures that no secret (password, key, anything) leaked from the application or database is sufficient for decryption of the protected data chunks that originate from it.
Acra was built with specific user experiences in mind:
- quick and easy integration of security instrumentation.
- cryptographic protection of data in the threat model where all other parts of the infrastructure could be compromised, and if AcraServer isn't compromised, the data is safe.
- proper abstraction of all cryptographic processes: you're safe from the risk of choosing the wrong key length or algorithm padding.
- strong default settings to get you going.
- intrusion detection to let you know early that something wrong is going on.
- high degree of configurability to create perfect balance between the extra security features and performance.
- automation-friendly: most of Acra's features were built to be easily configured / automated from configuration automation environment.
- limited attack surface: to compromise Acra-powered app, an attacker will need to compromise the separate compartmented server, AcraServer - more specifically - it's key storage, and the database.
Acra is still a product on a very early development stage: any security tools require enourmous human efforts for validation of the methods, code, and finding possible infrastructural weaknesses. Although we do run Acra in production in several instances, we're continuously enhancing it as we go to everyone's benefit. And Acra still needs ruthless dissection of all of its properties to ensure that the provided security benefits are not rendered useless through implementation problems or increased complexity.
Acra relies on our cryptographic library Themis, which implements high-level cryptosystems based on the best availble open-source implementations of the most reliable ciphers. Acra does not contain any self-made cryptographic primitives or obscure ciphers. Instead, to deliver its unique guarantees, Acra relies on the combination of well-known ciphers and smart key management scheme.
- Acra source builds and tests with Go versions 1.6 – 1.10.
- Acra is known to build on:
| Distributive | Go versions |
|---|---|
| CentOS | 1.8.3 (system) |
| Debian Stretch | 1.7.4 (system) |
| Debian Jessie | latest (1.3.3 is not supported) |
| Debian Wheezy | latest (1.0.2 is not supported) |
| Ubuntu Artful | 1.8.3 (system) |
| Ubuntu Xenial | 1.6.2 (system) |
| Ubuntu Trusty | latest (1.2.1 is not supported) |
| i386/Debian Stretch | 1.7.4 (system) |
| i386/Debian Jessie | latest (1.3.3 is not supported) |
| i386/Debian Wheezy | latest (1.0.2 is not supported) |
| i386/Ubuntu Artful | 1.8.3 (system) |
| i386/Ubuntu Xenial | 1.6.2 (system) |
| i386/Ubuntu Trusty | latest (1.2.1 is not supported) |
- Acra currently supports PostgreSQL 9.4+ as the database backend; MongoDB and MariaDB (and other MySQL flavours) coming quite soon.
- Acra has writer libraries for Ruby, Python, Go, and PHP, but you can easily generate AcraStruct containers with Themis for any platform you want.
After successfully deploying and integrating Acra into your application, follow the 4 steps below:
- Your app talks to AcraProxy, local daemon, via PostgreSQL driver. AcraProxy emulates your normal PostgreSQL database, forwards all the requests to AcraServer over a secure channel, and expects back plaintext output. Then AcraProxy forwards it over the initial PostgreSQL connection to the application. It is connected to AcraServer via Secure Session, which ensures that all the plaintext goes over a protected channel. It is highly desirable to run AcraProxy via a separate user to compartmentalise it from the client-facing code.
- AcraServer is the core entity that provides decryption services for all the encrypted envelopes that come from the database, and then re-packs database answers for the application.
- To write protected data to the database, you can use AcraWriter library, which generates AcraStructs and helps you integrate it as a type into your ORM or database management code. You will need Acra's public key to do that. AcraStructs generated by AcraWriter are not readable by it - only the server has the right keys to decrypt it.
- You can connect to both AcraProxy and the database directly when you don't need encrypted reads/writes. However, increased performance might cost you some design elegance (which is sometimes perfectly fine when it's a conscious decision).
To better understand the architecture and data flow, please refer to Architecture and data flow section in the official documentation.
The typical workflow looks like this:
- The app encrypts some data using AcraWriter, generating AcraStruct with AcraServer public key, and updates the database.
- The app sends SQL request through AcraProxy, which forwards it to AcraServer, AcraServer forwards it to the database.
- Upon receiving the answer, AcraServer tries to detect encrypted envelopes (AcraStructs). If it succeeds, AcraServer decrypts payload and replaces them with plaintext answer, which is then returned to AcraProxy over a secure channel.
- AcraProxy then provides an answer to the application, as if no complex security instrumentation was ever present within the system.
- Read the Wiki page on building and installing all the components. Soon they'll be available as pre-built binaries, but for the time being you'll need to fire a few commands to get the binaries going.
- Deploy AcraServer binaries in a separate virtual machine (or try it in a docker container). Generate keys, put AcraServer public key into both clients (AcraProxy and AcraWriter, see next).
- Deploy AcraProxy on each server where you need to read sensitive data. Generate proxy keys, provide a public key to AcraServer. Point your database access code to AcraProxy, access it as your normal database installation.
- Integrate AcraWriter into your code where you need to store sensitive data, supply AcraWriter with proper server key.
We fill the Wiki documentation with useful articles about the core Acra concepts, use cases, details on cryptographic and security design.
You might want to:
- Read the notes on security design to better understand what you get with using Acra and what is the threat model that Acra operates in.
- Read some notes on making Acra stronger / more productive and efficient, and on adding security features or increasing throughput, depending on your goals and security model.
This open source version of Acra is an early alpha. We're slowly unifying and moving features from its previous incarnation into a community-friendly edition. Please let us know in the Issues whenever you stumble upon a bug, see a possible enhancement or have a comment on security design.
If you’d like to contribute your code or other kind of input to Acra, you’re very welcome. Your starting point for contributing should be this Contribution Wiki page.
Acra is licensed as Apache 2 open source software.
If you want to ask a technical question, feel free to raise an issue or write to dev@cossacklabs.com.
To talk to the business wing of Cossack Labs Limited, drop us an email to info@cossacklabs.com.
