Security & Data Protection

Security & Data Protection

This page describes the security architecture, encryption, authentication, and data protection mechanisms in uControl Insight.

Encryption at Rest

Credential Storage

All discovery credentials (SSH passwords, private keys, SNMP community strings, API tokens, WinRM passwords, etc.) are encrypted before being stored in the database.

The encrypted payload is stored in the credentials.encrypted_payload column. The kv (key version) field supports future key rotation — decrypt with old key, re-encrypt with new key.

Worker Agent Credential Storage

Worker agents that store credentials locally use the same AES-256-GCM encryption. The worker's master key is stored in ./data/worker.key (auto-generated on first run). The worker's H2 database stores encrypted credential payloads identical to the control plane format.

Backup Encryption

When creating backups, the master key is encrypted using:

• Key derivation: PBKDF2 with HMAC-SHA256, 100,000 iterations, 128-bit random salt
• Encryption: AES-256-GCM with 96-bit random IV
• Input: User-provided backup password (minimum 8 characters)

This means backup files are safe to store on disk, S3, or any storage — the master key cannot be extracted without the backup password.

Password Storage

User passwords are hashed using bcrypt (Spring Security default) with a cost factor of 10. Passwords are never stored in plaintext or reversible encryption.

Encryption in Transit

Web UI & API

Discovery Protocols

Authentication & Authorisation

Multi-Layer Authentication

uControl Insight supports four authentication methods, processed in order by Spring Security filter chains:

Role-Based Access Control (RBAC)

Users can have multiple roles (e.g. DISCOVERY_ADMIN + API_USER).

API Key Security

• Integration keys (ucm_) — SHA-256 hashed before storage. Only the prefix is stored for identification. The full key is shown once at generation time.
• User API tokens (uci_) — Same SHA-256 hashing. Inherits the generating user's roles.
• Worker API keys (uck_) — SHA-256 hashed. Scoped to a site label. Can be revoked and deleted.

Session Security

• Session timeout: 8 hours
• Cookies: HttpOnly (no JavaScript access), SameSite=Strict (CSRF protection), Secure flag configurable
• CSRF protection enabled on all form submissions (Thymeleaf auto-includes CSRF tokens)

Database Security

• Database credentials stored in environment variables (not in application config files)
• Connection pool: HikariCP with connection-level timezone enforcement (SET time_zone='+00:00')
• All user input is parameterised via JdbcTemplate or Spring Data JDBC — no SQL injection vectors
• Flyway migrations validate schema integrity on every startup

Audit Trail

All security-relevant actions are logged to the audit_events table:

• User login / logout
• Credential CRUD operations (create, update, delete)
• Discovery target changes
• User management (create, update, disable, role changes)
• API key generation and revocation
• Worker registration and deregistration
• Backup creation and restore operations

Each audit event records: event type, actor (username), target type, target ID, details (JSON), IP address, and timestamp.

Network Security Recommendations

Control Plane

• Deploy behind a TLS-terminating reverse proxy (Apache, Nginx, or cloud ALB)
• Restrict management ports (8080/8180) to internal networks
• Use a dedicated database user with minimal privileges (GRANT on application database only)
• Set UCONTROL_MASTER_KEY via environment variable, not in config files

Worker Agents

• Workers require no inbound ports for core operation (outbound HTTPS only)
• If flow collection is enabled: inbound UDP 2055/4739 from network exporters only
• Store worker.key with restricted file permissions (chmod 600)
• Worker API keys can be revoked immediately from the control plane if compromised

Discovery Targets

• Use dedicated service accounts with minimum required privileges for each platform
• Rotate credentials regularly — credential match patterns allow scoped access
• For SNMP: prefer SNMPv3 over v2c in production environments
• For VMware/Proxmox: use read-only roles where full admin is not needed

Compliance Considerations