6. BayunCoreSDK Operations

The BayunCore class contains public methods for locking and unlocking of files, text and data.

Encryption Policy

Use of encryption-policy, as optional argument in lock function, allows the developer to bind a specific access-policy to the data being locked. The Bayun SDK will automatically choose the right encryption-keys (creating new ones as necessary), in conjunction with the Bayun Lockbox Management Server, and putting these keys in a hierarchy of lockboxes, such that the applied policy is enforceable on the locked data irrespective of any software (potentially hacked) being used to access the data. If no policy is explicitly specified by the developer at the time of locking the data, the default policy dictated by the server is used as specified in the admin-panel settings for that company and user.

The actual policy applied to the data is a combination of the encryption-policy specified in lock function and the policy dictated by the server based on settings. The developer-specified policy passed as argument to the lock function in the code always takes precedence over the default policy specified by the server. It is expected that the developer can choose the right access policy based on the business-logic of the application and context of the data being locked. Otherwise it is okay to leave the policy to DEFAULT in code here, and let the admin define de-facto rules to apply for each user and/or company.

NONE : No encryption is performed. The lock function acts as a simple passthrough for data. But all accounting on data-access patterns is still performed for reporting in the admin-panel, so that complete visibility into all lock/unlock operations is still maintained.

DEFAULT : Locking/unlocking is performed according to the policy dictated by the server based on admin-panel settings.

COMPANY : Locking/unlocking is performed using company key i.e the enterprise encryption key. Every employee of the same company will have access to this enterprise encryption key in their lockbox, and so will technically be able to access this data.

EMPLOYEE: Locking/unlocking is performed using individual employee key. Nobody other than the user herself has access to this encryption-key, and so nobody else will be able to access this data.

GROUP : Locking/unlocking is performed using group key. A groupId has to be specified while using this policy. Only members of the specified group will be able to access this data (see the Groups section in this Guide for details).

Key Generation Policy

Use of key generation policy, as optional argument in lock function, allows the developer to determine the policy to generate Encryption Key for the data being locked. If no policy is explicitly specified by the developer at the time of locking the data, the default policy dictated by the server is used as specified in the admin-panel settings for that company and user.

The developer-specified policy passed as argument to the lock function in the code always takes precedence over the default policy specified by the server. Unless the developer has a specific reason to use a particular policy for key generation to encrypt any particular piece of data, it is best to leave this to default so that the admin can choose the right policy in most cases.

DEFAULT : Encryption of every data object is done with the key generated according to the key generation policy dictated by the server based on admin-panel settings.

STATIC : Encryption of every data object is done with same key, that is derived from the Base Key. The Base Key is determined by the Policy tied to the object being locked (e.g. CompanyKey, EmployeeKey, GroupKey).

ENVELOPE : Every data object is encrypted with its own unique key that is randomly generated. The random key itself is kept encrypted with a key derived from the Base Key.

CHAIN : Every data object is encrypted with its own unique key, that is derived from the Base Key using a multi-dimensional chaining mechanism.

Operations

Here is the list of operations that can be performed using BayunSDK

page6.1 Lock/Unlock Filepage6.2 Lock/Unlock Textpage6.3 Lock/Unlock Datapage6.4 Get Locking Key