System requirements for eperi sEcure Platform

Installation Requirements

The deployment of eperi sEcure Platform is possible as:

• an automated installation package for Ubuntu, RHEL, and SLES
  Note: The automated installation package requires the following:

  • For RHEL and Ubuntu only: The package vim-common to check if eperi master key is needed during service start
  • For SLES only: The package vim to check if eperi master key is needed during service start
  • The package acl. This is necessary to allow asking for eperi master key by using systemd tools.
  • For SLES only: The packages libcap2 & libcap-progs which are needed to allow opening ports <1024 with delivered java
• a deployment package for Java-based application server
• docker container

Minimum Hardware Requirements

• 2 GHz CPU (with 4 cores)
• 8 GB RAM
• 10 GB disk space

The recommended requirements for your specific use-case depend on the installed adapter and the number of (concurrent) users. Sizing guidelines are available by eperi on request.

Virtual Machine Support

The following VM platforms are supported:

• Hyper-V
• KVM
• VirtualBox 2.2 and higher
• VMWare ESXi 5.5 and higher
• VMWare Workstation 6.5 and higher

Automated installation packages

The automated installation package is supported for the following Linux distributions:

• Ubuntu 20.04 LTS, 22.04 LTS, or 24.04 LTS
• RHEL 7, 8, 9
• CentOS 7, 8, 9
• AlmaLinux 9
• SUSE Linux Enterprise Server 15 SP2-SP4

The automated installation package contains the following:

• Java (AdoptOpenJDK 21 JRE)
• Apache Tomcat 9
• eperi sEcure Platform

Deployment Package for other Linux Application Server Versions

The solution can also be deployed manually as a web application archive (WAR file) to existing web application servers running on other Linux operating systems types and versions.

The following are the most common deployments, though other versions can also be supported:

• AdoptOpenJDK 21 with Hotspot JVM, OpenJDK 21, Oracle Java 21
• Apache Tomcat 9

Deployment of Docker Containers

If you don't want to install eperi sEcure Platform on your system directly, you can alternatively run a docker image containing eperi sEcure Platform. eperi provides docker images for most eperi products through a docker registry. Access can be granted upon request. The docker infrastructure must be provided by the customer. For third-party components such as Solr, eperi does not provide or maintain docker images. Docker images for those components might be available from the according vendor.

Deployment inside a Secure Enclave

Creating and hosting the confidential environment for eperi sEcure Platform

• Using for example "Scontain", an image of eperi sEcure Platform can be created which can run in an enclave, e.g.
  • Azure Confidential VM (VM from the DCv2 series) or Azure Kubernetes Service with SGX enabled nodes
  • Azure Confidential VM on AMD
• They need to to fulfill the following requirements at least:
  • Processors supporting Intel SGX 32 GB of RAM or more

The eperi sEcure Platform database

Configuration data and other data required by eperi sEcure Platform for encryption and tokenization are stored in an external database. The external database must be provided by the customer.

For a production environment, the following databases are supported:

• Oracle 19c or 23ai
• MariaDB 10.2 or higher (both Community and Enterprise Edition are supported)
• Microsoft SQL Server 2016 or higher
• Azure SQL

The database must provide additional space depending on how much data is being tokenized.

Minimum Hardware Requirements for the search engine

For indexing and searching in encrypted data, eperi sEcure Platform uses the open source search platform Apache Solr. For Solr you need the following hardware equipment:

We recommend 8 CPUs (Octacore, physical cores) and 32 GB RAM and installing the latest version Solr v9.5.0 and ZooKeeper v3.8.4.

Network Requirements

Inbound Network Requirements

OS access (for installation) is required via SSH on port 22/tcp.

For administration of eperi sEcure Platform, the management console should be accessible via HTTPS on port 8443/tcp (optionally via http on port 8080/tcp).

If you plan to configure a Reverse Proxy, eperi sEcure Platform should be accessible via HTTPS on port 443/tcp.

If you plan to configure a Forward Proxy, eperi sEcure Platform should be accessible on an additional port which can be freely chosen, e.g. 8081/tcp.

For email delivery eperi sEcure Platform should be accessible via SMTP on port 25/tcp.

If you want to use collaboration features the Office Online Server should be accessible via HTTPS on port 443/tcp. The Office Online Server should also be able to access eperi sEcure Platform via HTTPS on port 8443/tcp (optionally via http on port 8080/tcp).

Outbound Network Requirements

During the licensing process of eperi sEcure Platform, eperi sEcure Platform requires access to the license server at the following address: Eperi Customer Portal page. Please make sure that eperi sEcure Platform is allowed to access the license server.

Ideally eperi sEcure Platform server should be able to download packages from system repositories to install the required dependencies and components.

eperi sEcure Platform should be allowed outbound internet access to all M365 services on port 443/tcp.

For email delivery eperi sEcure Platform should be allowed outbound internet access at least to your Exchange Online mail exchanger as well as to either an outbound mail relay in your organization, or alternatively unrestricted outbound access on SMTP port 25/tcp should be granted.

Email Requirements

If use cases are to be tested including email addresses that have been obfuscated, then additional pre-requisites need to be met. This is dependent on where the eperi sEcure Platform is running.

If it is running in your data center, then it will potentially be necessary to make changes to internal mail systems for forwarding email appropriately. To achieve this, it will be necessary to ensure that your email infrastructure will accept email sent to and from eperi sEcure Platform. This can be quite a burden on internal resources, change control processes and a may be risk of interrupting live services.

Regardless of where eperi sEcure Platform is running, a mailbox capable of receiving these emails is also required. eperi recommends using an internet based test email address such as GMail, a personal email address or an Office 365 test account to reduce the required changes to internal infrastructure.

However if it is essential to enable emails to be delivered to one of your company email addresses, then there may be changes required to your internal email infrastructure, as described above.

For the handling of inbound and outbound emails, it is also required to set up the open-source mail transfer agent Postfix as SMTP Relay. Nevertheless, we recommend a dedicated Mail Transfer Agent (MTA) if you want advanced features such as spam filtering, mail routing, and maintaining reputation. This has the additional advantage that Postfix only needs to be connected to Microsoft 365 and can otherwise remain behind the firewall.

DNS Requirements

In order to set up eperi sEcure Platform, a registered DNS domain is required.

For the example below, the registered domain is crm.example.com.

The DNS should be resolvable both internally and externally. The hostname of eperi sEcure Platform should be resolvable by eperi sEcure Platform.

It is recommended to use a wildcard DNS for this domain, e.g.:

A Record

crm.example.com --> 1.2.3.4 (server IP address)

CNAME Record

*.crm.example.com --> crm.example.com

MX Record

crm.example.com --> crm.example.com

Unless a wildcard certificate is allowed, additional DNS records must be set up for your particular SaaS application that point to the IP address of the eperi sEcure Platform server.

Details can be found in the respective configuration manual for your SaaS application.

SSL Certificate Requirements

Reverse Proxy Certificate Requirements

A PKI SSL certificate is required for the reverse proxy, to ensure that all communication between the end user and eperi sEcure Platform are fully encrypted.

A wildcard certificate from a public CA would be preferred. Alternatively you could use a certificate signed by your internal Certificate Authority, where the CA Cert is generally trusted by your standard desktops / browsers. The use of a self-signed certificate is possible, but not recommended, as it requires additional steps to avoid certificate errors.

eperi sEcure Platform requires a trusted SSL certificate with (as a minimum) the domain name as subject (e.g. crm.example.com) and subject alternative names according to your SaaS application. Details can be found in the respective configuration manual for your SaaS application.

For the setup and installation of eperi sEcure Platform, you will need to obtain:

• the private key
• the certificate
• the certificate chain including root and intermediate CA certificates

This should be created as a PKCS#12 key store, for the import via the eperi sEcure Admin Console.

For instructions on how to create a PKCS#12 key store, please refer to Creating a PKCS#12 key store from a PKCS#7 certificate bundle.

Forward Proxy Certificate Requirements

For using eperi sEcure Platform as a Forward Proxy, an Intermediate or Root CA is required to enable eperi sEcure Platform to create SSL server certificates valid for hostnames of your SaaS application.

On iOS devices, it is only possible to fully trust a root certificate. Therefore, you are required to create a Root CA instead of an Intermediate CA. In case you do not plan to use iOS devices, an Intermediate CA is enough.

This should be created as a PKCS#12 key store, for the import via the eperi sEcure Admin Console.

For using eperi sEcure Platform as Forward Proxy, it is necessary that the Intermediate or Root CA Certificate is trusted by your clients / browsers which will be used for testing.

Tool Requirements

You should install any necessary tools needed to access the eperi sEcure Platform server over SSH, e.g.:

• PuTTY or another SSH tool for accessing the Linux shell
• WinSCP or another SCP tool for copying files across to the server

Additional requirements depending on the SaaS application

Depending on the SaaS application for which you are using eperi sEcure Platform, additional requirements must be observed. Details can be found in the configuration manual of your respective SaaS application.