Python data encryption

This module provides a package for encrypting Python based pipeline data. There are multiple encryption algorithms available. Each with their own strengths and weaknesses as outlined below.

The following example illustrates how to perform encryption.

1. Example usage

   • Add the following to your code

   VaultRemoteEncryptionStrategy

   # Uses remote Vault encryption
   from aiops_encrypt.vault_remote_encryption_strategy import VaultRemoteEncryptionStrategy
   
   vault_remote = VaultRemoteEncryptionStrategy()
   
   # encrypt plain text data using Vault
   encrypted_value = vault_remote.encrypt('SOME PLAIN TEXT')
   
   # decrypt cipher text data using Vault
   decrypted_value = vault_remote.decrypt(encrypted_value)
   

   NOTE: If you are encrypting your data through a User Defined Function (udf) in PySpark you need to use the VaultLocalEncryptionStrategy (see below). Currently the remote version causes threading issues. This issue will likely be resolved in a future update to the Hashicorp Vault client

   VaultLocalEncryptionStrategy

   # Uses an encryption key retrieved from the Vault server, but performs the encryption locally.
   from aiops_encrypt.vault_local_encryption_strategy import VaultLocalEncryptionStrategy
   
   vault_local = VaultLocalEncryptionStrategy()
   
   # encrypt plain text data using local Vault
   encrypted_value = vault_local.encrypt('SOME PLAIN TEXT')
   
   # decrypt cipher text data using local Vault
   decrypted_value = vault_local.decrypt(encrypted_value)
   

   AesCbcEncryptionStrategy

   # Uses the AES CBC encryption
   from aiops_encrypt.aes_cbc_encryption_strategy import AesCbcEncryptionStrategy
   
   aes_cbc = AesCbcEncryptionStrategy()
   
   # encrypt plain text data using AES CBC
   encrypted_value = aes_cbc.encrypt('SOME PLAIN TEXT')
   
   # decrypt cipher text data using AES CBC
   decrypted_value = aes_cbc.decrypt(encrypted_value)
   

   AesGcm96EncryptionStrategy

   # AES GCM encryption with a 96 bit initialization vector (same algorithm as Vault)
   from aiops_encrypt.aes_gcm_96_encryption_strategy import AesGcm96EncryptionStrategy
   
   aes_gcm_96 = AesGcm96EncryptionStrategy()
   
   # encrypt plain text data using AES GCM
   encrypted_value = aes_gcm_96.encrypt('SOME PLAIN TEXT')
   
   # decrypt cipher text data using AES CBC
   decrypted_value = aes_gcm_96.decrypt(encrypted_value)
   

AISSEMBLE™ Data Encryption

This package includes one security client for calling the "Secrets as a Service" encryption service.

Vault encryption

See the extensions-encryption README for more information on how to configure Vault encryption.