KafkaProxy: data-at-rest encryption and confidentiality support for Kafka clusters - Silva, Fábio; Silva, Matteus; Brito, Andrey (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg), 2020)
Apache Kafka has become a popular tool for building distributed systems. It supports a diversity of use cases that benefit from decoupled N-to-M communication such as publishing IoT data, decoupling and load-balancing microservices, and serve as a central hub for data in a distributed application. Nevertheless, Kafka's security is restricted to encrypted communications and authentication, leaving data unprotected in memory and on the disks. In this work, we design and implement a transparent, drop-in component that provides encryption to incoming and outgoing data in a Kafka cluster. Our component leverages confidential computing techniques not only to ensure data-at-rest encryption, but also to protect data and encryption keys from the operators of the Kafka Cluster. Our evaluation shows that the KafkaProxy can handle message streams with latency overhead of around 10%. Finally, in cases where throughput is impacted, simple replication of the KafkaProxy can mitigate the issue.