KafkaProxy: data-at-rest encryption and confidentiality support for Kafka clusters
Resumo
Apache Kafka has become a popular tool for building distributed systems. It supports a diversity of use cases that benefit from decoupled N-to-M communication such as publishing IoT data, decoupling and load-balancing microservices, and serve as a central hub for data in a distributed application. Nevertheless, Kafka's security is restricted to encrypted communications and authentication, leaving data unprotected in memory and on the disks. In this work, we design and implement a transparent, drop-in component that provides encryption to incoming and outgoing data in a Kafka cluster. Our component leverages confidential computing techniques not only to ensure data-at-rest encryption, but also to protect data and encryption keys from the operators of the Kafka Cluster. Our evaluation shows that the KafkaProxy can handle message streams with latency overhead of around 10%. Finally, in cases where throughput is impacted, simple replication of the KafkaProxy can mitigate the issue.
Referências
Arnautov, S., Trach, B., Gregor, F., Knauth, T., Martin, A., Priebe, C., Lind, J., Muthukumaran, D., O’Keeffe, D., Stillwell, M. L., Goltzsche, D., Eyers, D., Kapitza, R., Pietzuch, P., and Fetzer, C. (2016). SCONE: Secure linux containers with intel SGX. In 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI 16), pages 689–703, Savannah, GA. USENIX Association.
Barbosa, P., Freitas, L., Brito, A., and Silva, L. (2016). Privacy preserving techniques in smart metering: An overview. In Proceedings of the 16th Brazilian Symposium on Information and Computational Systems Security. Sociedade Brasileira de Computação.
Borges, F. (2017). On Privacy-Preserving Protocols for Smart Metering Systems: Security and Privacy in Smart Grids.
Eugster, P. T., Felber, P. A., Guerraoui, R., and Kermarrec, A.-M. (2003). The many faces of publish/subscribe. ACM Comput. Surv., 35(2):114–131.
Figueiredo, M., de Almeida, A., and Ribeiro, B. (2012). Home electrical signal disaggregation for non-intrusive load monitoring (nilm) systems. Neurocomputing, 96:66 – 73. Adaptive and Natural Computing Algorithms.
Maene, P., Götzfried, J., de Clercq, R., Müller, T., Freiling, F., and Verbauwhede, I. (2018). Hardware-based trusted computing architectures for isolation and attestation. IEEE Transactions on Computers, 67(3):361–374.
Mukhtar, M. A., Bhatti, M. K., and Gogniat, G. (2019). Architectures for security: A comparative analysis of hardware security features in intel sgx and arm trustzone. In 2019 2nd International Conference on Communication, Computing and Digital systems (C-CODE), pages 299–304.
Pires, R., Pasin, M., Felber, P., and Fetzer, C. (2016). Secure content-based routing using intel software guard extensions. In Proceedings of the 17th International Middleware Conference, Middleware ’16, New York, NY, USA. Association for Computing Machinery.
Sampaio, L., Silva, F., Souza, A., Brito, A., and Felber, P. (2017). Secure and privacy-aware data dissemination for cloud-based applications. In Proceedings of The 10th International Conference on Utility and Cloud Computing, UCC ’17, page 47–56, New York, NY, USA. Association for Computing Machinery.
Silva, L., Marinho, R., Brito, A., and Barbosa, P. (2016). Agregação de dados na núvem com garantias de segurança e privacidade. In Proceedings of the 16th Brazilian Symposium on Information and Computational Systems Security. Sociedade Brasileira de Computação.
Weichbrodt, N., Aublin, P.-L., and Kapitza, R. (2018). sgx-perf: A performance analysis tool for intel sgx enclaves. In Proceedings of the 19th International Middleware Conference, pages 201–213.
