io.confluent.kafka.schemaregistry.encryption

Class FieldEncryptionExecutor

java.lang.Object

io.confluent.kafka.schemaregistry.rules.FieldRuleExecutor

io.confluent.kafka.schemaregistry.encryption.FieldEncryptionExecutor

All Implemented Interfaces:

RuleBase, RuleExecutor, AutoCloseable, org.apache.kafka.common.Configurable

public class FieldEncryptionExecutor
extends FieldRuleExecutor

In envelope encryption, a user generates a data encryption key (DEK) locally, encrypts data with the DEK, sends the DEK to a KMS to be encrypted (with a key managed by KMS - KEK), and then stores the encrypted DEK. At a later point, a user can retrieve the encrypted DEK for the encrypted data, use the KEK from KMS to decrypt the DEK, and use the decrypted DEK to decrypt the data.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
class	FieldEncryptionExecutor.FieldEncryptionExecutorTransform

Field Summary

Fields

Modifier and Type	Field and Description
static String	CACHE_EXPIRY_SECS
static String	CACHE_SIZE
static String	CLOCK
static byte[]	EMPTY_AAD
static String	ENCRYPT_ALTERNATE_KMS_KEY_IDS
static String	ENCRYPT_DEK_ALGORITHM
static String	ENCRYPT_DEK_EXPIRY_DAYS
static String	ENCRYPT_KEK_NAME
static String	ENCRYPT_KMS_KEY_ID
static String	ENCRYPT_KMS_TYPE
static String	KMS_TYPE_SUFFIX
protected static int	LATEST_VERSION
protected static byte	MAGIC_BYTE
protected static int	MILLIS_IN_DAY
static String	TYPE
protected static int	VERSION_SIZE

Fields inherited from class io.confluent.kafka.schemaregistry.rules.FieldRuleExecutor

PRESERVE_SOURCE_FIELDS

Fields inherited from interface io.confluent.kafka.schemaregistry.rules.RuleBase

DEFAULT_NAME

Constructor Summary

Constructors

Constructor and Description
FieldEncryptionExecutor()

Method Summary

Modifier and Type	Method and Description
boolean	addOriginalConfigs()
void	close()
void	configure(Map<String,?> configs)
protected byte[]	generateDek(DekFormat dekFormat)
Map<DekFormat,Cryptor>	getCryptors()
FieldEncryptionExecutor.FieldEncryptionExecutorTransform	newTransform(RuleContext ctx)
String	type()

Methods inherited from class io.confluent.kafka.schemaregistry.rules.FieldRuleExecutor

isPreserveSource, transform

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

TYPE

public static final String TYPE

See Also:

Constant Field Values

ENCRYPT_KEK_NAME

public static final String ENCRYPT_KEK_NAME

See Also:

Constant Field Values

ENCRYPT_KMS_KEY_ID

public static final String ENCRYPT_KMS_KEY_ID

See Also:

Constant Field Values

ENCRYPT_KMS_TYPE

public static final String ENCRYPT_KMS_TYPE

See Also:

Constant Field Values

ENCRYPT_DEK_ALGORITHM

public static final String ENCRYPT_DEK_ALGORITHM

See Also:

Constant Field Values

ENCRYPT_DEK_EXPIRY_DAYS

public static final String ENCRYPT_DEK_EXPIRY_DAYS

See Also:

Constant Field Values

ENCRYPT_ALTERNATE_KMS_KEY_IDS

public static final String ENCRYPT_ALTERNATE_KMS_KEY_IDS

See Also:

Constant Field Values

KMS_TYPE_SUFFIX

public static final String KMS_TYPE_SUFFIX

See Also:

Constant Field Values

EMPTY_AAD

public static final byte[] EMPTY_AAD

CACHE_EXPIRY_SECS

public static final String CACHE_EXPIRY_SECS

See Also:

Constant Field Values

CACHE_SIZE

public static final String CACHE_SIZE

See Also:

Constant Field Values

CLOCK

public static final String CLOCK

See Also:

Constant Field Values

LATEST_VERSION

protected static final int LATEST_VERSION

See Also:

Constant Field Values

MAGIC_BYTE

protected static final byte MAGIC_BYTE

See Also:

Constant Field Values

MILLIS_IN_DAY

protected static final int MILLIS_IN_DAY

See Also:

Constant Field Values

VERSION_SIZE

protected static final int VERSION_SIZE

See Also:

Constant Field Values

Constructor Detail

FieldEncryptionExecutor

public FieldEncryptionExecutor()

Method Detail

addOriginalConfigs

public boolean addOriginalConfigs()

configure

public void configure(Map<String,?> configs)

Specified by:

configure in interface RuleBase

Specified by:

configure in interface org.apache.kafka.common.Configurable

Overrides:

configure in class FieldRuleExecutor

type

public String type()

newTransform

public FieldEncryptionExecutor.FieldEncryptionExecutorTransform newTransform(RuleContext ctx)
                                                                      throws RuleException

Specified by:

newTransform in class FieldRuleExecutor

Throws:

RuleException

getCryptors

public Map<DekFormat,Cryptor> getCryptors()

generateDek

protected byte[] generateDek(DekFormat dekFormat)
                      throws GeneralSecurityException

Throws:

GeneralSecurityException

close

public void close()
           throws RuleException

Throws:

RuleException