Scale By The Bay 2020: Prashant Sharma, Apache Spark meets FIPS standard

Scale By The Bay 2020: Prashant Sharma, Apache Spark meets FIPS standard

Recording: Scale By The Bay 2020: Prashant Sharma, Apache Spark meets FIPS standard

[Music] good morning evening or afternoon everyone based on your respective time zones apache spark meets reps federal information processing standards a bit about me and scrap codes on twitter and github and my key key focus areas in apache spark are structured streaming and spark on kubernetes i'm also part of kubernetes release team for 1.20 um my group kudai which is center for open source data and ai technologies we are focused on we are focused on open source uh and we are a group of like 40 plus developers and some of us work on the key projects which are part of any typical machine learning pipeline for example tensorflow pytorch party spark cycle and so on the question why do we need encryption for big data processing engines like apache spark we enterprises are handling confidential data be it sensitive private personal information and the government bodies large enterprises like banks healthcare industry telecommunications sector today all of them have to come have to comply with some kind of regulation or compliance for example gdpr or ccpa why do certain enterprises build their own solution rather than license from others so this question uh shows the importance of how important it is to comply with these compliance the risk of not complying and loss of users personal data can have way more serious reproductions in the form of lawsuits than um you know the expense incurred in the achieving those compliance so many enterprises go all the way in the investments to for example men a general solution taken is you know have a cloud vpn in some cases on prime deployment and even up to the point of build my own solutions using you know open source stack and come up with their own as a service as an example as of today many organizations have some form of spark as a service implementation of their own which of course they could have licensed can we still use the convenience of a cloud platform while we handle sensitive data so yes and a bit about fips federal information processing processing standards which are you know issued are standardized announced by nist national institutes of standards and technologies which is a u.s government agency and phipps is one such standard which gives guidance on the encrypt encryption algorithms and and the key sizes which are secure enough for large enterprises bring your own key and fips standard of encryption the combination of this achieves the highest level of security what is bring your own key it is that only the user controls the keys used to encrypt the data loss of keys renders the data that is encrypted inaccessible even to the cloud provider so how this happens the keys are stored in the most secure computing environment you know fibs certified cloud hsm which is like a dedicated hardware for storing keys um ensures that they are stored in a tamper-proof way and and any any uh loss of keys simply means the data is inaccessible for the both for the user and the cloud provider and since the data is encrypted by the user-provided keys the cloud providers in themselves cannot access the data we'll cover this concept in a brief envelope encryption so this is what works underneath any bring your own key implementation today this diagram looks familiar to all of us there is an unencrypted data data encryption key and we apply aes algorithm and we get encrypted data what is special here is that this encrypted data and the data encryption key which was used to encrypt that data are both encrypted the key itself is encrypted which is called wrapping wrapping up the key and the and the key used to wrap the user uh the encrypting dek data encryption key is the user provided key and that key stays safe in a cloud hsm and never leaves that system the benefit of this is that when encrypted data and rap decay are stored at rest in any storage no one can access the data unless they have access to the root key which are protected in a in a secure cloud hsm instance so we we discussed the cloud provider cannot use the data and if the keys are lost the data becomes permanently inaccessible keys are protected inside of physical hardware that is cloud ssm which are fips level four certified which is like highest level of uh security certification in the fips standard now in a typical deployment there is an openshift cluster or you know kubernetes cluster there are apache spark nodes and and each node has either a driver or an executor running on them there is a cloud object storage and a key management service key management service is an interface to access the user key the service it provides are for example wrapping a decay and unwrapping a decay wrapping is encrypting the key with the user provided key and unwrapping is reversing that so in this case openshift has an integration for you know bring your own key and so does cloud object storage how they do it that all of their internal communication between the nodes happen over ssl and the keys used to perform that ssl communication is accessed through the key management service by these get wrapped dek requests in this way the data that flows even on the network or is stored at rest all are encrypted through the user provided keys similarly even the cloud object storage uses this key management service to wrap the data encryption key in this way the data is not accessible even to the cloud provider when we say an application is fips compliant or a system is fixed compliant or a library is facebook what does it mean it means the software is using communication and storing data at rest and the encryption algorithms used are approved by fifth standard as stated in the as stated by nist fips mode allows only a subset of encryption algorithm let's take a case in point [Music] for example open ssl which has a fips compliant mode and also a default mode so this example i have listed all the encryption ciphers which supports key exchanges rsa and this includes even those which are weaker encryption algorithms for example nulsha null md5 and so on the same open ssl which is in fips mode when we do version we get fibs and when i list the ciphers with fips i get a subset of what we saw on the previous screen the the starting from 3des from on the bottom up to the aes 256 gcm you know sha 384 cipher all of these are supported by the fibs standard and are pretty strong encryption algorithms a smaller key size for example aes 128 is probably more performant in terms of processing speeds but is weaker in in the encryption strength and similarly aes 256 would be the strongest here let's take java for exa as as if example of fibs compliance in java or a jdk the compliance is achieved by configuration of security policies oracle offers its guidance i have the link provided if you want to check it out and they list the set of uh algorithms or encryption ciphers and key strengths which are which are supported or which are allowed approved by the fib standard similarly ibm sdk also has a security you know policy configuration not only that they also provide specific security providers java security providers which are validated for uh by the fips compliance like they have a cmvp program they are validated so coming to spark security has four parts authentication i o encryption for storage network encryption you know and web interface where we see the spark ui has an ssl support how we make spark fibs compliant first step is to make the underlying operating system stack fips compliant then comes the libraries that spark depends on also fibs compliance more specifically the libraries which provide encryption fixed compliant for example open ssl jdk jdk as we discussed on the previous slide they have security policies and can be configured to achieve the compliance then we configure the spark itself to use the compliant algorithms over the uncompliant ones we optionally are can use a stronger you know pkcs11 provider and see how we configure that pkcs has pkcs 11 has and is just an api interface to offer encryption which is further which is implemented which has implementation in open source and also many hardware accelerators provide libraries which are pkcs 11 api which have pkcs 11 compliant apis so lastly we'll get back to our open shift and bring your own key and how this achieves the security even on cloud so first step making the operating system of ips compliant you know unless the os itself provides the compliance mode it can be very difficult to set up for example like in previous slide openssl has both fibs mode and the default mode one would have to compile a library with fibs flag on to get the fips version of it and similarly when a number of libraries are used for example one maybe uses mozilla nss library or open ssl libraries and and there are a number of them operating system itself uses a lot of communication which needs to be encrypted as well so unless the operating system offers a compliant version it's very it can be very very difficult to set up so i am personally aware of red hat which has a compliant mode instruction is available and i have i'm also aware about ubuntu which also has a you know option for a paid version which which has a fips mode this is an example of setting up a pkcs 11 provider in the mozilla and you know you provide a p you know provide a nss configuration and set up the provider in the java.security file like in this example i have configured the down under the order is also very important as the algorithms are searched in this order one two and three like that so we already saw this oracle offers the guidance on this and so does ibm jdk and both of them have a common in this in their setup that we need to set up their security policy files to use the right algorithms approved algorithms or providers for that matter fips compliant for spark this is a configuration example and which i have used pretty good very good key strengths and use the secure random spk cs11 since the jdk is configured to use pkcs 11 we can use them in spark as well underneath spark uses either the open ssl library as [Music] provided by the operating system or it uses the java version of these encryption algorithms or ciphers so we need to make sure both of them are also fibs compliant coming back to reviewing our openshift cluster so after uh what if all of this setup is already provided for example an open shift which is compliant fibs compliant already make sure that operating system is compliant and all the network communication and storage data at rest is also encrypted and with the compliant approved fips approved algorithms so when any application this is spark as a example is just an example any application running over openshift can leverage these uh and leverage the compliance much easily or can benefit from the com the setup much easily than going for their own setup as we just saw which can be pretty difficult so this integra this inbuilt bring your own key integration in openshift makes it very convenient to achieve encryption or to achieve fips compliance and very strong security processing big data we covered processing big data on hybrid cloud why how we can uh be still compliant and use the hybrid benefit of hybrid cloud the cost factor and the time factor we also we we covered that for example the cost incurred in not complying with gdpr can be very very high than the cost incurred in complying with it you know the extra computing power or whatever cloud brings in the the convenience of having [Music] ready to use solution out of the box we also saw how bring your own key and envelope immigration encryption ensures only the user has the access to the data a user controls access to the data we also saw how fips compliance can be achieved and we also talked about validation about fips validation which is a different subject as a matter of fact openshift integrates both bring your own key and fix compliant any replica application running on top of it leverages it so these are the links feel free to check out about fixed compliance you know openshift spark and down this is my blog which has more details on how we achieve how spark achieves fibs that we briefly saw in my presentation thank you i am open to questions now you