Client-Side Field-Level Encryption for Apache Kafka Connect
summary
Client-side field-level encryption for Kafka Connect uses a configurable Kryptonite SMT to encrypt specific JSON/Avro fields (demo encrypts the street field from a MySQL Debezium source, writes base64 ciphertext to Kafka, then decrypts into MongoDB or MinIO) and supports AES-GCM and AES-SIV for probabilistic or deterministic needs, key rotation, and keys from files or Azure Key Vault. Demos show both object vs element modes (opaque subdocuments or per-element encryption) and a working end-to-end pipeline with 100 demo records.
AI-written summary · about
chapters (7)
- 0:00Motivation for security
- 4:25Kafka data breaches
- 7:56Core security limitations
- 13:57Client-side field encryption
- 23:36Demo: Database integration
- 31:06Demo: Advanced encryption
- 39:41Implementation and roadmap
related talks
27mEnd-to-End Encryption for Streaming Data Pipelines
41mRunning MongoDB securely on AWS using field-level encryption
45mData Privacy for SaaS Kafka or Pulsar Offerings
07mDescribing Kafka security in AsyncAPI
54mEnabling Message Level Protection at Uber
47mEnd-to-end Encryption in Cloud Services
50mBuilding Production-Grade End to End Encrypted App...
39mCryptic - keeps your secrets