Store Sensitive Data With Python & MongoDB Client-Side Field Level Encryption

1
python -m pip install "pymongo[encryption,srv]~=3.11"

1
# create_key.py
2
3
import os
4
from pathlib import Path
5
from secrets import token_bytes
6
7
from bson import json_util
8
from bson.binary import STANDARD
9
from bson.codec_options import CodecOptions
10
from pymongo import MongoClient
11
from pymongo.encryption import ClientEncryption
12
from pymongo.encryption_options import AutoEncryptionOpts

1
# create_key.py
2
3
# Generate a secure 96-byte secret key:
4
key_bytes = token_bytes(96)

1
# create_key.py
2
3
# Configure a single, local KMS provider, with the saved key:
4
kms_providers = {"local": {"key": key_bytes}}
5
csfle_opts = AutoEncryptionOpts(
6
   kms_providers=kms_providers, key_vault_namespace="csfle_demo.__keystore"
7
)
8
9
# Connect to MongoDB with the key information generated above:
10
with MongoClient(os.environ["MDB_URL"], auto_encryption_opts=csfle_opts) as client:
11
   print("Resetting demo database & keystore ...")
12
   client.drop_database("csfle_demo")
13
14
   # Create a ClientEncryption object to create the data key below:
15
   client_encryption = ClientEncryption(
16
      kms_providers,
17
      "csfle_demo.__keystore",
18
      client,
19
      CodecOptions(uuid_representation=STANDARD),
20
   )
21
22
   print("Creating key in MongoDB ...")
23
   key_id = client_encryption.create_data_key("local", key_alt_names=["example"])

1
{
2
   '_id': UUID('00c63aa2-059d-4548-9e18-54452195acd0'),
3
   'creationDate': datetime.datetime(2020, 11, 24, 11, 25, 0, 974000),
4
   'keyAltNames': ['example'],
5
   'keyMaterial': b'W\xd2"\xd7\xd4d\x02e/\x8f|\x8f\xa2\xb6\xb1\xc0Q\xa0\x1b\xab ...'
6
   'masterKey': {'provider': 'local'},
7
   'status': 0,
8
   'updateDate': datetime.datetime(2020, 11, 24, 11, 25, 0, 974000)
9
}

1
# create_key.py
2
3
Path("key_bytes.bin").write_bytes(key_bytes)

1
# create_key.py
2
3
schema = {
4
  "bsonType": "object",
5
  "properties": {
6
      "ssn": {
7
         "encrypt": {
8
            "bsonType": "string",
9
            # Change to "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic" in order to filter by ssn value:
10
            "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random",
11
            "keyId": [key_id],  # Reference the key
12
         }
13
      },
14
   },
15
}
16
17
json_schema = json_util.dumps(
18
   schema, json_options=json_util.CANONICAL_JSON_OPTIONS, indent=2
19
)
20
Path("json_schema.json").write_text(json_schema)

1
# csfle_main.py
2
3
import os
4
from pathlib import Path
5
6
from pymongo import MongoClient
7
from pymongo.encryption_options import AutoEncryptionOpts
8
from pymongo.errors import EncryptionError
9
from bson import json_util
10
11
# Load the master key from 'key_bytes.bin':
12
key_bin = Path("key_bytes.bin").read_bytes()
13
14
# Load the 'person' schema from "json_schema.json":
15
collection_schema = json_util.loads(Path("json_schema.json").read_text())

1
# csfle_main.py
2
3
# Configure a single, local KMS provider, with the saved key:
4
kms_providers = {"local": {"key": key_bin}}
5
6
# Create a configuration for PyMongo, specifying the local master key,
7
# the collection used for storing key data, and the json schema specifying
8
# field encryption:
9
csfle_opts = AutoEncryptionOpts(
10
   kms_providers,
11
   "csfle_demo.__keystore",
12
   schema_map={"csfle_demo.people": collection_schema},
13
)

1
{
2
"bsonType": "object",
3
"properties": {
4
   "ssn": {
5
      "encrypt": {
6
      "bsonType": "string",
7
      "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random",
8
      "keyId": [
9
         {
10
            "$binary": {
11
            "base64": "4/p3dLgeQPyuSaEf+NddHw==",
12
            "subType": "04"}}]
13
      }}}}

1
key_id = db.__keystore.find_one({ "keyAltNames": "example" })["_id"]

1
# csfle_main.py
2
3
# Add a new document to the "people" collection, and then read it back out
4
# to demonstrate that the ssn field is automatically decrypted by PyMongo:
5
with MongoClient(os.environ["MDB_URL"], auto_encryption_opts=csfle_opts) as client:
6
   client.csfle_demo.people.delete_many({})
7
   client.csfle_demo.people.insert_one({
8
      "full_name": "Sophia Duleep Singh",
9
      "ssn": "123-12-1234",
10
   })
11
   print("Decrypted find() results: ")
12
   print(client.csfle_demo.people.find_one())

1
{'_id': ObjectId('5fc12f13516b61fa7a99afba'), 'full_name': 'Sophia Duleep Singh', 'ssn': '123-12-1234'}

1
# csfle_main.py
2
3
# Connect to MongoDB, but this time without CSFLE configuration.
4
# This will print the document with ssn *still encrypted*:
5
with MongoClient(os.environ["MDB_URL"]) as client:
6
   print("Encrypted find() results: ")
7
   print(client.csfle_demo.people.find_one())

1
{
2
   '_id': ObjectId('5fc12f13516b61fa7a99afba'),
3
   'full_name': 'Sophia Duleep Singh',
4
   'ssn': Binary(b'\x02\xe3\xfawt\xb8\x1e@\xfc\xaeI\xa1\x1f\xf8\xd7]\x1f\x02\xd8+,\x9el ...', 6)
5
}

1
# csfle_main.py
2
3
# The following demonstrates that if the ssn field is encrypted as
4
# "Random" it cannot be filtered:
5
try:
6
   with MongoClient(os.environ["MDB_URL"], auto_encryption_opts=csfle_opts) as client:
7
      # This will fail if ssn is specified as "Random".
8
      # Change the algorithm to "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
9
      # in client_schema_create_key.py (and run it again) for this to succeed:
10
      print("Find by ssn: ")
11
      print(client.csfle_demo.people.find_one({"ssn": "123-12-1234"}))
12
except EncryptionError as e:
13
   # This is expected if the field is "Random" but not if it's "Deterministic"
14
   print(e)

1
# create_key.py
2
3
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic",

1
# Configure encryption options with the same key, but *without* a schema:
2
csfle_opts_no_schema = AutoEncryptionOpts(
3
   kms_providers,
4
   "csfle_demo.__keystore",
5
)
6
with MongoClient(
7
   os.environ["MDB_URL"], auto_encryption_opts=csfle_opts_no_schema
8
) as client:
9
   print("Inserting Dora Thewlis, without configured schema.")
10
   # This will insert a document *without* encrypted ssn, because
11
   # no schema is specified in the client or server:
12
   client.csfle_demo.people.insert_one({
13
      "full_name": "Dora Thewlis",
14
      "ssn": "234-23-2345",
15
   })
16
17
# Connect without CSFLE configuration to show that Sophia Duleep Singh is
18
# encrypted, but Dora Thewlis has her ssn saved as plaintext.
19
with MongoClient(os.environ["MDB_URL"]) as client:
20
   print("Encrypted find() results: ")
21
   for doc in client.csfle_demo.people.find():
22
      print(" *", doc)

1
* {'_id': ObjectId('5fc12f13516b61fa7a99afba'), 'full_name': 'Sophia Duleep Singh', 'ssn': Binary(b'\x02\xe3\xfawt\xb8\x1e@\xfc\xaeI\xa1\x1f\xf8\xd7]\x1f\x02\xd8+,\x9el\xfe\xee\xa7\xd9\x87+\xb9p\x9a\xe7\xdcjY\x98\x82]7\xf0\xa4G[]\xd2OE\xbe+\xa3\x8b\xf5\x9f\x90u6>\xf3(6\x9c\x1f\x8e\xd8\x02\xe5\xb5h\xc64i>\xbf\x06\xf6\xbb\xdb\xad\xf4\xacp\xf1\x85\xdbp\xeau\x05\xe4Z\xe9\xe9\xd0\xe9\xe1n<', 6)}
2
* {'_id': ObjectId('5fc12f14516b61fa7a99afc0'), 'full_name': 'Dora Thewlis', 'ssn': '234-23-2345'}

1
# create_key.py
2
3
print("Creating 'people' collection in 'csfle_demo' database (with schema) ...")
4
client.csfle_demo.create_collection(
5
   "people",
6
   codec_options=CodecOptions(uuid_representation=STANDARD),
7
   validator={"$jsonSchema": schema},
8
)

1
# csfle_main.py
2
3
csfle_opts = AutoEncryptionOpts(
4
   kms_providers,
5
   "csfle_demo.__keystore",
6
)