Skip to content

Commit 52ae369

Browse files
rishav-karanjitrishav-karanjit
committed
Item encryptor
1 parent d57edd4 commit 52ae369

File tree

5 files changed

+101
-46
lines changed

5 files changed

+101
-46
lines changed

‎db-esdk-performance-testing/benchmarks/config/test-scenarios.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ data_sizes:
99
- 10240 # 10KB
1010
medium:
1111
- 102400 # 100KB
12-
- 400000 # 400KB
12+
- 50000000 # 50MB
1313

1414
# Quick test configuration (reduced test set for faster execution)
1515
quick_config:

‎db-esdk-performance-testing/benchmarks/go/benchmark/benchmark_tests.go‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,12 @@ import (
77
"bytes"
88
"context"
99
"fmt"
10+
"reflect"
1011
"runtime/metrics"
1112
"strconv"
1213
"time"
1314

15+
dbesdkitemencryptortypes "github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/awscryptographydbencryptionsdkdynamodbitemencryptorsmithygeneratedtypes"
1416
"github.com/aws/aws-sdk-go-v2/aws"
1517
"github.com/aws/aws-sdk-go-v2/service/dynamodb"
1618
"github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
@@ -120,6 +122,48 @@ func (b *DBESDKBenchmark) runBatchPutGetCycle(data []byte) (float64, float64, er
120122
return batchWriteDuration, batchGetDuration, nil
121123
}
122124

125+
// runBatchPutGetCycle performs a BatchWriteItem-BatchGetItem cycle with 25 items and measures performance
126+
func (b *DBESDKBenchmark) runItemEncryptorCycle(data []byte) (float64, float64, error) {
127+
item := map[string]types.AttributeValue{
128+
"partition_key": &types.AttributeValueMemberS{Value: "benchmark-test"},
129+
"sort_key": &types.AttributeValueMemberN{Value: "0"},
130+
"attribute1": &types.AttributeValueMemberM{Value: map[string]types.AttributeValue{
131+
"data": &types.AttributeValueMemberB{Value: data},
132+
}},
133+
"attribute2": &types.AttributeValueMemberS{Value: "sign me!"},
134+
":attribute3": &types.AttributeValueMemberS{Value: "ignore me!"},
135+
}
136+
137+
encryptItemInput := &dbesdkitemencryptortypes.EncryptItemInput{
138+
PlaintextItem: item,
139+
}
140+
141+
encryptItemStart := time.Now()
142+
encryptItemOutput, err := b.ItemEncryptorClient.EncryptItem(context.Background(), *encryptItemInput)
143+
if err != nil {
144+
return 0, 0, fmt.Errorf("EncryptItem failed: %w", err)
145+
}
146+
encryptItemDuration := time.Since(encryptItemStart).Seconds() * 1000
147+
// Demonstrate that the item has been encrypted
148+
encryptedItem := encryptItemOutput.EncryptedItem
149+
150+
// Directly decrypt the encrypted item using the DynamoDb Item Encryptor
151+
decryptItemInput := &dbesdkitemencryptortypes.DecryptItemInput{
152+
EncryptedItem: encryptedItem,
153+
}
154+
decryptItemStart := time.Now()
155+
decryptedItem, err := b.ItemEncryptorClient.DecryptItem(context.Background(), *decryptItemInput)
156+
if err != nil {
157+
return 0, 0, fmt.Errorf("EncryptItem failed: %w", err)
158+
}
159+
decryptItemDuration := time.Since(decryptItemStart).Seconds() * 1000
160+
161+
if !reflect.DeepEqual(item, decryptedItem.PlaintextItem) {
162+
panic("Decrypted item does not match original item")
163+
}
164+
return encryptItemDuration, decryptItemDuration, nil
165+
}
166+
123167
// shouldRunTestType checks if a test type should be run based on quick config
124168
func (b *DBESDKBenchmark) shouldRunTestType(testType string) bool {
125169
if b.Config.QuickConfig == nil || len(b.Config.QuickConfig.TestTypes) == 0 {

‎db-esdk-performance-testing/benchmarks/go/benchmark/dbesdk_benchmark.go‎

Lines changed: 51 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ import (
1313

1414
mplsmithygenerated "github.com/aws/aws-cryptographic-material-providers-library/releases/go/mpl/awscryptographymaterialproviderssmithygenerated"
1515
mpltypes "github.com/aws/aws-cryptographic-material-providers-library/releases/go/mpl/awscryptographymaterialproviderssmithygeneratedtypes"
16+
itemencryptor "github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/awscryptographydbencryptionsdkdynamodbitemencryptorsmithygenerated"
17+
dbesdkitemencryptortypes "github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/awscryptographydbencryptionsdkdynamodbitemencryptorsmithygeneratedtypes"
1618
dbesdkdynamodbencryptiontypes "github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/awscryptographydbencryptionsdkdynamodbsmithygeneratedtypes"
1719
dbesdkstructuredencryptiontypes "github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/awscryptographydbencryptionsdkstructuredencryptionsmithygeneratedtypes"
1820
"github.com/aws/aws-database-encryption-sdk-dynamodb/releases/go/dynamodb-esdk/dbesdkmiddleware"
@@ -32,12 +34,13 @@ const (
3234

3335
// DBESDKBenchmark is the main benchmark struct
3436
type DBESDKBenchmark struct {
35-
Config TestConfig
36-
DbesdkClient *dynamodb.Client
37-
Keyring mpltypes.IKeyring
38-
Results []BenchmarkResult
39-
CPUCount int
40-
TotalMemoryGB float64
37+
Config TestConfig
38+
DbesdkClient *dynamodb.Client
39+
ItemEncryptorClient *itemencryptor.Client
40+
Keyring mpltypes.IKeyring
41+
Results []BenchmarkResult
42+
CPUCount int
43+
TotalMemoryGB float64
4144
}
4245

4346
// New creates a new benchmark instance
@@ -64,7 +67,7 @@ func New(configPath string) (*DBESDKBenchmark, error) {
6467
}
6568

6669
// Setup DB-ESDK
67-
if err := benchmark.setupDBESDK(); err != nil {
70+
if err := benchmark.setupDBESDK(false); err != nil {
6871
return nil, fmt.Errorf("failed to setup DB-ESDK: %w", err)
6972
}
7073

@@ -95,35 +98,7 @@ func (b *DBESDKBenchmark) setupMPL() error {
9598
}
9699

97100
// setupDBESDK initializes the DynamoDB client with DB-ESDK middleware and creates a default keyring which is AES keyring
98-
func (b *DBESDKBenchmark) setupDBESDK() error {
99-
ddbTableName := b.Config.TableName
100-
101-
// Initialize the material providers client
102-
matProvConfig := mpltypes.MaterialProvidersConfig{}
103-
matProv, err := mplsmithygenerated.NewClient(matProvConfig)
104-
if err != nil {
105-
return fmt.Errorf("failed to create material providers client: %w", err)
106-
}
107-
108-
// Create default AES-256 keyring
109-
key := make([]byte, 32) // 256-bit key
110-
if _, err := rand.Read(key); err != nil {
111-
return fmt.Errorf("failed to generate AES-256 key: %w", err)
112-
}
113-
114-
keyringInput := mpltypes.CreateRawAesKeyringInput{
115-
KeyName: "test-aes-256-key",
116-
KeyNamespace: "DB-ESDK-performance-test",
117-
WrappingKey: key,
118-
WrappingAlg: mpltypes.AesWrappingAlgAlgAes256GcmIv12Tag16,
119-
}
120-
121-
keyring, err := matProv.CreateRawAesKeyring(context.Background(), keyringInput)
122-
if err != nil {
123-
return fmt.Errorf("failed to create keyring: %w", err)
124-
}
125-
b.Keyring = keyring
126-
101+
func (b *DBESDKBenchmark) setupDBESDK(useItemEncryptor bool) error {
127102
attributeActions := map[string]dbesdkstructuredencryptiontypes.CryptoAction{
128103
"partition_key": dbesdkstructuredencryptiontypes.CryptoActionSignOnly,
129104
"sort_key": dbesdkstructuredencryptiontypes.CryptoActionSignOnly,
@@ -137,22 +112,41 @@ func (b *DBESDKBenchmark) setupDBESDK() error {
137112
partitionKey := "partition_key"
138113
sortKeyName := "sort_key"
139114
algorithmSuiteID := mpltypes.DBEAlgorithmSuiteIdAlgAes256GcmHkdfSha512CommitKeyEcdsaP384SymsigHmacSha384
115+
116+
err := b.setupItemEncryptorClient(partitionKey, sortKeyName, allowedUnsignedAttributePrefix, algorithmSuiteID, attributeActions)
117+
if err != nil {
118+
return err
119+
}
120+
121+
err = b.SetupDDB(partitionKey, sortKeyName, allowedUnsignedAttributePrefix, algorithmSuiteID, attributeActions)
122+
if err != nil {
123+
return err
124+
}
125+
126+
log.Println("ESDK client initialized successfully")
127+
return nil
128+
}
129+
130+
func (b *DBESDKBenchmark) SetupDDB(partitionKey, sortKeyName, allowedUnsignedAttributePrefix string, algorithmSuiteID mpltypes.DBEAlgorithmSuiteId, attributeActions map[string]dbesdkstructuredencryptiontypes.CryptoAction) error {
140131
tableConfig := dbesdkdynamodbencryptiontypes.DynamoDbTableEncryptionConfig{
141-
LogicalTableName: ddbTableName,
132+
LogicalTableName: b.Config.TableName,
142133
PartitionKeyName: partitionKey,
143134
SortKeyName: &sortKeyName,
144135
AttributeActionsOnEncrypt: attributeActions,
145-
Keyring: keyring,
136+
Keyring: b.Keyring,
146137
AllowedUnsignedAttributePrefix: &allowedUnsignedAttributePrefix,
147138
AlgorithmSuiteId: &algorithmSuiteID,
148139
}
149140
tableConfigsMap := make(map[string]dbesdkdynamodbencryptiontypes.DynamoDbTableEncryptionConfig)
150-
tableConfigsMap[ddbTableName] = tableConfig
141+
tableConfigsMap[b.Config.TableName] = tableConfig
151142
listOfTableConfigs := dbesdkdynamodbencryptiontypes.DynamoDbTablesEncryptionConfig{
152143
TableEncryptionConfigs: tableConfigsMap,
153144
}
154145

155146
cfg, err := config.LoadDefaultConfig(context.TODO())
147+
if err != nil {
148+
return fmt.Errorf("failed to load default config: %w", err)
149+
}
156150

157151
dbEsdkMiddleware, err := dbesdkmiddleware.NewDBEsdkMiddleware(listOfTableConfigs)
158152
ddb := dynamodb.NewFromConfig(cfg, dbEsdkMiddleware.CreateMiddleware(), func(o *dynamodb.Options) {
@@ -161,7 +155,24 @@ func (b *DBESDKBenchmark) setupDBESDK() error {
161155

162156
b.DbesdkClient = ddb
163157

164-
log.Println("ESDK client initialized successfully")
158+
return nil
159+
}
160+
161+
func (b *DBESDKBenchmark) setupItemEncryptorClient(partitionKey, sortKeyName, allowedUnsignedAttributePrefix string, algorithmSuiteID mpltypes.DBEAlgorithmSuiteId, attributeActions map[string]dbesdkstructuredencryptiontypes.CryptoAction) error {
162+
itemEncryptorConfig := dbesdkitemencryptortypes.DynamoDbItemEncryptorConfig{
163+
LogicalTableName: b.Config.TableName,
164+
PartitionKeyName: partitionKey,
165+
SortKeyName: &sortKeyName,
166+
AttributeActionsOnEncrypt: attributeActions,
167+
Keyring: b.Keyring,
168+
AllowedUnsignedAttributePrefix: &allowedUnsignedAttributePrefix,
169+
AlgorithmSuiteId: &algorithmSuiteID,
170+
}
171+
itemEncryptorClient, err := itemencryptor.NewClient(itemEncryptorConfig)
172+
if err != nil {
173+
return fmt.Errorf("failed to create item encryptor client: %w", err)
174+
}
175+
b.ItemEncryptorClient = itemEncryptorClient
165176
return nil
166177
}
167178

‎db-esdk-performance-testing/benchmarks/go/benchmark/testRunners.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ func (b *DBESDKBenchmark) runMemoryTest(dataSize int) (*BenchmarkResult, error)
133133

134134
// Run operation
135135
operationStart := time.Now()
136-
_, _, err := b.runBatchPutGetCycle(data)
136+
_, _, err := b.runItemEncryptorCycle(data)
137137
operationDuration := time.Since(operationStart)
138138

139139
close(stopSampling)
@@ -229,7 +229,7 @@ func (b *DBESDKBenchmark) runConcurrentTest(dataSize int, concurrency int, itera
229229
var workerTimes []float64
230230
for j := 0; j < iterationsPerWorker; j++ {
231231
iterStart := time.Now()
232-
_, _, err := b.runBatchPutGetCycle(data)
232+
_, _, err := b.runItemEncryptorCycle(data)
233233
if err != nil {
234234
errorChan <- fmt.Errorf("worker %d iteration %d failed: %w", workerID, j, err)
235235
return
@@ -291,7 +291,7 @@ func (b *DBESDKBenchmark) runThroughputTest(dataSize int, iterations int) (*Benc
291291

292292
// Warmup
293293
for i := 0; i < b.Config.Iterations.Warmup; i++ {
294-
if _, _, err := b.runBatchPutGetCycle(testData); err != nil {
294+
if _, _, err := b.runItemEncryptorCycle(testData); err != nil {
295295
return nil, fmt.Errorf("warmup iteration %d failed: %w", i, err)
296296
}
297297
}
@@ -309,7 +309,7 @@ func (b *DBESDKBenchmark) runThroughputTest(dataSize int, iterations int) (*Benc
309309
startTime := time.Now()
310310
for i := 0; i < iterations; i++ {
311311
iterationStart := time.Now()
312-
putMs, getMs, err := b.runBatchPutGetCycle(testData)
312+
putMs, getMs, err := b.runItemEncryptorCycle(testData)
313313
if err != nil {
314314
return nil, fmt.Errorf("measurement iteration %d failed: %w", i, err)
315315
}

‎db-esdk-performance-testing/config/test-scenarios.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ data_sizes:
99
- 10240 # 10KB
1010
medium:
1111
- 102400 # 100KB
12-
- 400000 # 400KB
12+
- 40000000 # 40MB
1313

1414
# Quick test configuration (reduced test set for faster execution)
1515
quick_config:

0 commit comments

Comments
 (0)