huaweicloud-encryption-sdk-python 1.2.1__py3-none-any.whl

huaweicloud_encryptionsdk/model/enums/crypto_algorithm.py

@@ -0,0 +1,75 @@
+from enum import Enum
+
+
+class CryptoAlgorithm(Enum):
+
+    AES_128_GCM_NOPADDING = ("AES_128", "AES/GCM/NoPadding", 16, 12, 16, 16, 1, 1, "AES", 128)
+    AES_256_GCM_NOPADDING = ("AES_256", "AES/GCM/NoPadding", 32, 12, 16, 16, 2, 1, "AES", 256)
+    SM4_128_GCM_NOPADDING = ("SM4_128", "SM4/GCM/NoPadding", 16, 12, 16, 16, 3, 1, "SM4", 128)
+    SM4_128_CBC_PADDING = ("SM4_128", "SM4/CBC/PKCS5Padding", 16, 16, 16, 16, 4, 1, "SM4", 128)
+
+    def __init__(self, key_spec, crypto_alg, key_len, iv_len, tag_len, block_size, value, version, sec_key_algorithm, datakey_length):
+        self._key_spec = key_spec
+        self._crypto_alg = crypto_alg
+        self._key_len = key_len
+        self._iv_len = iv_len
+        self._tag_len = tag_len
+        self._block_size = block_size
+        self._value = value
+        self._version = version
+        self._sec_key_algorithm = sec_key_algorithm
+        self._datakey_length = datakey_length
+
+    @property
+    def key_spec(self):
+        return self._key_spec
+
+    @property
+    def crypto_alg(self):
+        return self._crypto_alg
+
+    @property
+    def key_len(self):
+        return self._key_len
+
+    @property
+    def iv_len(self):
+        return self._iv_len
+
+    @property
+    def tag_len(self):
+        return self._tag_len
+
+    @property
+    def block_size(self):
+        return self._block_size
+
+    @property
+    def value(self):
+        return self._value
+
+    @property
+    def version(self):
+        return self._version
+
+    @property
+    def sec_key_algorithm(self):
+        return self._sec_key_algorithm
+
+    @property
+    def datakey_length(self):
+        return self._datakey_length
+
+    @classmethod
+    def get_algorithm(cls, algorithm_value):
+        for algorithm in cls:
+            if algorithm.value == algorithm_value:
+                return algorithm
+        return None
+
+    def get_algorithm_name(self):
+        return self._key_spec.split("_")[0]
+
+    def get_crypto_mode(self):
+        parts = self._crypto_alg.split("/")
+        return parts[1]

huaweicloud_encryptionsdk/model/enums/data_key_generate_type.py

@@ -0,0 +1,20 @@
+from enum import Enum
+
+
+class DataKeyGenerateType(Enum):
+
+    LOCAL_GENERATE = ("create data key from local", 1)
+    KMS_GENERATE = ("create data key from KMS", 2)
+    KEY_CAPSULE_GENERATE = ("create data key from key capsule", 3)
+
+    def __init__(self, desc, code):
+        self._desc = desc
+        self._code = code
+
+    @property
+    def desc(self):
+        return self._desc
+
+    @property
+    def code(self):
+        return self._code

huaweicloud_encryptionsdk/model/enums/key_provider_enum.py

@@ -0,0 +1,19 @@
+from enum import Enum
+
+
+class KeyProviderEnum(Enum):
+
+    LOCAL_PROVIDER = (1, "huawei-local")
+    KMS_PROVIDER = (2, "huawei-kms")
+
+    def __init__(self, code, name):
+        self._code = code
+        self._name = name
+
+    @property
+    def code(self):
+        return self._code
+
+    @property
+    def name(self):
+        return self._name

huaweicloud_encryptionsdk/model/enums/keyring_type_enum.py

@@ -0,0 +1,27 @@
+from enum import Enum
+
+
+class KeyringTypeEnum(Enum):
+
+    RAW_AES = "AES"
+    RAW_SM2 = "SM2"
+    RAW_RSA = "RSA"
+    RAW_SM4_CBC = "SM4_CBC"
+    RAW_SM4_GCM = "SM4_GCM"
+    KMS_MULTI_REGION = "multi"
+    KMS_DISCOVERY = "discovery"
+    KMS_KEY_CAPSULE = "key_capsule"
+
+    def __init__(self, type_value):
+        self._type = type_value
+
+    @property
+    def type(self):
+        return self._type
+
+    @classmethod
+    def get_raw_keyring_type(cls, type_str):
+        for keyring_type in cls:
+            if keyring_type.type.lower() == type_str.lower():
+                return keyring_type
+        return None

huaweicloud_encryptionsdk/model/key_capsule.py

@@ -0,0 +1,10 @@
+from dataclasses import dataclass
+from typing import Optional
+
+
+@dataclass
+class KeyCapsule:
+    key_id: Optional[str] = None
+    datakey_capsule: Optional[str] = None
+    access_point_type: int = 0
+    instance_id: Optional[str] = None

huaweicloud_encryptionsdk/model/key_capsule_config.py

@@ -0,0 +1,12 @@
+from dataclasses import dataclass
+from typing import Optional
+
+from huaweicloud_encryptionsdk.model.access_point_config import AccessPointConfig
+
+
+@dataclass
+class KeyCapsuleConfig:
+    region: str = ""
+    default_policy_id: Optional[str] = None
+    default_key_policy: Optional[str] = None
+    access_point_config: Optional[AccessPointConfig] = None

huaweicloud_encryptionsdk/model/kms_config.py

@@ -0,0 +1,10 @@
+from dataclasses import dataclass
+from typing import Optional
+
+
+@dataclass
+class KMSConfig:
+    region: str = ""
+    key_id: str = ""
+    project_id: str = ""
+    end_point: Optional[str] = None

huaweicloud_encryptionsdk/model/request/encrypt_request.py

@@ -0,0 +1,10 @@
+from dataclasses import dataclass, field
+from typing import Dict, Optional
+
+
+@dataclass
+class EncryptRequest:
+    encryption_context: Dict[str, str] = field(default_factory=dict)
+    plain_text: bytes = b""
+    policy_id: Optional[str] = None
+    key_policy: Optional[str] = None

huaweicloud_encryptionsdk/model/request/sign_request.py

@@ -0,0 +1,2 @@
+class SignRequest:
+    pass

huaweicloud_encryptionsdk/model/request/verify_request.py

@@ -0,0 +1,2 @@
+class VerifyRequest:
+    pass

huaweicloud_encryptionsdk/proof/attestation_document.py

@@ -0,0 +1,36 @@
+import json
+from dataclasses import dataclass, field, asdict
+from typing import Optional
+
+
+@dataclass
+class AttestationDocument:
+    ecs_signature: Optional[str] = field(default=None)
+    custom_signature: Optional[str] = field(default=None)
+    custom_public_key: Optional[str] = field(default=None)
+    expire_time: Optional[str] = field(default=None)
+    service_token: Optional[str] = field(default=None)
+    modelarts_job_id: Optional[str] = field(default=None)
+    modelarts_pool_id: Optional[str] = field(default=None)
+
+    def to_dict(self) -> dict:
+        return {k: v for k, v in asdict(self).items() if v is not None}
+
+    def to_json(self) -> str:
+        return json.dumps(self.to_dict())
+
+    @classmethod
+    def from_dict(cls, data: dict) -> "AttestationDocument":
+        return cls(
+            ecs_signature=data.get("ecs_signature"),
+            custom_signature=data.get("custom_signature"),
+            custom_public_key=data.get("custom_public_key"),
+            expire_time=data.get("expire_time"),
+            service_token=data.get("service_token"),
+            modelarts_job_id=data.get("modelarts_job_id"),
+            modelarts_pool_id=data.get("modelarts_pool_id"),
+        )
+
+    @classmethod
+    def from_json(cls, json_str: str) -> "AttestationDocument":
+        return cls.from_dict(json.loads(json_str))

huaweicloud_encryptionsdk/proof/collector/cce_proof_collector.py

@@ -0,0 +1,24 @@
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException
+from huaweicloud_encryptionsdk.proof.attestation_document import AttestationDocument
+from huaweicloud_encryptionsdk.proof.proof_collector import ProofCollector
+from huaweicloud_encryptionsdk.proof.proof_info import ProofInfo
+
+
+SERVICE_ACCOUNT_TOKEN_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+
+
+class CceProofCollector(ProofCollector):
+
+    def collect(self, proof_info: ProofInfo) -> AttestationDocument:
+        service_token = self._read_service_account_token()
+        return AttestationDocument(service_token=service_token)
+
+    @staticmethod
+    def _read_service_account_token() -> str:
+        try:
+            with open(SERVICE_ACCOUNT_TOKEN_PATH, "r") as f:
+                return f.read().strip()
+        except Exception as e:
+            raise HuaweicloudException(
+                f"Failed to read CCE service account token from {SERVICE_ACCOUNT_TOKEN_PATH}", e
+            )

huaweicloud_encryptionsdk/proof/collector/ecs_proof_collector.py

@@ -0,0 +1,11 @@
+from huaweicloud_encryptionsdk.common.ecs_metadata_service import EcsMetadataService
+from huaweicloud_encryptionsdk.proof.attestation_document import AttestationDocument
+from huaweicloud_encryptionsdk.proof.proof_collector import ProofCollector
+from huaweicloud_encryptionsdk.proof.proof_info import ProofInfo
+
+
+class EcsProofCollector(ProofCollector):
+
+    def collect(self, proof_info: ProofInfo) -> AttestationDocument:
+        signature = EcsMetadataService.fetch_identity_signature()
+        return AttestationDocument(ecs_signature=signature)

huaweicloud_encryptionsdk/proof/collector/key_pair_proof_collector.py

@@ -0,0 +1,55 @@
+import base64
+from datetime import datetime, timezone, timedelta
+
+from cryptography.hazmat.primitives.asymmetric import ec, utils as ec_utils
+from cryptography.hazmat.primitives import hashes, serialization
+
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+from huaweicloud_encryptionsdk.proof.attestation_document import AttestationDocument
+from huaweicloud_encryptionsdk.proof.proof_collector import ProofCollector
+from huaweicloud_encryptionsdk.proof.proof_info import ProofInfo
+from huaweicloud_encryptionsdk.common.ec_private_key_loader import ECPrivateKeyLoader
+
+
+class KeyPairProofCollector(ProofCollector):
+
+    def collect(self, proof_info: ProofInfo) -> AttestationDocument:
+        private_key_str = proof_info.private_key_decrypt_callback(proof_info.encrypted_private_key)
+        private_key = ECPrivateKeyLoader.load(private_key_str)
+        expire_time = self._get_expire_time()
+        origin_text = (proof_info.key_capsule or "") + expire_time
+        signature = self._get_signature(private_key, origin_text)
+        return AttestationDocument(
+            custom_public_key=self._get_public_key_from_private_key(private_key),
+            custom_signature=signature,
+            expire_time=expire_time,
+        )
+
+    @staticmethod
+    def _get_public_key_from_private_key(private_key) -> str:
+        try:
+            public_key = private_key.public_key()
+            public_der = public_key.public_bytes(
+                encoding=serialization.Encoding.DER,
+                format=serialization.PublicFormat.SubjectPublicKeyInfo,
+            )
+            return base64.b64encode(public_der).decode("utf-8")
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.GET_PUB_KEY_EXCEPTION.message, e)
+
+    @staticmethod
+    def _get_signature(private_key, origin_text: str) -> str:
+        try:
+            signature_bytes = private_key.sign(
+                origin_text.encode("utf-8"),
+                ec.ECDSA(hashes.SHA256()),
+            )
+            return base64.b64encode(signature_bytes).decode("utf-8")
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.COLLECT_PROOF_EXCEPTION.message, e)
+
+    @staticmethod
+    def _get_expire_time() -> str:
+        expire = datetime.now(timezone.utc) + timedelta(minutes=30)
+        expire = expire.replace(microsecond=0)
+        return expire.isoformat().replace("+00:00", "Z")

huaweicloud_encryptionsdk/proof/collector/ma_proof_collector.py

@@ -0,0 +1,51 @@
+import os
+
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException
+from huaweicloud_encryptionsdk.proof.attestation_document import AttestationDocument
+from huaweicloud_encryptionsdk.proof.proof_collector import ProofCollector
+from huaweicloud_encryptionsdk.proof.proof_info import ProofInfo
+
+
+LWS_LEADER_ADDRESS_ENV = "LWS_LEADER_ADDRESS"
+MA_JOB_NAME_ENV = "MA_JOB_NAME"
+MODELARTS_PREFIX = "modelarts-"
+
+
+class MaProofCollector(ProofCollector):
+    """ModelArts (MA) 接入点证明收集器。
+
+    根据环境变量自动判断场景：
+    - 推理场景：读 LWS_LEADER_ADDRESS，按 . 分割取最后一段作为 pool_id
+    - 训练场景：读 MA_JOB_NAME，去掉前缀 modelarts- 得到 job_id
+    """
+
+    def collect(self, proof_info: ProofInfo) -> AttestationDocument:
+        pool_id = self._extract_pool_id()
+        job_id = self._extract_job_id()
+
+        if pool_id is None and job_id is None:
+            raise HuaweicloudException(
+                f"Failed to collect MA proof: neither {LWS_LEADER_ADDRESS_ENV} "
+                f"nor {MA_JOB_NAME_ENV} found"
+            )
+
+        return AttestationDocument(
+            modelarts_pool_id=pool_id,
+            modelarts_job_id=job_id,
+        )
+
+    @staticmethod
+    def _extract_pool_id() -> str | None:
+        addr = os.environ.get(LWS_LEADER_ADDRESS_ENV, "")
+        if not addr:
+            return None
+        return addr.split(".")[-1]
+
+    @staticmethod
+    def _extract_job_id() -> str | None:
+        job_name = os.environ.get(MA_JOB_NAME_ENV, "")
+        if not job_name:
+            return None
+        if job_name.startswith(MODELARTS_PREFIX):
+            return job_name[len(MODELARTS_PREFIX):]
+        return job_name

huaweicloud_encryptionsdk/proof/private_key_decrypt_callback.py

@@ -0,0 +1,7 @@
+from typing import Protocol
+
+
+class PrivateKeyDecryptCallback(Protocol):
+
+    def decrypt(self, encrypted_private_key: str) -> str:
+        ...

huaweicloud_encryptionsdk/proof/proof_collector.py

@@ -0,0 +1,11 @@
+from abc import ABC, abstractmethod
+
+from huaweicloud_encryptionsdk.proof.proof_info import ProofInfo
+from huaweicloud_encryptionsdk.proof.attestation_document import AttestationDocument
+
+
+class ProofCollector(ABC):
+
+    @abstractmethod
+    def collect(self, proof_info: ProofInfo) -> AttestationDocument:
+        pass

huaweicloud_encryptionsdk/proof/proof_collector_factory.py

@@ -0,0 +1,53 @@
+import threading
+from typing import Dict, Optional
+
+from huaweicloud_encryptionsdk.proof.proof_collector import ProofCollector
+from huaweicloud_encryptionsdk.proof.proof_info import ProofInfo
+from huaweicloud_encryptionsdk.proof.attestation_document import AttestationDocument
+from huaweicloud_encryptionsdk.proof.collector.ecs_proof_collector import EcsProofCollector
+from huaweicloud_encryptionsdk.proof.collector.key_pair_proof_collector import KeyPairProofCollector
+from huaweicloud_encryptionsdk.proof.collector.cce_proof_collector import CceProofCollector
+from huaweicloud_encryptionsdk.proof.collector.ma_proof_collector import MaProofCollector
+
+
+class ProofCollectorFactory:
+
+    _COLLECTORS: Dict[int, ProofCollector] = {}
+    _lock = threading.Lock()
+
+    @classmethod
+    def _init_collectors(cls):
+        if not cls._COLLECTORS:
+            with cls._lock:
+                if not cls._COLLECTORS:
+                    cls._COLLECTORS[1] = EcsProofCollector()
+                    cls._COLLECTORS[2] = KeyPairProofCollector()
+                    cls._COLLECTORS[3] = CceProofCollector()
+                    cls._COLLECTORS[4] = MaProofCollector()
+
+    @classmethod
+    def register_collector(cls, type_val: int, collector: ProofCollector) -> None:
+        if collector is None:
+            raise ValueError("Type and collector cannot be null")
+        with cls._lock:
+            cls._COLLECTORS[type_val] = collector
+
+    @classmethod
+    def get_collector(cls, type_val: int) -> ProofCollector:
+        cls._init_collectors()
+        if type_val is None:
+            raise ValueError("Access point type cannot be null")
+        collector = cls._COLLECTORS.get(type_val)
+        if collector is None:
+            raise ValueError(
+                f"Unsupported access point type: {type_val}. Supported types: {list(cls._COLLECTORS.keys())}"
+            )
+        return collector
+
+    @classmethod
+    def collect(cls, proof_info: ProofInfo) -> AttestationDocument:
+        if proof_info is None:
+            raise ValueError("AccessPointConfig cannot be null")
+        type_val = proof_info.type
+        collector = cls.get_collector(type_val)
+        return collector.collect(proof_info)

huaweicloud_encryptionsdk/proof/proof_info.py

@@ -0,0 +1,10 @@
+from dataclasses import dataclass
+from typing import Callable, Optional
+
+
+@dataclass
+class ProofInfo:
+    type: int = 0
+    encrypted_private_key: Optional[str] = None
+    private_key_decrypt_callback: Optional[Callable[[str], str]] = None
+    key_capsule: Optional[str] = None

huaweicloud_encryptionsdk/util/common_utils.py

@@ -0,0 +1,12 @@
+from typing import Dict
+
+
+class CommonUtils:
+
+    @staticmethod
+    def get_encrypt_map() -> Dict[str, str]:
+        return {"key": "value", "context": "encrypt"}
+
+    @staticmethod
+    def get_encryption_context() -> Dict[str, str]:
+        return {"encryption": "context", "simple": "test", "caching": "encrypt"}

tests/test_enums.py

@@ -0,0 +1,84 @@
+import pytest
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+from huaweicloud_encryptionsdk.model.enums.access_point_type import AccessPointType
+from huaweicloud_encryptionsdk.model.enums.key_provider_enum import KeyProviderEnum
+from huaweicloud_encryptionsdk.model.enums.data_key_generate_type import DataKeyGenerateType
+from huaweicloud_encryptionsdk.model.enums.keyring_type_enum import KeyringTypeEnum
+from huaweicloud_encryptionsdk.exception.errors import ErrorMessage
+
+
+class TestCryptoAlgorithm:
+    def test_all_values(self):
+        assert CryptoAlgorithm.AES_128_GCM_NOPADDING.value == 1
+        assert CryptoAlgorithm.AES_256_GCM_NOPADDING.value == 2
+        assert CryptoAlgorithm.SM4_128_GCM_NOPADDING.value == 3
+        assert CryptoAlgorithm.SM4_128_CBC_PADDING.value == 4
+
+    def test_key_lengths(self):
+        assert CryptoAlgorithm.AES_128_GCM_NOPADDING.key_len == 16
+        assert CryptoAlgorithm.AES_256_GCM_NOPADDING.key_len == 32
+        assert CryptoAlgorithm.SM4_128_GCM_NOPADDING.key_len == 16
+
+    def test_get_algorithm(self):
+        assert CryptoAlgorithm.get_algorithm(1) == CryptoAlgorithm.AES_128_GCM_NOPADDING
+        assert CryptoAlgorithm.get_algorithm(2) == CryptoAlgorithm.AES_256_GCM_NOPADDING
+        assert CryptoAlgorithm.get_algorithm(3) == CryptoAlgorithm.SM4_128_GCM_NOPADDING
+        assert CryptoAlgorithm.get_algorithm(4) == CryptoAlgorithm.SM4_128_CBC_PADDING
+
+    def test_get_algorithm_name(self):
+        assert "AES" in CryptoAlgorithm.AES_256_GCM_NOPADDING.get_algorithm_name() or "GCM" in CryptoAlgorithm.AES_256_GCM_NOPADDING.get_algorithm_name()
+
+
+class TestAccessPointType:
+    def test_all_values(self):
+        assert AccessPointType.ECS.code == 1
+        assert AccessPointType.CUSTOM.code == 2
+        assert AccessPointType.CCE.code == 3
+
+    def test_display_names(self):
+        assert AccessPointType.ECS.display_name == "ECS"
+        assert AccessPointType.CUSTOM.display_name == "Custom"
+        assert AccessPointType.CCE.display_name == "CCE"
+
+    def test_get_display_name_by_code(self):
+        assert AccessPointType.get_display_name_by_code(1) == "ECS"
+        assert AccessPointType.get_display_name_by_code(2) == "Custom"
+        assert AccessPointType.get_display_name_by_code(3) == "CCE"
+
+
+class TestKeyProviderEnum:
+    def test_all_values(self):
+        assert KeyProviderEnum.LOCAL_PROVIDER.code == 1
+        assert KeyProviderEnum.KMS_PROVIDER.code == 2
+
+
+class TestDataKeyGenerateType:
+    def test_all_values(self):
+        assert DataKeyGenerateType.LOCAL_GENERATE.code == 1
+        assert DataKeyGenerateType.KMS_GENERATE.code == 2
+        assert DataKeyGenerateType.KEY_CAPSULE_GENERATE.code == 3
+
+
+class TestKeyringTypeEnum:
+    def test_all_values(self):
+        assert KeyringTypeEnum.RAW_AES.type == "AES"
+        assert KeyringTypeEnum.RAW_SM2.type == "SM2"
+        assert KeyringTypeEnum.RAW_RSA.type == "RSA"
+        assert KeyringTypeEnum.KMS_KEY_CAPSULE.type == "key_capsule"
+
+    def test_get_raw_keyring_type(self):
+        result = KeyringTypeEnum.get_raw_keyring_type("AES")
+        assert result == KeyringTypeEnum.RAW_AES
+
+
+class TestErrorMessage:
+    def test_error_codes(self):
+        assert ErrorMessage.DECRYPT_EXCEPTION.code == 1000
+        assert ErrorMessage.CIPHER_EXCEPTION.code == 1001
+        assert ErrorMessage.KEYRING_NULL_EXCEPTION.code == 1012
+        assert ErrorMessage.KEY_CAPSULE_NULL.code == 1030
+        assert ErrorMessage.COLLECT_PROOF_EXCEPTION.code == 1036
+
+    def test_error_messages(self):
+        assert "decrypt" in ErrorMessage.DECRYPT_EXCEPTION.message.lower()
+        assert "null" in ErrorMessage.KEYRING_NULL_EXCEPTION.message.lower()

tests/test_exceptions.py

@@ -0,0 +1,38 @@
+import pytest
+from huaweicloud_encryptionsdk.exception.errors import (
+    HuaweicloudException,
+    KeyringNotFoundException,
+    KeyringNotMatchException,
+    KeyParseException,
+    EncryptException,
+    CipherTamperedException,
+    CipherDataException,
+    ErrorMessage,
+)
+
+
+class TestExceptions:
+    def test_huaweicloud_exception_message(self):
+        e = HuaweicloudException("test error")
+        assert str(e) == "test error"
+
+    def test_keyring_not_found_exception(self):
+        e = KeyringNotFoundException(ErrorMessage.KEYRING_NULL_EXCEPTION.message)
+        assert "key ring" in str(e).lower() or "null" in str(e).lower()
+
+    def test_cipher_tampered_exception(self):
+        e = CipherTamperedException(ErrorMessage.TAMPERED_EXCEPTION.message)
+        assert "integrity" in str(e).lower() or "tampered" in str(e).lower() or "Header" in str(e)
+
+    def test_exception_inheritance(self):
+        assert issubclass(KeyringNotFoundException, HuaweicloudException)
+        assert issubclass(KeyringNotMatchException, HuaweicloudException)
+        assert issubclass(KeyParseException, HuaweicloudException)
+        assert issubclass(EncryptException, HuaweicloudException)
+        assert issubclass(CipherTamperedException, HuaweicloudException)
+        assert issubclass(CipherDataException, HuaweicloudException)
+
+    def test_exception_with_cause(self):
+        cause = ValueError("original")
+        e = HuaweicloudException("wrapper", cause)
+        assert "wrapper" in str(e)