Securing Data with PGP Encryption and Azure Functions

Introduction

This blog post provides guidance for integrating and encrypting data with PGP in a solution hosted on Azure Functions. You’ll learn how to use Azure Key Vault to securely store PGP encryption keys and follow best practices for implementing this security measure effectively.

The guide includes step-by-step instructions on creating PGP keys, storing them in Key Vault, and a real-world case sample to demonstrate the process. If you need to secure sensitive files or automate data encryption, this post will guide you in leveraging Azure Functions and PGP encryption to improve your data security.

About PGP Encryption

Pretty Good Privacy (PGP) is a well-known data encryption method used to protect sensitive information. Introduced in the 1990s, PGP remains an industry standard for encrypting files, disks, and emails, with both commercial and open-source versions available.

Benefits of PGP Encryption

1. Extremely Secure: PGP offers robust security through symmetric key encryption, public-key encryption, and hashing.
2. Free to Use: OpenPGP, the open standard of PGP, is available at no cost.
3. Proven Track Record: PGP has a long history of reliable security.

Drawbacks of PGP Encryption

• Complexity: PGP can be difficult to use for non-technical users due to key management requirements.
• Software Requirement: Requires specific software for encryption and decryption.

One significant advantage of using PGP over OpenSSL for data encryption is the cost, as authorized SSL certificates (from GlobalSign for example) are not free to generate.

Project Architecture Overview

1. Encrypt Data Files with PGP for Regulatory Compliance

• Key Generation and Management
  • Generate public/private keys locally.
  • Store the keys securely in Azure Key Vault.
• Encryption/Decryption Process
  • Use the BouncyCastle NuGet package for encryption and decryption operations in C#.

2. Connect to an SFTP Server over SSH

• Key Management
  • Store SSH keys securely in Azure Key Vault.
• Connection Setup
  • Establish SFTP connections in C# using the WinSCP NuGet package.

3. Fixed IP Address Security through IP Filtering

• Network Configuration
  • Utilize a premium app plan with a virtual network and public IP for enhanced security and fixed IP address requirements.

Creating PGP Keys: A Step-by-Step Guide

To avoid command line struggles, use Kleopatra for creating key pairs. You can download it here: Download Kleopatra

An excellent YouTube video on creating PGP key pairs in Kleopatra and how to validate, encrypt, and decrypt messages is available here: Watch on YouTube

You should end up with two files:

• Private key: Right click -> Backup secret keys
• Public key: Right click -> Export

Setting Up PGP Keys in Azure Key Vault for Enhanced Security

For security reasons, store the private and public key files in Azure Key Vault. Although Azure Key Vault does not support PGP formats directly, you can use the secrets functionality. How to store pgp keys in azure key vault?

When saving PGP files in Key Vault through the Azure portal, you will encounter issues with the multi-lined PGP keys. To avoid this, use PowerShell with ConvertTo-SecureString and -AsPlainText. Here’s an example:

Set-AzKeyVaultSecret -VaultName ‘keyvault-tst' -Name 'PGPPrivateKey' -SecretValue (ConvertTo-SecureString (Get-Content ./MyPgpfile-private.asc -Raw) -force -AsPlainText)

Using a NuGet Library for PGP Encryption in Azure

BouncyCastle is a commonly used and excellent NuGet package for encryption and decryption. Download BouncyCastle
Documentation

For a more user-friendly alternative with fewer settings and configurations, consider using PgpCore. Below is a small snippet on how to encrypt a stream:

// Init encryption keys and PGP class
EncryptionKeys encryptionKeys = new EncryptionKeys(new MemoryStream(Encoding.UTF8.GetBytes(_pGPPublicKey)), new MemoryStream(Encoding.UTF8.GetBytes(_pGpPrivateKey)), _pGPPrivatePwd);
var _pGpCore = new PGP(encryptionKeys);
_pGpCore.CompressionAlgorithm = Org.BouncyCastle.Bcpg.CompressionAlgorithmTag.Zip;

// Define filename & encrypt
var filename = $"filename.pgp";
var outputStream = new MemoryStream();
_pGpCore.EncryptAndSign(stream, outputStream, name: filename);
outputStream.Position = 0;

Azure Function Integration services

In the previous example, encryption and SFTP connection were handled within a single Azure Function. For a more modular and maintainable architecture, consider breaking these tasks into separate components. This approach improves reusability, scalability, and debugging. Here are advanced integration possibilities using Azure Functions:

Modular Components for Encryption and SFT

Instead of combining encryption and SFTP operations, separate them into distinct Azure Functions:

• Encryption Function: Handles PGP encryption and decryption, taking input data, performing encryption or decryption, and outputting the processed data.
• SFTP Connection Function: Manages secure file uploads and downloads to an SFTP server.

Modular components make your architecture more flexible and reusable across different projects.

Integration with Logic Apps and Power Automate

Azure Functions can be seamlessly integrated with Azure Logic Apps and Power Automate to build sophisticated workflow orchestrations:

• Logic Apps Integration: Use Logic Apps to call Azure Functions as part of a workflow. For example, trigger the encryption function when a new file is uploaded to Azure Blob Storage, then call the SFTP connection function to transfer the encrypted file.
• Power Automate Integration: Create automated workflows that connect to various services. By invoking Azure Functions, you can automate complex, multi-step processes.

Advanced ETL and ELT Processes with Data Factory

Azure Data Factory (ADF) can invoke Azure Functions to enhance your ETL (Extract, Transform, Load) and ELT (Extract, Load, Transform) processes:

• Custom Data Processing: Use Azure Functions for custom data transformations not natively supported by Data Factory, such as encrypting sensitive data before loading it into a data warehouse.
• Data Orchestration: Incorporate Azure Functions into ADF pipelines for complex data workflows, enhancing data extraction, encryption, and loading.