Hardware Credentials Encryption at Rest

IMPLEMENTED

Edge router and OLT management credentials represent high-value administrative assets. Exposing them in plain text in database backups or logs poses critical risk.

1. Encryption Implementation

Located in backend/apps/network/models.py:

• Sensitive fields (Router.encrypted_password, OLT.snmp_community) are encrypted symmetrically before saving to the database using Python's cryptography.fernet.Fernet.
• The encryption key is derived from the master environment secret SECRET_KEY.

from cryptography.fernet import Fernet
import base64
import hashlib

def get_cipher():
    key = hashlib.sha256(settings.SECRET_KEY.encode()).digest()
    return Fernet(base64.urlsafe_b64encode(key))

def encrypt_credential(plain_text: str) -> str:
    if not plain_text:
        return ''
    return get_cipher().encrypt(plain_text.encode()).decode()

def decrypt_credential(cipher_text: str) -> str:
    if not cipher_text:
        return ''
    return get_cipher().decrypt(cipher_text.encode()).decode()

2. API Serializer Masking

Serializers for Router and OLT never return decrypted passwords in GET responses:

• The password field is defined as write_only=True.
• In GET responses, password fields return ******** or are completely omitted.