Snowflake Encryption: Key Types, Benefits & ENCRYPT Command Made Easy

Businesses today are overflowing with data. The amount of data produced every day is truly staggering. With Data Explosion, there has been an ever-increasing pressure on Data Warehousing companies like Snowflake to make sure that their data is kept secure based on the roles and responsibilities of the users trying to access the data. This is where Snowflake encryption comes in.

Snowflake is a Data Warehouse that has become an industry-leading Cloud-Based SaaS (Software-as-a-service) Data Platform. Snowflake is always seeking ways to improve its offerings and enhance its data encryption and security practices thereby, making it a Data Warehouse of choice. This article will discuss Snowflake encryption and some details of related technologies, in an easy-to-understand fashion. The aim is to make you familiar with how snowflake encryption works and is beneficial for you.

Table of Contents

• What is Snowflake?
  • Key Features of Snowflake
• What is Data Encryption?
• What is Snowflake Encryption?
• What is the Role of Hardware Security Module (HSM)?
• Dynamics of Data Transfer in Snowflake
• How does Snowflake Encryption Work?
• How does Snowflake Encryption At Rest?
  • File Uploads to Staging Areas
    • What are Snowflake-provided Staging Areas?
    • What are Customer-provided Staging Areas?
• What is the use of a Storage Integration?
• How does Snowflake Encryption ensure Impenetrability?
• How is Snowflake Encryption used while Transferring Data?
• How does Snowflake Encryption work during Querying and Processing Data?
• What is Snowflake ENCRYPT Command?
• Additional Benefits of Snowflake Encryption
• Conclusion

What is Snowflake?

Snowflake is a Cloud Data Warehousing solution provided as a SaaS offering. It is built on Amazon Web Service, Microsoft Azure, or Google Cloud infrastructure that provides an unbounded platform for storing and retrieving data. Snowflake Data Warehouse uses a different proprietary SQL Database Engine with a unique architecture designed for the cloud.

The architecture of Snowflake separates its “Compute” and “Storage” units, thereby scaling differently. This allows the customers to use and pay for both services independently. It means organizations that have high storage demands but less need for CPU cycles, or vice versa, do not have to pay for an integrated bundle that requires payment for both, making it very attractive to companies. Like other popular Data Warehouses, it also uses Columnar Storage for parallel query execution.

With Snowflake, there is no hardware or software to select, install, configure, or manage, therefore, making it ideal for organizations that do not want to have dedicated resources for setup, maintenance, and support for in-house servers. Snowflake security and sharing functionalities make it easy for organizations to quickly share and secure data in real-time using any available ETL solution. Snowflake is known for its scalability and relative ease of use when compared to other Data Warehouses in the market.

Key Features of Snowflake

Here are some of the benefits of using Snowflake as a Software as a Service (SaaS) solution:

• Snowflake enables you to enhance your Analytics Pipeline by transitioning from nightly Batch Loads to Real-time Data Streams, allowing you to improve the quality and speed of your analytics. By enabling secure, concurrent, and monitoring access to your Data Warehouse across your organization, you can improve the quality of analytics at your company.
• Snowflake uses the Caching Paradigm to swiftly deliver the results from the cache. To avoid re-generation of the report when nothing has changed, Snowflake employs Persistent (within the session) Query results.
• Snowflake allows you to get rid of silos and ensure access to meaningful insights across the enterprise, resulting in better Data-driven Decision-Making. This is a crucial first step toward bettering partner relationships, optimizing pricing, lowering operational expenses, increasing sales effectiveness, and more.
• Snowflake allows you to better analyze Customer Behaviour and Product Usage. You can also use the whole scope of data to ensure customer satisfaction, drastically improve product offers, and foster Data Science innovation.
• Snowflake allows you to create your own Data Exchange, which allows you to securely communicate live, controlled data. It also encourages you to improve data relationships throughout your business units, as well as with your partners and customers.

What is Data Encryption?

Data Encryption can convert the data into code or a different form that only users who have a secret password or key can read. It gets frequently automated as a part of a data platform’s other procedures.

In the context of a data cloud, encryption is separated into two distinct areas: securing the data stored in tables, also known as encryption of data at rest, and securing the data sent to and from the data cloud, which is known as securing data in transit. Both have become ubiquitous in the last few years to mitigate real risks to your data.

In this context, Snowflake can encrypt all customer data by default, by leveraging the latest security standards, at no additional cost. Therefore, Snowflake Encryption allows Snowflake to be one of the most secure and easiest-to-use data platforms in the marketplace.

What is Snowflake Encryption?

Snowflake encrypts your data to make sure no one, except the intended audience, is able to read your data even if they gain unauthorized access to it. Simply put, encryption entails picking up a subset of your data and transforming it into a new subset that is a string of alphanumeric characters, using a special cryptographic function plus your private key. 

E.g. when a string like “I paid $75 to Megan” is encrypted using a private key with AES-256 compatible algorithm, the resultant Base 64 encoded, the encrypted text comes out as:

mtJme3b1dXTQSk5gVwRmSdWMeBp459quQuF1s3t7RnQ=

Now even if someone gets hold of this string while the data was in transit, he cannot decipher its meaning unless he uses my public key to decrypt it. 

There is a lot more to it, but the above is a simple analogy of the concept of Snowflake encryption.

What is the Role of Hardware Security Module (HSM)?

A hardware security module or HSM is a tamper-proof secure way to generate, store and use cryptographic keys. Your key never leaves the HSM and all encryption/decryption operations are performed in the HSM itself. HSM provides an API to delegate all operations that need a private key, to be run in the HSM internally. 

HSM then returns the encrypted result of those operations, thereby always hiding your private key(s) behind iron curtains. During key rotation and rekeying also, an HSM generates secure random keys to make these operations impermeable.

Dynamics of Data Transfer in Snowflake

In Snowflake, you load data from an external entity or your corporate network, into an intermediate staging area and then into Snowflake. This intermediate staging area could also be some third-party Data Warehouses/Data Lakes, like Amazon S3, etc.

Snowflake recommends that you encrypt your data in your staging area itself, or keep it encrypted in your corporate network so that your data is better secured while in transit into Snowflake. In case there is no encryption at the source, Snowflake will encrypt the data as soon as it is entered into a Snowflake table.

If you’re using the Snowflake client to export data into Snowflake, the Snowflake client will first encrypt your data and then send it to Snowflake’s secure virtual private cloud (VPC) or virtual network (VNet). Again as soon as data enters Snowflake, it gets encrypted again.

How does Snowflake Encryption Work?

For encryption, Snowflake uses a method that is similar to the asymmetric key algorithm discussed above. Here the customer first creates a master key which is then shared with Snowflake. This master key is a 256-bit Advanced Encryption Standard (AES) key encoded in Base64. This master key is normally a composite of the customer’s private key and Snowflake’s managed encryption key. 

This key combination, when stored in the cloud provider platform alongside your Snowflake account, is called Tri-Secret Secure. Since the master key includes a customer’s private key, in case of a suspected data breach, the customer can restrict access to his private key, thereby halting all operations in Snowflake. 

This allows for better control of the encryption/decryption process and increased control in case of problems. Though it comes with some added responsibility for the customer to ensure confidentiality and integrity of his private key(s), this is a better tradeoff considering the enhanced security and leverage that it offers.

How does Snowflake Encryption At Rest?

Snowflake offers end-to-end encryption (E2EE) to ensure that only end-users and the Snowflake runtime components have access to user data. Because the data is encrypted at rest and only decrypted in the memory of the Snowflake runtime components, even the cloud provider where the user’s Snowflake account gets deployed can’t read it.

File Uploads to Staging Areas

Before a data gets transferred into a table in Snowflake, you first need to upload it to a staging area. Even if you assume that only authenticated users have access to staging areas, your data’s confidentiality and integrity gets jeopardized if your credentials are compromised. There are two types of staging areas supported by Snowflake:

• Snowflake-provided Staging Area (Internal Stage)
• Customer-provided Staging Area (External Stage)

What are Snowflake-provided Staging Areas?

Snowflake Encryption automatically encrypts files before loading them into tables when uploaded to a staging area supplied by Snowflake. Internal staging areas are available at Snowflake in the following configurations:

• Table Stages: Each table has its own staging area which is allocated under Snowflake encryption. You can leverage this option when data files need to be accessible by several users but can only get copied to a single table.
• User Stages: Every user has their own staging area in Snowflake. You can choose this option when data files should only be accessible by one user but may get copied to multiple tables.
• Named Stages: Named stages are database objects that may be configured, created, and shared to provide users the most flexibility and options.

What are Customer-provided Staging Areas?

When uploading data to customer-provided or external stages, users can opt to encrypt their files. Snowflake manages data encryption by interacting with the Cloud provider’s storage services’ native capabilities. These are the choices you can choose from for Snowflake Encryption’s customer-provided staging areas:

• Server-side Encryption: The data can get transferred from the client to the cloud provider, who can then encrypt it before storing it on disk. This option is a fantastic solution since it strikes a decent balance between operational costs and security.
• No Encryption: The data is transferred from the client and saved on disk in the cloud provider’s data center in cleartext. Although this approach is deemed the simplest, it is not a recommended Snowflake Encryption option.
• Client-side Encryption: The data gets encrypted on the client before being uploaded to the cloud. This option is the safest choice since clear-text information doesn’t transfer to the cloud; however it necessitates more planning and works on the customer’s part.

What is the use of a Storage Integration?

Creating a storage integration between Snowflake and the public cloud where the external stage’s storage is situated is better to connect to external storage as opposed to explicitly inserting credentials. This option offers the following security advantages:

• To have more control over where data is loaded from and into, users can directly specify locations for their stages.
• When implementing “CREATE STAGE”, users do not need to transfer credentials between queries.

How does Snowflake Encryption ensure Impenetrability?

These days 64-bit encryption is no longer considered safe and 128-bit is the minimum prescribed length of the key. Snowflake uses 256-bit encryption in its keys,  which are then saved in a hardware security module in a hierarchical fashion. 

This hierarchical model arranges keys in several layers, keys at the higher level are called parent keys, which encrypt( or wrap) the keys just below them( child keys). 

Snowflake’s hierarchical key model consists of four levels of keys:

• The Root key.
• Account master keys: Every account has its own master keys.
• Table master keys: Encrypt tables, 1 table master key per table is normally used. 
• File keys: Encrypt each individual file.

Moreover, keys are frequently rotated and data is automatically re-encrypted (“rekeyed”) on a regular basis. Rekeying data does not require any downtime hence your workloads and queries are not affected. Snowflake encryption takes extra measures to ensure additional security and to be future compatible with the latest developments. 

How is Snowflake Encryption used while Transferring Data?

First, the client generates or specifies his private key and defines a stage in Snowflake. A stage is a repeatable container process that has a specified cloud storage service target, the client’s private key, and some settings. 

The Snowflake client generates another key which is a random encryption key. Using this random encryption key, the client encrypts the data. Then, this random encryption key is itself encrypted using the customer master key. 

Now the client sends the encrypted data and the encrypted random encryption key to Snowflake. Snowflake already has the customer master key which is used to decrypt the random encryption key first. 

Then Snowflake uses this decrypted random encryption key to decrypt the sent data. Encrypting the random encryption key ensures that even if somebody gets hold of this key in transit, he cannot use it as it’s encrypted. 

Encrypting the data ensures that no one can eavesdrop on it, and it can be deciphered only by someone (Snowflake in this case) who has the customer master key.

How does Snowflake Encryption work during Querying and Processing Data?

To make things more secure Snowflake keeps your data in its proprietary file format. All data at rest inside Snowflake is encrypted. All data in transit is also encrypted. When you run queries, operations, or transformations on your data, Snowflake decrypts the data to perform your operations but quickly re-encrypts the data once the desired operation is complete. 

Your query results are auto encrypted when unloaded to a Snowflake-provided stage, if you’re unloading them to your own (customer managed/outside) stage encryption is the optional but recommended way to go. Once you get the results to your computer, you can easily decrypt them to make them readable and easily usable.

What is Snowflake ENCRYPT Command?

Here’s how you can use the Snowflake ENCRYPT command. It will encrypt a VARCHAR or BINARY value using a VARCHAR passphrase. Below is the syntax for using the ENCRYPT command.

ENCRYPT( <value_to_encrypt> , <passphrase> ,
[ [ <additional_authenticated_data> , ] <encryption_method> ]
)

Additional Benefits of Snowflake Encryption

• Snowflake encryption is one of the enablers of Continuous Data Protection (CDP). CDP is a set of features that Snowflake implements to protect data against hardware/software failure, malicious use, human error, etc. 
• Along With measures like Multi-Factor Authentication (MFA), IP address-based access, Roles, and maintaining Historical data; encryption is a CDP feature that ensures that data is encrypted and thereby protected against data leakage. 
• Even if someone gets hold of your data, he cannot decrypt and read it, so your data is readable only to intended users. 
• Snowflake encryption has earned all the highest security accreditations including SOC 2 Type II, PCI-DSS, HIPAA, and HITRUST CSF. 

Conclusion

We have discussed how Snowflake encryption works to ensure the security of your data while in transit and when it’s at rest on Snowflake’s Data Warehouse. Also, how Snowflake encryption and decryption work on your queries and their results. We hope this helps you understand the benefits of Snowflake encryption and how to make the best use of it.

Snowflake has a list of tools that can be integrated into it by simply accessing its tools page and selecting the platform you need. Hevo Data is a good data tool to integrate with Snowflake as it helps you to create efficient datasets and transforms your data into insightful actionable leads.

visit our website to explore hevo

Hevo Data, with its strong integration with 100+ Sources & BI tools, allows you to not only export data from sources & load data in the destinations such as Snowflake, but also transform & enrich your data, & make it analysis-ready so that you can focus only on your key business needs and perform insightful analysis using BI tools. In short, Hevo can help you store your data securely in Snowflake.

Give Hevo Data a try and sign up for a 14-day free trial today. Hevo offers plans & pricing for different use cases and business needs!

Share your experience of working with Snowflake encryption in the comments section below.