Security & Secrets Management
Relevant source files
The following files were used as context for generating this wiki page:
Security and Secrets Management within the trading system focuses on the secure handling of connection credentials, database authentication, and encrypted communication channels. The system integrates with external brokers like Interactive Brokers (IB) and databases like PostgreSQL, requiring structured management of sensitive information such as API keys, passwords, and SSL certificates.
The architecture emphasizes a separation between core trading logic and configuration management. Credentials for local databases and remote trading gateways are typically handled through command-line arguments, environment variables, or specific configuration files (e.g., Lua-based config maps for XTQuant).
Database Authentication
In production-like strategies, such as the RiskAverseStrategy, the system interacts with PostgreSQL for historical market data storage. Authentication is handled via parameters passed during runtime, which include sensitive fields for the database user and password.
Key Authentication Parameters
The system uses the following parameters for PostgreSQL connectivity:
| Parameter | Default Value | Description |
|---|---|---|
--dbuser | jason | PostgreSQL username for authentication. |
--dbpass | fsck | PostgreSQL password for authentication. |
--dbname | market_data | Target database name. |
Sources: strategies/risk_adverse.py:465-471
Secure Broker Connections
Communication with Interactive Brokers and XTQuant involves network-level security configurations. The system supports SSL for secure data transmission and proxy authentication for gated network environments.
SSL/TLS Configuration
The xtquant module provides specific configuration structures for SSL-enabled connections. This includes paths to Certificate Authority (CA) files and server-side private keys.
The following configuration elements are pertinent to SSL management:
isUseSSL: Boolean flag to enable/disable encryption.crtPath: Path to the SSL certificate.serverKeyPath: Path to the server private key.sslPassword: Password protecting the private key.
Sources: xtquant/config/configHelper.lua:165-171, xtquant/config/configHelper.lua:142-143
Proxy and Gateway Security
For environments behind firewalls, the system supports proxy authentication. This involves managing credentials for various proxy types, including HTTP, SOCKS4, and SOCKS5.
| Configuration Field | Description |
|---|---|
proxyType | Integer identifying proxy protocol (0=None, 1=HTTP, 2=SOCKS4, 3=SOCKS5). |
proxyUserName | Username for proxy server authentication. |
proxyPassword | Password for proxy server authentication. |
proxyNeedCheck | Boolean flag indicating if proxy credentials are required. |
Sources: xtquant/config/configHelper.lua:144-149
Interactive Brokers (IB) Client Security
The IB Store implementation manages client identity and connection-level synchronization. Connection security is primarily restricted via clientId and readonly flags.
Connection Workflow
When connecting to the IB Gateway or TWS, the system validates the clientId to ensure it is unique per connection. This prevents unauthorized session hijacking.
- Read-Only Mode: A
readonlyflag can be set during connection to prevent order execution, acting as a safeguard for data-only sessions. - Client ID Management: The system can generate a random
clientIdbetween 1 and $2^{16}-1$ if one is not provided, reducing the risk of ID collisions.
Sources: backtrader/stores/ibstore_insync.py:901-907, backtrader/stores/ibstore_insync.py:255-259
Secret Storage Philosophy
The project roadmap indicates a move towards more robust secret management for production environments. Future plans involve:
- pgvector-backed Logs: Storing decision logs and potentially sensitive trading metadata in Postgres with restricted access.
- Environment Separation: Distinct modes for
Replay,Paper Trade, andLive Trade, each requiring different levels of credential exposure. - Agentic Tool Isolation: Using typed wrappers like
InteractiveBrokersClientToolto encapsulate the logic for order submission, effectively abstracting the underlying credentials from the agent logic.
Sources: PLAN.md:14-22, PLAN.md:52-58
Conclusion
Security and Secrets Management in the system is currently characterized by configuration-based authentication for databases and broker gateways. While standard credentials (usernames/passwords) are passed via command-line or config maps, the system provides infrastructure for SSL/TLS and proxy security to ensure data integrity during live execution. Future development aims to further isolate credentials through agentic tool abstractions.