Configure Transparent Data Encryption

Transparent Data Encryption (TDE) allows user data to be encrypted before being written to disk. Before encryption can be enabled on a database, the domain administrator must configure a storage password for the database. All SMs and TEs in the database will use this storage password as a key to secure the encrypted data. The storage password can be initialized or changed at any time, whether the database is running or not. If a storage password is already configured for the database it must be supplied in order to change to a different storage password.

Set up Transparent Data Encryption

To enable TDE on a database, a storage password must be added using NuoDB Admin. The database must exist but may or may not be running.

nuocmd update data-encryption --db-name <DB-name> \
    --new-password <password> \
    --is-initial-password

Now that the database has a storage password, encryption can be enabled and disabled using the ALTER DATABASE change encryption type command. Database administrator privileges are required to use this command.

To encrypt the database, set the encryption type to AES128 or AES256. For example, to set the encryption type to AES128, run:

ALTER DATABASE change encryption type AES128;

To decrypt the database, set the encryption type to NONE.

ALTER DATABASE change encryption type NONE;

The encryption type for SMs and TEs that were not running when the encryption type was changed will update automatically when the SMs and TEs start. The database always has the same encryption type on all nodes.

Check the Type of Encryption

To check the current encryption type of the database, query the NODES System Table.

For example:

SELECT startid,address,type,disk_encryption FROM system.nodes;

 STARTID   ADDRESS      TYPE     DISK_ENCRYPTION
 ------- ---------- ----------- ----------------

    0    172.18.0.2 Storage         AES128
    2    172.18.0.3 Storage         AES128
    1    172.18.0.2 Transaction     AES128
    3    172.18.0.3 Transaction     AES128

Here, the encryption type for the database is AES128 and background encryption is complete.

If SMs are in the process of encrypting their archives, the percentage of data that has been encrypted will be shown in the DISK_ENCRYPTION column.

For example:

ALTER DATABASE change encryption type AES256;
SELECT startid,address,type,disk_encryption FROM system.nodes;

 STARTID  ADDRESS     TYPE     DISK_ENCRYPTION
 -------- -------- ----------- ----------------

    0     10.1.1.4 Storage      AES256 46.22%
    1     10.1.1.3 Transaction  AES256

If the database is not encrypted, DISK_ENCRYPTION is NONE.

For example:

SELECT startid,address,type,disk_encryption FROM system.nodes;

 STARTID  ADDRESS     TYPE     DISK_ENCRYPTION
 -------- -------- ----------- ----------------

    0     10.1.1.4 Storage           NONE
    1     10.1.1.3 Transaction       NONE

Here, the encryption type for the database is NONE and background decryption is complete.

Decryption of archives will also proceed in the background. If SMs are in the process of decrypting their archives, the percentage of data that has been decrypted will be shown in the DISK_ENCRYPTION column.

SELECT startid,address,type,disk_encryption FROM system.nodes;

 STARTID  ADDRESS     TYPE     DISK_ENCRYPTION
 -------- -------- ----------- ----------------

    0     10.1.1.4 Storage       NONE 52.10%
    1     10.1.1.3 Transaction   NONE

Verify the Storage Password

Use the nuoarchive tool to verify the storage password that a non-running archive is encrypted with.

If the archive is encrypted, nuoarchive check will prompt for the storage password when run on the archive.

For example:

nuoarchive check /var/opt/nuodb/archive/mydb

Enter Storage Password:
...
[INFO ] nuochk: Archive verification found no issues.

Alternatively, the storage password may be provided to nuoarchive via the NUODB_STORAGE_PASSWORD environment variable.

Change the Storage Password for a Database

To change the storage password for a TDE-enabled database, the current storage password must be specified with the --current-password argument:

nuocmd update data-encryption --db-name <DB-name> \
    --current-password <current-password> \
    --new-password <new-password>

The current storage password is verified (see the note below) before the database’s storage password is updated. Any SMs that are not running when the storage password is changed will update their storage password when they are started. Database archives do not need to be re-encrypted when the storage password is changed: it happens immediately so the data_encryption column of the system.nodes table will not show a percentage complete.

All passwords that are used to encrypt any archive which belongs to the database must be provided using the --existing-passwords option during password rotation. NuoDB Admin will automatically add the current password to the specified list of existing passwords. Common situations that require adding existing passwords are:

An SM is not in a RUNNING state when two or more subsequent TDE password rotations were performed
The database archive has been restored from a backup that was encrypted with a password different from the current one

Lifetime of the Storage Password

Each AP in the domain preserves in memory all storage passwords that have been configured since the domain started. When a new AP joins the domain, it is provided with all storage passwords known to the domain. If the entire domain is stopped, all storage passwords are forgotten: no storage passwords will be present when the domain restarts. In this situation the domain administrator must use the update data-encryption command to re-add storage passwords before encrypted databases can be restarted.

Storage passwords are never made durable. However, a one-way salted hash of the current storage password is saved in the NuoDB Admin Raft log. It is not possible to recover the storage password from this hash, but it will be used to verify that passwords provided to update data-encryption --current-password are correct even after domain restart.

Normally, all archives in a database will use the current storage password for that database. However, if an archive is offline when the storage password is changed, or if an archive is restored from an encrypted hot copy created with a different storage password, the domain will need to know the older storage password(s) as well.

If the domain does not have the storage password needed to start an SM, the domain administrator must add older required storage passwords using the --existing-passwords argument to update data-encryption. Although the --new-password option must also be provided, it may have the same value as the --current-password to avoid changing the current storage password:

 nuocmd update data-encryption --db-name <DB-name> \
    --current-password <current-password> \
    --new-password <current-password> \
    --existing-passwords <old-password-1> <...> <old-password-n>