Encrypt table data with KMIP keys

Encrypt data stored in a table using a Key Management Interoperability Protocol (KMIP) key.

Prerequisites

Complete the steps in Adding a KMIP host.

If any of the defined KMIP groups are not available, HCD startup fails.

Use the `hcd.yaml` file to encrypt table data

Locate the hcd.yaml configuration file. The location of this file depends on your installation type.
- Package installations
- Tarball installations
/etc/hcd/hcd.yaml
INSTALLATION_LOCATION/resources/hcd/conf/hcd.yaml
Replace INSTALLATION_LOCATION with the path where you extracted the HCD tarball.
To create a new encrypted table using a key from a KMIP server:
- Encryption without compression:
  CREATE TABLE customers ... WITH COMPRESSION = { 'class': 'Encryptor', 'key_provider': 'KmipKeyProviderFactory', 'kmip_host': 'kmip_group_name' ['key_keyspace': 'kmip_keyspace'], 'cipher_algorithm': 'AES/ECB/PKCS5Padding', 'secret_key_strength': 128 };
  - 'key_provider': 'KmipKeyProviderFactory' tells the encryptor to use a KMIP key server to manage its encryption keys. Include the 'key provider' entry only to specify to use a KMIP key server, otherwise omit this entry.
  - 'kmip_host': 'kmip_group_name' specifies the user-defined KMIP key server group name defined in the kmip_hosts section of the hcd.yaml file.
  - 'kmip_host': 'kmip_group_name' ['key_keyspace': 'kmip_keyspace'] specify an optional KMIP keyspace. Use keyspaces to allow granular management of keys on a per table or keyspace basis.
- Compression and encryption:
  CREATE TABLE customers ... WITH COMPRESSION = { 'class': 'EncryptingDeflateCompressor', 'key_provider': 'KmipKeyProviderFactory', 'kmip_host': 'kmip_group_name', 'cipher_algorithm': 'AES/ECB/PKCS5Padding', 'secret_key_strength': 128 };
To encrypt a pre-existing table:
1. Change the table compression settings:
  - Encryption without compression:
    
    ALTER TABLE customers ... WITH COMPRESSION = { 'class': 'Encryptor', 'key_provider': 'KmipKeyProviderFactory', 'kmip_host': 'kmip_group_name' ['key_keyspace': 'kmip_keyspace'], 'cipher_algorithm': 'AES/ECB/PKCS5Padding', 'secret_key_strength': 128 };
    
    'key_provider': 'KmipKeyProviderFactory' tells the encryptor to use a KMIP key server to manage its encryption keys. Include the 'key provider' entry only to specify to use a KMIP key server, otherwise omit this entry.
    
    'kmip_host': 'kmip_group_name' specifies the user-defined KMIP key server group name defined in the kmip_hosts section of the hcd.yaml file.
    
    ['key_keyspace': 'kmip_keyspace'] specify an optional KMIP keyspace. Use keyspaces to allow granular management of keys on a per table or keyspace basis.
  - Compression and encryption:
    
    ALTER TABLE customers ... WITH COMPRESSION = { 'class': 'EncryptingDeflateCompressor', 'key_provider': 'KmipKeyProviderFactory', 'kmip_host': 'kmip_group_name', 'cipher_algorithm': 'AES/ECB/PKCS5Padding', 'secret_key_strength': 128 };
2. Encrypt existing data on all nodes in the cluster:
```
nodetool upgradesstables -a [keyspace_name [table_name[ tablename]...]
```

Encrypt table data with KMIP keys

Prerequisites

Use the `hcd.yaml` file to encrypt table data

Was this helpful?

Give Feedback

Encrypt table data with KMIP keys

Prerequisites

Use the hcd.yaml file to encrypt table data

Was this helpful?

Use the `hcd.yaml` file to encrypt table data