About Transparent Data Encryption
Protects sensitive at-rest data stored in configuration files and in database tables.
- Configuration file properties: Protects LDAP search password, LDAP truststore password, SSL truststore passwords.
- System resources: Protected properties using the same key for the system.batchlog and system.paxos tables, hint files and commit logs.
- Database tables: Protects all data in the table except for the primary
key columns. Different tables can use different keys.
SSTable data files are immutable once they have been flushed to disk and are only encrypted during the write to disk. To encrypt existing data, use the nodetool upgradesstables with the
-a
option to rewrite the tables to disk with encryption.Warning: Primary keys are stored in plain text. Do NOT put sensitive information in partition key or clustering columns.
Data that is not encrypted
- Table partition key columns
- Database files other than the commit log and SSTable data files
- DSEFS data files
- Spark spill files
Requirements
To use the DataStax Enterprise (DSE) Transparent Data Encryption (TDE) feature, enable the Java Cryptography Extension (JCE).
When using TDE on a secure local file system, encryption keys are stored remotely with KMIP encryption or locally with on-server encryption.
TDE limitations and recommendations
The following utilities cannot access encrypted data, but will operate on all unencrypted data.
Compression and encryption introduce performance overhead.
Utility | Reason utility is not encrypted |
---|---|
nodetool | Uses only JMX, so data is not accessed. |
sstableloader | Operates directly on the SSTables. |
sstablescrub | Operates directly on the SSTables. |
sstableutil | Operates directly on the SSTables. |
sstableverify | Operates directly on the SSTables. |
config_encryption_active
is
true
in DSE and OpsCenter. For LCM limitations, see Configuration
encryption.TDE options
To get the full capabilities of TDE and to ensure full algorithm support, enable JCE Unlimited.