About Transparent Data Encryption
Protects sensitive at-rest data stored in configuration files, database tables and SSTable indexes.
- Configuration file properties: Protects LDAP search password, LDAP truststore password, SSL truststore passwords.
- System resources: Protected properties using the same key for the
system.batchlog
andsystem.paxos
tables, hint files and commit logs. - Database tables and SSTable indexes: Protects all data in the table and
on-disk SSTable indexes. Different tables can use different keys.
SSTable data files are immutable once they have been flushed to disk and are only encrypted during the write to disk. To encrypt existing data, use the nodetool upgradesstables with the
-a
option to rewrite the tables to disk with encryption.Important: When Transparent Data Encryption (TDE) is enabled, starting in DSE 6.8, all header data in indexes are encrypted including partition keys in SSTable indexes. This feature is designed to protect sensitive data that might be present in the primary key. Consequently, DSE cannot access SSTables that are not decryptable. When non-decryptable SSTables are present, DSE issues an error message during startup. If the error is ignored due to the chosen disk failure policy – that is, when the policy isignore
orbest_effort
– DSE skips the non-decryptable SSTable and thus ignores its content on queries without issuing a warning or error.
Data that is not encrypted
- Database files other than the commit log
- SSTable data files such as offsets and tokens
- DSEFS data files
Requirements
When using TDE secure local file system. Encryption keys are stored remotely with KMIP encryption or locally with on-server encryption.
TDE limitations and recommendations
The following utilities cannot access encrypted data, but will operate on all unencrypted data.
Compression and encryption introduce performance overhead.
Utility | Reason utility is not encrypted |
---|---|
nodetool | Uses only JMX, so data is not accessed. |
sstableloader | Operates directly on the SSTables. |
sstablescrub | Operates directly on the SSTables. |
sstableutil | Operates directly on the SSTables. |
sstableverify | Operates directly on the SSTables. |
config_encryption_active
is true
in DSE and
OpsCenter. For LCM limitations, see Encrypted DSE configuration values.