A tenant master key is the infrastructure for data encryption in OceanBase Database. The Transparent Data Encryption (TDE), Column Encryption, and Function Encryption features all rely on tenant master keys.
Applicability
Community Edition of OceanBase Database does not support tenant master keys.
Two-level key system
OceanBase Database implements data encryption using a two-level key system:
- Tenant master key: Each tenant has a master key used to encrypt and protect data keys. The master key is stored in the keystore.
- Data key: Used to directly encrypt data. Each encrypted tablespace has a corresponding data key.
To ensure data security, users cannot directly view or specify the master key and data key. These keys are generated by the system and are not stored in plaintext on the disk, significantly enhancing system security.
Keystore
Keystore is the module responsible for managing the master key, providing key management services. The features of keystore include:
- Master key generation: The master key is generated by keystore based on the encryption algorithm, and users cannot specify it.
- Storage of master key information: Keystore ensures the multi-replica, consistency, and fault tolerance of the related information.
- Master key management and multi-version control: The multi-version mechanism allows new master keys to take effect gradually without needing to be immediately active.
- High availability service for retrieving the master key.
- Processing operation instructions for keystore.
Master key storage methods
The storage method for the master key is controlled by the parameter tde_method:
tde_method value |
Description |
|---|---|
none |
No tenant master key is generated (default value) |
internal |
The master key is stored in an internal table |
bkmi |
The master key is stored in an external BKMI system |
obcloud |
The master key is stored in the OceanBase Cloud KMS service |
Notice
- Encryption cannot be enabled for the sys tenant.
- Once the
tde_methodparameter is set to a value other thannone, it cannot be modified. You cannot switch to another encryption method unless you rebuild the tenant.
Master key storage methods:
- Both
internalandobcloudare supported. With theinternalmethod, the master key encryption information is stored and managed in internal tables. To avoid cyclic dependencies during log replay, the clog is not encrypted in this method. With theobcloudmethod, the master key is managed through OceanBase Cloud KMS or the OCP KMS proxy service. - When using an external KMS (such as
obcloud), in addition to settingtde_method, you can configure external_kms_info to specify the KMS address, authentication information, key name, and so on. The database uses this configuration to connect to and access the external KMS to obtain the master key.
When encryption is enabled, the master key is used to encrypt the data key, producing encrypted data key ciphertext. This ciphertext is stored in the internal table, macroblock header, and clog header. The data key is not stored in plaintext anywhere. When data needs to be encrypted or decrypted, the master key is used to decrypt the ciphertext to obtain the data key, which is then used to encrypt or decrypt the user data in the macroblock or clog.