Overview

A tenant master key is the infrastructure for data encryption in OceanBase Database. The Transparent Data Encryption (TDE), Column Encryption, and Function Encryption features all rely on tenant master keys.

Two-level key architecture

OceanBase Database uses a two-level key architecture for data encryption:

• Tenant master key: Each tenant has a master key, which is used to encrypt and protect data keys. The master key is stored in the keystore.
• Data key: A data key is used to directly encrypt data. Each encrypted tablespace has a corresponding data key.

To ensure data security, users cannot directly view or specify the master key or data key. These keys are generated by the system and are not stored in plaintext on the disk, significantly enhancing system security.

Keystore

The keystore is the management module for the master key, providing key management services. The keystore supports the following features:

• Master key generation: The keystore generates the master key based on the encryption algorithm. Users cannot specify the master key.
• Storage of master key-related information: The keystore ensures the multi-replica, consistency, and fault-tolerance features of the master key.
• Master key management and multi-version control: The multi-version mechanism allows new master keys to take effect gradually without immediately replacing the existing ones.
• High availability service for retrieving the master key.
• Processing of keystore operation instructions.

Storage of the master key

The tde_method parameter specifies the storage method of the master key:

The storage method of the master key is described as follows:

• The internal and obcloud methods are supported. In the internal method, the encryption information of the master key is stored in an internal table. To avoid circular dependencies during log replay, the clog is not encrypted in this method. In the obcloud method, the master key is managed by the OceanBase Cloud KMS or OCP KMS proxy service.
• When an external KMS (such as obcloud) is used, you can configure the external_kms_info parameter to specify the address, authentication information, and key name of the KMS. The database uses this configuration to connect to and access the external KMS to obtain the master key.

When encryption is enabled, the system uses the master key to encrypt the data key and stores the encrypted data key in the internal table, macroblock header, and clog header. The data key is not stored in plaintext anywhere. When data needs to be encrypted or decrypted, the system uses the master key to decrypt the encrypted data key and then encrypts or decrypts the user data in the macroblock or clog.

References

• Generate a tenant master key (MySQL mode)
• Generate a tenant master key (Oracle mode)