Systems, methods, and devices for encrypting database data
A method for encrypting database data includes generating an encryption key for a first file stored in a data store, wherein a table in a database comprises an entry pointing to the first file. The method includes generating a second file by encrypting the data the first file in the data store using the encryption key without modifying the first file. The method includes, in response to generating the second file, modifying the entry in the table to point to the second file, wherein the modification of the entry is performed atomically. A process for rekeying from the first file to the second file may happen in the background without blocking, interfering, or otherwise obstructing user interaction with a database system.
1. A method, comprising:
generating a mapping for a plurality of encrypted files that are stored in a database, wherein the mapping associates the plurality of encrypted files with a plurality of encrypted keys and wherein a first encrypted file of the plurality of encrypted files is encrypted with a first encryption key;
in response to a request to re-encrypt the first encrypted file, generating a second encrypted file by re-encrypting data in the first encrypted file using a second encryption key, wherein both the first encrypted file and the second encrypted file are stored in the database and remain accessible to queries for a period of time;
updating the mapping to include the second encrypted file, wherein the mapping is updated after the second encrypted file has been generated; and
marking, after updating the mapping, the first encrypted file as expired to prevent a query from accessing the first encrypted file after the period of time has expired.
2. The method of claim 1 , wherein queries received before the request to re-encrypt the first encrypted file are permitted access to the first encrypted file and queries received after the request to re-encrypt the first encrypted filed are permitted access to the second encrypted file.
3. The method of claim 1 , wherein generating the second encrypted file comprises:
generating the second encryption key; and
decrypting the first encrypted file using the first encryption key to obtain the data in the first encrypted file.
4. The method of claim 1 , further comprising:
removing the first encrypted file after marking the first encrypted file.
5. The method of claim 1 , wherein the mapping is stored in a metadata store and the plurality of encrypted keys are stored in a separate key store.
6. The method of claim 5 , further comprising:
storing one or more of the first encryption key or the second encryption key in the separate key store.
7. The method of claim 1 , further comprising:
permitting read access to the first encrypted file prior to the updating of the mapping being completed.
8. The method of claim 7 , wherein permitting the read access to the first encrypted file comprises:
permitting the read access after one or more of: generation of the second encryption key or beginning generation of the second encrypted file.
9. The method of claim 1 , further comprising:
receiving a query with write access for one or more tables corresponding to the first encrypted file;
determining whether the second encryption key has been generated for the first encrypted file; and
generating, in response to determining that the second encryption key has been generated, the second encrypted file by: modifying the first encrypted file based on the query with write access and encrypting the second encrypted file based on the second encryption key.
10. The method of claim 1 , further comprising:
generating additional encrypted files based on the second encryption key; and
updating the mapping to include the additional encrypted files, wherein the mapping is updated after the additional encrypted files have been generated.
11. The method of claim 1 , wherein one or more of:
generating the second encryption key is performed without locking the database;
generating the second encrypted is performed without locking the database; and
updating the mapping is performed without locking the database.
12. An apparatus, comprising:
a memory to store data; and
one or more processors coupled to the memory, the one or more processors to:
generate a mapping for a plurality of encrypted files that are stored in a database, wherein the mapping associates the plurality of encrypted files with a plurality of encrypted keys and wherein a first encrypted file of the plurality of encrypted files is encrypted with a first encryption key;
in response to a request to re-encrypt the first encrypted file, generate a second encrypted file by re-encrypting data in the first encrypted file using a second encryption key, wherein both the first encrypted file and the second encrypted file are stored in the database and remain accessible to queries for a period of time;
update the mapping to include the second encrypted file, wherein the mapping is updated after the second encrypted file has been generated; and
mark, after updating the mapping, the first encrypted file as expired to prevent a query from accessing the first encrypted file after the period of time has expired.
13. The apparatus of claim 12 , wherein queries received before the request to re-encrypt the first encrypted file are permitted access to the first encrypted file and queries received after the request to re-encrypt the first encrypted filed are permitted access to the second encrypted file.
14. The apparatus of claim 12 , wherein to generate the second encrypted file the one or more processors are further to:
generate the second encryption key; and
decrypt the first encrypted file using the first encryption key to obtain the data in the first encrypted file.
15. The apparatus of claim 12 , wherein the one or more processors are further to:
remove the first encrypted file after marking the first encrypted file.
16. The apparatus of claim 12 , the one or more processors are further to:
permit read access to the first encrypted file prior to the updating of the mapping being completed.
17. The apparatus of claim 16 , wherein to permit read access to the first encrypted file the one or more processors are further to:
permit read access after one or more of: generation of the second encryption key or beginning generation of the second encrypted file.
18. The apparatus of claim 12 , wherein the one or more processors are further to:
receive a query with write access for one or more tables corresponding to the first encrypted file;
determine whether the second encryption key has been generated for the first encrypted file; and
generate, in response to determining that the second encryption key has been generated, the second encrypted file by: modifying the first encrypted file based on the query with write access and encrypting the second encrypted file based on the second encryption key.
19. The apparatus of claim 12 , wherein one or more of:
generating the second encryption key is performed without locking the database;
generating the second encrypted is performed without locking the database; and
updating the mapping is performed without locking the database.
20. A non-transitory computer-readable medium storing instructions which, when executed by one or more processors of a computing device, cause the computing device to:
generate a mapping for a plurality of encrypted files that are stored in a database, wherein the mapping associates the plurality of encrypted files with a plurality of encrypted keys and wherein a first encrypted file of the plurality of encrypted files is encrypted with a first encryption key;
in response to a request to re-encrypt the first encrypted file, generate, by the one or more processors, a second encrypted file by re-encrypting data in the first encrypted file using a second encryption key, wherein both the first encrypted file and the second encrypted file are stored in the database and remain accessible to queries for a period of time;
update the mapping to include the second encrypted file, wherein the mapping is updated after the second encrypted file has been generated; and
mark, after updating the mapping, the first encrypted file as expired to prevent a query from accessing the first encrypted file after the period of time has expired.