Robin Schumacher

<p>One of the new security features added in DataStax Enterprise 3.0 is transparent encryption. Let’s take a quick tour of the feature and see how it works.</p>

<h2>What is Transparent Data Encryption?</h2>

<p>Transparent Data Encryption (TDE) is used to encrypt data at rest so that it cannot be easily read by unauthorized users who gain access to the underlying files used to store table / column family data. TDE is especially good for tables containing sensitive data such as human resource information, social security numbers, credit card data, etc.</p>

<h2>How to use Transparent Data Encryption in DataStax Enterprise</h2>

<p>TDE is applied at the table / column family level in DataStax Enterprise. The easiest way to use TDE is specify it at table creation time. TDE is specified using the Cassandra plug in that does both data compression and encryption. An example of specifying TDE for a new table might be:</p>

<pre>
cqlsh:dev&gt; create table emp</pre>

<pre>
... (empid int primary key,</pre>

<pre>
...&nbsp; first_name varchar,</pre>

<pre>
...&nbsp; last_name varchar,</pre>

<pre>
...&nbsp; ssn int)</pre>

<pre>
... with compression_parameters:sstable_compression = 'Encryptor'</pre>

<pre>
...&nbsp;&nbsp; and compression_parameters:cipher_algorithm = 'AES/ECB/PKCS5Padding'</pre>

<pre>
...&nbsp;&nbsp; and compression_parameters:secret_key_strength = 128;</pre>

<p>The above sets AES 128 encryption for the new table. There are a number of different encryption algorithms that may be set for a table:</p>

<table border="1" cellpadding="0" cellspacing="0">
	<thead>
		<tr>
			<td width="137"><strong>cipher_algorithm</strong></td>
			<td><strong>key_strength</strong></td>
		</tr>
	</thead>
	<tbody>
		<tr>
			<td width="137">AES/CBC/PKCS5Padding</td>
			<td>128, 192, 256</td>
		</tr>
		<tr>
			<td width="137">AES/ECB/PKCS5Padding</td>
			<td>128, 192, 256</td>
		</tr>
		<tr>
			<td width="137">DES/CBC/PKCS5Padding</td>
			<td>56</td>
		</tr>
		<tr>
			<td width="137">DESede/CBC/PKCS5Padding</td>
			<td>112 or 168</td>
		</tr>
		<tr>
			<td width="137">Blowfish/CBC/PKCS5Padding</td>
			<td>32-448</td>
		</tr>
		<tr>
			<td width="137">RC2/CBC/PKCS5Padding</td>
			<td>40-128</td>
		</tr>
	</tbody>
</table>

<p>Custom encryption providers may also be installed and used in DataStax Enterprise.</p>

<p>Once encryption is specified for a new table, there is nothing else a developer or administrator needs to do. No changes need to be made at the application level to read or write data; this is where the ‘transparent’ part of TDE comes into play. Data may be written and read in typical fashion:</p>

<pre>
cqlsh:dev&gt; insert into emp</pre>

<pre>
... (empid, first_name, last_name, ssn)</pre>

<pre>
... values (1,'laura','jung',213456789);</pre>

<pre>
cqlsh:dev&gt; select * from emp;</pre>

<pre>
empid  | first_name | last_name | ssn</pre>

<pre>
-------+------------+-----------+-----------</pre>

<pre>
1      |&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; laura |&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; jung | 213456789</pre>

<p>Encrypting data for an existing table can be done, but there are extra steps that need to be followed. First, the ALTER command is used to specify encryption for the existing table:</p>

<pre>
ALTER TABLE dept</pre>

<pre>
WITH compression_parameters:sstable_compression = 'Encryptor'</pre>

<pre>
AND compression_parameters:cipher_algorithm = 'AES/ECB/PKCS5Padding'</pre>

<pre>
AND compression_parameters:secret_key_strength = 128;&nbsp;</pre>

<p>However, the existing SStables on disk still need to be updated to include encryption, which can be accomplished by using nodetool supplied in DataStax Enterprise and running the scrub command to rewrite all SStables for the table or the flush command to just flush to disk all new data, which is then encrypted.</p>

<h2>Encrypting Hadoop Data in DataStax Enterprise</h2>

<p>Because DataStax Enterprise swaps out HDFS for the Cassandra File System (CFS) and runs all Hadoop operations on top of Cassandra, it’s possible to use TDE to encrypt all Hadoop data in DataStax Enterprise.</p>

<p>The inode and sblocks tables used to store all metadata and operational data on nodes in DataStax Enterprise specified as Hadoop nodes can be encrypted in the exact manner as described above so that all Hadoop data is protected.</p>

<p>For Solr/enterprise search nodes in DataStax Enterprise, because Solr indexes do not make use of Cassandra tables to store their data, TDE cannot be used to fully cover Solr data as is done on Hadoop and Cassandra nodes. Solr data can be encrypted, however Solr indexes cannot.</p>

<h2>Current Limitations</h2>

<p>Limitations to the current implementation of TDE in DataStax Enterprise are:</p>

<ul>
	<li>The encryption keys are stored on the server and are not separated/pushed out to a different machine.</li>
	<li>Data in the Cassandra commit log is not encrypted.</li>
	<li>There is some minor overhead that comes from using encryption, the amount of which is dependent on a number of factors (table size, datatypes used, etc.)</li>
</ul>

<h2>Next Steps</h2>

<p>To try out TDE and all features of DataStax Enterprise, download a copy today. DataStax Enterprise is completely free to use in development environments with no restrictions, however production deployments do require that a subscription be purchased.</p>

<p>For more information on all of 3.0's security features, please see our&nbsp;<a href="https://docs.datastax.com">online documentation</a>&nbsp;and our “What’s New in DataStax 3.0?” white paper.</p>


Using Transparent Data Encryption in DataStax Enterprise

Robin Schumacher

Share

Share

What is Transparent Data Encryption?

How to use Transparent Data Encryption in DataStax Enterprise

Encrypting Hadoop Data in DataStax Enterprise

Current Limitations

Next Steps

More Technology

How Winweb Built its AI Assistant with DataStax Astra DB and LangChain

Vercel + Astra DB: Get Data into Your GenAI Apps Fast

Simplifying Agent Development with Astra DB Connector for Vertex AI Search

Making Astra DB easier for MongoDB developers

One-stop Data API for Production GenAI