<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="mysql-cluster-tde-implementation">
      </a>
      25.6.14.2 NDB File System Encryption Implementation
     </h4>
    </div>
   </div>
  </div>
  <p>
   For
   <code class="literal">
    NDB
   </code>
   Transparent Data Encryption (TDE),
        data nodes encrypt user data at rest, with security provided by
        a password (file system password), which is used to encrypt and
        decrypt a secrets file on each data node. The secrets file
        contains a Node Master Key (NMK), a key used later to encrypt
        the different file types used for persistence.
   <code class="literal">
    NDB
   </code>
   TDE encrypts user data files including
        LCP files, redo log files, tablespace files, and undo log files.
  </p>
  <p>
   You can use the
   <a class="link" href="mysql-cluster-programs-ndbxfrm.html" title="25.5.32 ndbxfrm — Compress, Decompress, Encrypt, and Decrypt Files Created by NDB Cluster">
    <span class="command">
     <strong>
      ndbxfrm
     </strong>
    </span>
   </a>
   utility to see
        whether a file is encrypted, as shown here:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa49272191"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">&gt; ndbxfrm <span class="token property">-i</span> ndb_5_fs/LCP/0/T2F0<span class="token punctuation">.</span>Data
File<span class="token attr-value"><span class="token punctuation">=</span>ndb_5_fs/LCP/0/T2F0.Data,</span> compression<span class="token attr-value"><span class="token punctuation">=</span>no,</span> encryption<span class="token attr-value"><span class="token punctuation">=</span>yes</span>
&gt; ndbxfrm <span class="token property">-i</span> ndb_6_fs/LCP/0/T2F0<span class="token punctuation">.</span>Data
File<span class="token attr-value"><span class="token punctuation">=</span>ndb_6_fs/LCP/0/T2F0.Data,</span> compression<span class="token attr-value"><span class="token punctuation">=</span>no,</span> encryption<span class="token attr-value"><span class="token punctuation">=</span>no</span></code></pre>
  </div>
  <p>
   It is possible to obtain the key from the secrets file using the
   <a class="link" href="mysql-cluster-programs-ndb-secretsfile-reader.html" title="25.5.24 ndb_secretsfile_reader — Obtain Key Information from an Encrypted NDB Data File">
    <span class="command">
     <strong>
      ndb_secretsfile_reader
     </strong>
    </span>
   </a>
   program, like this:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa34315366"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">&gt; ndb_secretsfile_reader <span class="token constant">--filesystem-password</span><span class="token attr-value"><span class="token punctuation">=</span>54kl14</span> ndb_5_fs/D1/NDBCNTR/S0<span class="token punctuation">.</span>sysfile
ndb_secretsfile_reader<span class="token punctuation">:</span> <span class="token punctuation">[</span>Warning<span class="token punctuation">]</span> Using a password on the command line interface can be insecure<span class="token punctuation">.</span>
cac256e18b2ddf6b5ef82d99a72f18e864b78453cc7fa40bfaf0c40b91122d18</code></pre>
  </div>
  <p>
   The per-node key hierarchy can be represented as follows:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      A user-supplied passphrase (P) is processed by a
            key-derivation function using a random salt to generate a
            unique passphase key (PK).
     </p>
    </li>
    <li class="listitem">
     <p>
      The PK (unique to each node) encrypts the data on each node
            in its own secrets file.
     </p>
    </li>
    <li class="listitem">
     <p>
      The data in the secrets file includes a unique, randomly
            generated Node Master Key (NMK).
     </p>
    </li>
    <li class="listitem">
     <p>
      The NMK encrypts (using wrapping) one or more randomly
            generated data encryption key (DEK) values in the header of
            each encrypted file (including LCP and TS files, and redo
            and undo logs).
     </p>
    </li>
    <li class="listitem">
     <p>
      Data encryption key values (DEK
      <sub>
       0
      </sub>
      ,
            ..., DEK
      <sub>
       n
      </sub>
      ) are used for encryption of
            [subsets of] data in each file.
     </p>
    </li>
   </ul>
  </div>
  <p>
   The passphrase indirectly encrypts the secrets file containing
        the random NMK, which encrypts a portion of the header of each
        encrypted file on the node. The encrypted file header contains
        random data keys used for the data in that file.
  </p>
  <p>
   Encryption is implemented transparently by the
   <a class="ulink" href="/doc/ndb-internals/en/ndb-internals-kernel-blocks-ndbfs.html" target="_top">
    <code class="literal">
     NDBFS
    </code>
   </a>
   layer within the data
        nodes.
   <code class="literal">
    NDBFS
   </code>
   internal client blocks operate
        on their files as normal;
   <code class="literal">
    NDBFS
   </code>
   wraps the
        physical file with extra header and footer information
        supporting encryption, and encrypts and decrypts data as it is
        read from and written to the file. The wrapped file format is
        referred to as
   <code class="literal">
    ndbxfrm1
   </code>
   .
  </p>
  <p>
   The node password is processed with PBKDF2 and the random salt
        to encrypt the secrets file, which contains the randomly
        generated NMK which is used to encrypt the randomly generated
        data encryption key in each encrypted file.
  </p>
  <p>
   The work of encryption and decryption is performed in the NDBFS
        I/O threads (rather than in signal execution threads such as
        main, tc, ldm, or rep). This is similar to what happens with
        compressed LCPs and compressed backups, and normally results in
        increased I/O thread CPU usage; you may wish to adjust
   <a class="link" href="mysql-cluster-ndbd-definition.html#ndbparam-ndbmtd-threadconfig">
    <code class="literal">
     ThreadConfig
    </code>
   </a>
   (if in
        use) with regard to the I/O threads.
  </p>
 </div>
 <br/>
</div>
