Configure Encryption

項目一覧

Overview
Key Manager
Local Key Management
Encrypt Existing Data at Rest

Overview

This page discusses server configuration to support encryption at rest. If you use MongoDB Atlas, your data is already encrypted. MongoDB manages Atlas encryption at the cloud provider level, but you can also use your own key management solution. See the Atlas key management documentation for details.

MongoDB Enterprise 3.2 introduces a native encryption option for the WiredTiger storage engine. Outside Atlas, encryption is only available for enterprise installations that use the WiredTiger Storage Engine.

Secure management of the encryption keys is a critical requirement for storage encryption. MongoDB uses a master key that is not stored with the MongoDB installation. Only the master key is externally managed, other keys can be stored with your MongoDB instance.

MongoDB's encrypted storage engine supports two key management options for the master key:

KMIP（Key Management Interoperability Protocol）を介してサードパーティのキーマネジメント機器と統合します。推奨
Use of local key management via a keyfile.

重要

MongoDB cannot encrypt existing data. When you enable encryption with a new key, the MongoDB instance cannot have any pre-existing data. If your MongoDB installation already has existing data, see Encrypt Existing Data at Rest for additional steps.

Key Manager

MongoDB Enterprise supports secure transfer of keys with compatible key management appliances. Using a key manager allows for the keys to be stored in the key manager.

MongoDB Enterprise supports secure transfer of keys with Key Management Interoperability Protocol (KMIP) compliant key management appliances.

MongoDB の認定パートナーの一覧については、パートナーリストを参照してください。

Tip

推奨

Using a key manager meets regulatory key management guidelines, such as HIPAA, PCI-DSS, and FERPA, and is recommended over the local key management.

前提条件

Your key manager must support the KMIP communication protocol.
デフォルトの KMIP プロトコルバージョンは 1.2 です。MongoDB サーバーの構成ファイルで、KMIP バージョン 1.0 または 1.1 を使用するように MongoDB を構成できます。
KMIP を使用してサードパーティのマネジメント機器を統合する場合、次の KMIP 操作を許可する必要があります。
- 作成（operation_create）
- 取得（operation_get）
- アクティブ化（operation_activate）
To authenticate MongoDB to a KMIP server, you must have a valid certificate issued by the key management appliance.

注意

Windows 上の MongoDB Enterprise では、保管時の暗号化のブロック暗号として AES256-GCM をサポートしなくなりました。この使用は、Linux でのみサポートされています。

Encrypt Using a New Key

To create a new key when you connect to the key manager, use the following options to start mongod:

To connect to a version 1.0 or 1.1 KMIP server, use the --kmipUseLegacyProtocol option.

構成に必要な追加オプションを含めます。たとえば、リモートクライアントを配置に接続する場合、または配置ノードを異なるホスト上で実行する場合は、 --bind_ipを指定します。

重要

Enabling encryption using a KMIP server on Windows fails when using --kmipClientCertificateFile and the KMIP server enforces TLS 1.2.

Windows で KMIP を使用して保管時の暗号化を有効にするには、次の条件を満たす必要があります。

クライアント証明書を Windows 証明書ストアにインポートします。
Use the --kmipClientCertificateSelector option.

The following operation creates a new master key in your key manager. mongod uses the master key to encrypt the keys that mongod generates for each database.

mongod --enableEncryption \
       --kmipServerName <KMIP Server HostName> \
       --kmipPort <KMIP server port> \
       --kmipServerCAFile ca.pem \
       --kmipClientCertificateFile client.pem

mongodでは、起動時に KMIP サーバーへの接続を検証します。

--kmipServerName に指定するサーバー名は、KMIP サーバーで提示する証明書のサブジェクト代替名 SAN またはコモンネーム CN のいずれかと一致する必要があります。SAN はシステム名または IP アドレスにすることができます。

SAN が存在する場合、mongod は CN との一致は試行しません。

KMIP サーバーのホスト名や IP アドレスが SAN とも CN とも一致しない場合、mongod は起動しません。

To verify that the key creation and usage was successful, check the log file. If successful, the process will log the following messages:

[initandlisten] Created KMIP key with id: <UID>
[initandlisten] Encryption key manager initialized using master key with id: <UID>

以下も参照してください。

暗号化のキー管理のオプション

Encrypt Using an Existing Key

You can use an existing master key that your KMIP server already manages. To use an existing key, use these options when you start mongod to connect mongod to the key manager:

To connect to a version 1.0 or 1.1 KMIP server, use the --kmipUseLegacyProtocol option.

mongod --enableEncryption \
       --kmipServerName <KMIP Server HostName> \
       --kmipPort <KMIP server port> \
       --kmipServerCAFile ca.pem \
       --kmipClientCertificateFile client.pem \
       --kmipKeyIdentifier <UID>

mongodでは、起動時に KMIP サーバーへの接続を検証します。

SAN が存在する場合、mongod は CN との一致は試行しません。

KMIP サーバーのホスト名や IP アドレスが SAN とも CN とも一致しない場合、mongod は起動しません。

以下も参照してください。

暗号化のキー管理のオプション

Local Key Management

重要

Using the keyfile method does not meet most regulatory key management guidelines and requires users to securely manage their own keys.

The safe management of the keyfile is critical.

To encrypt using a keyfile, you must have a base64 encoded keyfile that contains a single 16 or 32 character string. The keyfile must only be accessible by the owner of the mongod process.

Create the base64 encoded keyfile with the 16 or 32 character string. You can generate the encoded keyfile using any method you prefer. For example,
```
openssl rand -base64 32 > mongodb-keyfile
```
Update the file permissions.
```
chmod 600 mongodb-keyfile
```
To use the key file, start mongod with the following options:
- --enableEncryption,
- --encryptionKeyFile <path to keyfile>,
```
mongod --enableEncryption --encryptionKeyFile  mongodb-keyfile
```
構成に必要な追加オプションを含めます。たとえば、リモートクライアントを配置に接続する場合、または配置ノードを異なるホスト上で実行する場合は、 --bind_ipを指定します。
Verify if the encryption key manager successfully initialized with the keyfile. If the operation was successful, the process will log the following message:
```
[initandlisten] Encryption key manager initialized with key file: <path to keyfile>
```

以下も参照してください。

暗号化のキー管理のオプション

Encrypt Existing Data at Rest

MongoDB cannot encrypt existing data. When you enable encryption with a new key, the MongoDB instance cannot have any pre-existing data.

If you are using a replica set that does have existing data, use a rolling 最初の同期 to encrypt the data.

For example, consider a replica set with three members. The replica set is in use and holds data that you want to encrypt. These are the steps you would take to encrypt the data at rest:

Prepare a server.

Follow these steps to prepare the server:

Pick one of the secondary servers.
停止 mongod on the secondary server.
Optional: Backup the data in dbPath. If a full backup is not required, consider backing up just the diagnostic.data directory to preserve potentially-useful troubleshooting data in the event of an issue. See Full Time Diagnostic Data Capture for more information.
Remove the files and directories in the dbPath.

Enable encryption.

Start the secondary server with encryption enabled. The mongod instance creates a new keystore.

Synchronize the data.

Import the data from the primary. Start the mongod process, specifying レプリケーションのオプション as appropriate.

mongod performs an initial sync and encrypts the data during the sync up process.

Repeat the process on the secondaries.

When the first secondary has finished importing and encrypting the data, repeat the process on the other secondary mongod instances.

Encrypt the primary.

When the all the secondaries have been encrypted, step down the primary. Eligible secondaries will elect a new primary.

The old primary is now a secondary. Repeat the steps to remove the unencrypted data and then run an 最初の同期.

戻る

保管時の暗号化

キーのローテーション