๋ฌธ์„œ ๋ฉ”๋‰ด
๋ฌธ์„œ ํ™ˆ
/
MongoDB ๋งค๋‰ด์–ผ
/ / / / /

GCP์—์„œ ์ž๋™ Queryable Encryption ์‚ฌ์šฉ

์ด ํŽ˜์ด์ง€์˜ ๋‚ด์šฉ

  • ๊ฐœ์š”
  • ์‹œ์ž‘ํ•˜๊ธฐ ์ „์—
  • KMS ์„ค์ •
  • GCP ์„œ๋น„์Šค ๊ณ„์ • ๋“ฑ๋ก
  • GCP ๊ณ ๊ฐ ๋งˆ์Šคํ„ฐ ํ‚ค ๋งŒ๋“ค๊ธฐ
  • ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ์ƒ์„ฑ
  • ํ‚ค ๋ณผํŠธ collection์— ๊ณ ์œ  ์ธ๋ฑ์Šค ๋งŒ๋“ค๊ธฐ
  • ๋ฐ์ดํ„ฐ ์•”ํ˜ธํ™” ํ‚ค ๋ฐ ์•”ํ˜ธํ™”๋œ collection ๋งŒ๋“ค๊ธฐ
  • ์•”ํ˜ธํ™”๋œ ์ฝ๊ธฐ ๋ฐ ์“ฐ๊ธฐ๋ฅผ ์œ„ํ•œ MongoClient ๊ตฌ์„ฑ
  • ์•”ํ˜ธํ™”๋œ ํ•„๋“œ๊ฐ€ ์žˆ๋Š” ๋ฌธ์„œ ์‚ฝ์ž…ํ•˜๊ธฐ
  • ์•”ํ˜ธํ™”๋œ ๋ฌธ์„œ ์กฐํšŒ
  • ์ž์„ธํžˆ ์•Œ์•„๋ณด๊ธฐ

์ด ๊ฐ€์ด๋“œ์—์„œ๋Š” Google Cloud ํ‚ค ๊ด€๋ฆฌ ์„œ๋น„์Šค๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ Queryable Encryption ์ง€์› ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์„ ๋นŒ๋“œํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ์„ค๋ช…ํ•ฉ๋‹ˆ๋‹ค.

์ด ๊ฐ€์ด๋“œ์˜ ๋‹จ๊ณ„๋ฅผ ์™„๋ฃŒํ•˜๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์€ ๋‚ด์šฉ์ด ํ‘œ์‹œ๋ฉ๋‹ˆ๋‹ค:

  • GCP ํ‚ค ๊ด€๋ฆฌ ์„œ๋น„์Šค์—์„œ ํ˜ธ์ŠคํŒ…๋˜๋Š” ๊ณ ๊ฐ ๋งˆ์Šคํ„ฐ ํ‚ค ์ž…๋‹ˆ๋‹ค.

  • CMK ๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์•”ํ˜ธํ™”๋œ ๋ฌธ์„œ๋ฅผ ์‚ฝ์ž…ํ•˜๋Š” ํด๋ผ์ด์–ธํŠธ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ž…๋‹ˆ๋‹ค.

์ด ๊ฐ€์ด๋“œ์˜ ์ฝ”๋“œ๋ฅผ ์™„๋ฃŒํ•˜๊ณ  ์‹คํ–‰ํ•˜๋ ค๋ฉด ์„ค์น˜ ์š”๊ตฌ ์‚ฌํ•ญ ํŽ˜์ด์ง€์— ํ‘œ์‹œ๋œ ๋Œ€๋กœ ๊ฐœ๋ฐœ ํ™˜๊ฒฝ์„ ์„ค์ •ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

ํŒ

์ฐธ์กฐ: ์ „์ฒด ์ ์šฉ

์ด ๊ฐ€์ด๋“œ์—์„œ ๋งŒ๋“  ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์˜ ์ „์ฒด ์ฝ”๋“œ๋ฅผ ๋ณด๋ ค๋ฉด ํ”„๋กœ๊ทธ๋ž˜๋ฐ ์–ธ์–ด์— ํ•ด๋‹นํ•˜๋Š” ํƒญ์„ ์„ ํƒํ•˜๊ณ  ์ œ๊ณต๋œ ๋งํฌ๋ฅผ ๋”ฐ๋ผ๊ฐ€์„ธ์š”.

1
1
2

GCP์—์„œ ์„œ๋น„์Šค ๊ณ„์ •์„ ๋งŒ๋“ค๋ ค๋ฉด ์„œ๋น„์Šค ๊ณ„์ • ๋งŒ๋“ค๊ธฐ ๋ฅผ ๋”ฐ๋ฅด์„ธ์š”. ๊ฐ€์ด๋“œ๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

3

GCP์— ์„œ๋น„์Šค ๊ณ„์ • ํ‚ค๋ฅผ ์ถ”๊ฐ€ํ•˜๋ ค๋ฉด ์„œ๋น„์Šค ๊ณ„์ • ํ‚ค ๊ด€๋ฆฌ ํ•˜๊ธฐ๋ฅผ ๋”ฐ๋ฅด์„ธ์š”. ๊ฐ€์ด๋“œ๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

์ค‘์š”

์„œ๋น„์Šค ๊ณ„์ • ํ‚ค๋ฅผ ์ƒ์„ฑํ•  ๋•Œ ๋น„๊ณต๊ฐœ ํ‚ค ์ •๋ณด๋ฅผ ์ผํšŒ์„ฑ ๋‹ค์šด๋กœ๋“œ๋กœ ๋ฐ›๊ฒŒ ๋ฉ๋‹ˆ๋‹ค. ์ด ํŠœํ† ๋ฆฌ์–ผ์˜ ๋’ท๋ถ€๋ถ„์—์„œ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋„๋ก ์ด ํŒŒ์ผ์„ PKCS12 ๋˜๋Š” JSON ํ˜•์‹์œผ๋กœ ๋‹ค์šด๋กœ๋“œํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

2
1

ํ‚ค ์ƒ์„ฑ ๋‹จ๊ณ„์— ๋”ฐ๋ผ ํ‚ค๋ง๊ณผ ๋Œ€์นญ ํ‚ค๋ฅผ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค. ๊ฐ€์ด๋“œ๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

์ด ํ‚ค๋Š” ๊ณ ๊ฐ ๋งˆ์Šคํ„ฐ ํ‚ค(CMK)์ž…๋‹ˆ๋‹ค.

์ด ํŠœํ† ๋ฆฌ์–ผ์˜ ์ดํ›„ ๋‹จ๊ณ„์—์„œ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ณ ๊ฐ ๋งˆ์Šคํ„ฐ ํ‚ค ์— ๋Œ€ํ•œ ๋‹ค์Œ ์„ธ๋ถ€ ์ •๋ณด๋ฅผ ๊ธฐ๋กํ•ฉ๋‹ˆ๋‹ค.

ํ•„๋“œ
ํ•„์ˆ˜ ์‚ฌํ•ญ
์„ค๋ช…
key_name
์˜ˆ
๊ณ ๊ฐ ๋งˆ์Šคํ„ฐ ํ‚ค ์˜ ์‹๋ณ„์ž์ž…๋‹ˆ๋‹ค.
key_ring
์˜ˆ
ํ‚ค๊ฐ€ ์†ํ•œ ํ‚ค ๊ทธ๋ฃน์˜ ์‹๋ณ„์ž์ž…๋‹ˆ๋‹ค.
key_version
์•„๋‹ˆ
๋ช…๋ช…๋œ ํ‚ค์˜ ๋ฒ„์ „์ž…๋‹ˆ๋‹ค.
์œ„์น˜
์˜ˆ
ํ‚ค์— ๋Œ€ํ•ด ์ง€์ •๋œ ์ง€์—ญ์ž…๋‹ˆ๋‹ค.
์—”๋“œํฌ์ธํŠธ
์•„๋‹ˆ
Google Cloud KMS์˜ ํ˜ธ์ŠคํŠธ ๋ฐ ์„ ํƒ์  ํฌํŠธ์ž…๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’์€ cloudkms.googleapis.com ์ž…๋‹ˆ๋‹ค.

์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์—์„œ ์‚ฌ์šฉ ์ค‘์ธ MongoDB ๋“œ๋ผ์ด๋ฒ„์— ํ•ด๋‹นํ•˜๋Š” ํƒญ์„ ์„ ํƒํ•˜๋ฉด ๊ด€๋ จ ์ฝ”๋“œ ์ƒ˜ํ”Œ์„ ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

1

collection์˜ ํ•„๋“œ์— ๊ณ ์œ  ์ธ๋ฑ์Šค๋ฅผ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค.keyAltNames encryption.__keyVault

์„ ํ˜ธํ•˜๋Š” MongoDB ๋“œ๋ผ์ด๋ฒ„์— ํ•ด๋‹นํ•˜๋Š” ํƒญ์„ ์„ ํƒํ•ฉ๋‹ˆ๋‹ค:

2
1

Queryable Encryption์ด ํ™œ์„ฑํ™”๋œ ํด๋ผ์ด์–ธํŠธ ์ฝ”๋“œ์— ์„œ๋น„์Šค ๊ณ„์ • ์ž๊ฒฉ ์ฆ๋ช…์„ ์ถ”๊ฐ€ํ•ฉ๋‹ˆ๋‹ค.

์„ ํ˜ธํ•˜๋Š” MongoDB ๋“œ๋ผ์ด๋ฒ„์— ํ•ด๋‹นํ•˜๋Š” ํƒญ์„ ์„ ํƒํ•ฉ๋‹ˆ๋‹ค:

ํŒ

์ด ๊ฐ€์ด๋“œ ์˜ GCP ์„œ๋น„์Šค ๊ณ„์ • ๋งŒ๋“ค๊ธฐ ๋‹จ๊ณ„์—์„œ ์„œ๋น„์Šค ๊ณ„์ • ํ‚ค ์ž๊ฒฉ ์ฆ๋ช…์ด ํฌํ•จ๋œ ํŒŒ์ผ์„ ์ €์žฅํ–ˆ์Šต๋‹ˆ๋‹ค.

์ž๊ฒฉ ์ฆ๋ช…์„ JSON ํ˜•์‹์œผ๋กœ ๋‹ค์šด๋กœ๋“œํ•œ ๊ฒฝ์šฐ ๋‹ค์Œ ๋ช…๋ น์„ ์‚ฌ์šฉํ•˜์—ฌ <credentials-filename> ์„ ์ž๊ฒฉ ์ฆ๋ช… ํŒŒ์ผ ์ด๋ฆ„์œผ๋กœ ๋Œ€์ฒดํ•˜์—ฌ ๋น„๊ณต๊ฐœ ํ‚ค ๊ฐ’์„ ์ถ”์ถœํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

cat <credentials-filename> | jq -r .private_key | openssl pkcs8 -topk8 -nocrypt -inform PEM -outform DER | base64

์ž๊ฒฉ ์ฆ๋ช…์„ PKCS12 ํ˜•์‹์œผ๋กœ ๋‹ค์šด๋กœ๋“œํ•œ ๊ฒฝ์šฐ, GCP ์„œ๋น„์Šค ๊ณ„์ • ๊ฐ€์ ธ์˜ค๊ธฐ ์•”ํ˜ธ๋ฅผ ์ง€์ •ํ•˜๊ณ  PEM ์•”ํ˜ธ ๊ตฌ๋ฌธ์„ ์ถ”๊ฐ€ํ•˜์—ฌ ๋‹ค์Œ ๋ช…๋ น์„ ์‚ฌ์šฉํ•˜์—ฌ ํ‚ค์— ์•ก์„ธ์Šคํ•  ๋•Œ ํ‚ค์— ์•ก์„ธ์Šคํ•ด์•ผ ํ•˜๋ฉฐ, ์ด๋•Œ <credentials-filename> ์„ ์ž๊ฒฉ ์ฆ๋ช… ํŒŒ์ผ์˜ ์ด๋ฆ„์œผ๋กœ ๋Œ€์ฒดํ•ฉ๋‹ˆ๋‹ค.

openssl pkcs12 -info -in <credentials-filename>

ํŒ

์ž์„ธํžˆ ์•Œ์•„๋ณด๊ธฐ

GCP์šฉ KMS ์ œ๊ณต์ž ๊ฐ์ฒด์— ๋Œ€ํ•ด ์ž์„ธํžˆ ์•Œ์•„๋ณด๋ ค๋ฉด Google Cloud Platform KMS๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

2

๊ณ ๊ฐ ๋งˆ์Šคํ„ฐ ํ‚ค๋ฅผ ์ง€์ •ํ•˜๋ ค๋ฉด ๋‹ค์Œ ์ฝ”๋“œ๋ฅผ ์—…๋ฐ์ดํŠธํ•˜์„ธ์š”.

ํŒ

์ด ๊ฐ€์ด๋“œ ์˜ ๊ณ ๊ฐ ๋งˆ์Šคํ„ฐ ํ‚ค ์ƒ์„ฑ ๋‹จ๊ณ„์—์„œ ๊ณ ๊ฐ ๋งˆ์Šคํ„ฐ ํ‚ค ์„ธ๋ถ€ ์ •๋ณด๋ฅผ ๊ธฐ๋กํ–ˆ์Šต๋‹ˆ๋‹ค.

3

MongoDB ์—ฐ๊ฒฐ ๋ฌธ์ž์—ด๊ณผ ํ‚ค ๋ณผํŠธ ์ปฌ๋ ‰์…˜ ๋„ค์ž„์ŠคํŽ˜์ด์Šค๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ํด๋ผ์ด์–ธํŠธ๋ฅผ ๊ตฌ์„ฑํ•˜๊ณ  ๋ฐ์ดํ„ฐ ์•”ํ˜ธํ™” ํ‚ค๋ฅผ ๋งŒ๋“ญ๋‹ˆ๋‹ค.

์ฐธ๊ณ 

ํ‚ค ๋ณผํŠธ ์ปฌ๋ ‰์…˜ ๋„ค์ž„์ŠคํŽ˜์ด์Šค ๊ถŒํ•œ

์ด ๊ฐ€์ด๋“œ์˜ ํ‚ค ๋ณผํŠธ ์ปฌ๋ ‰์…˜์€ encryption ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์˜ __keyVault ์ปฌ๋ ‰์…˜์ž…๋‹ˆ๋‹ค. ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์—์„œ MongoDB์— ์—ฐ๊ฒฐํ•˜๋Š” ๋ฐ ์‚ฌ์šฉํ•˜๋Š” ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์‚ฌ์šฉ์ž์—๊ฒŒ encryption.__keyVault ๋„ค์ž„์ŠคํŽ˜์ด์Šค์— ๋Œ€ํ•œ ReadWrite ๊ถŒํ•œ์ด ์žˆ๋Š”์ง€ ํ™•์ธํ•ฉ๋‹ˆ๋‹ค.

4

Queryable Encryption์ด ํ™œ์„ฑํ™”๋œ MongoClient ์ธ์Šคํ„ด์Šค๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ํ•„๋“œ๋ฅผ ์•”ํ˜ธํ™”ํ•˜๊ณ  collection์„ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค.

์ด ์„น์…˜์˜ ์ฝ”๋“œ ์ถœ๋ ฅ์€ ๋‹ค์Œ๊ณผ ์œ ์‚ฌํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

Created encrypted collection!

ํŒ

์ž์„ธํžˆ ์•Œ์•„๋ณด๊ธฐ

GCP KMS๋ฅผ ์‚ฌ์šฉํ•  ๋•Œ ํด๋ผ์ด์–ธํŠธ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ๋ฐ์ดํ„ฐ ์•”ํ˜ธํ™” ํ‚ค๋ฅผ ์ƒ์„ฑํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ๋ณด์—ฌ์ฃผ๋Š” ๋‹ค์ด์–ด๊ทธ๋žจ์„ ๋ณด๋ ค๋ฉด ์•„ํ‚คํ…์ฒ˜๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

Azure Key Vault์—์„œ ํ˜ธ์ŠคํŒ…๋˜๋Š” ๊ณ ๊ฐ ๋งˆ์Šคํ„ฐ ํ‚ค๋กœ ์•”ํ˜ธํ™”๋œ ๋ฐ์ดํ„ฐ ์•”ํ˜ธํ™” ํ‚ค๋ฅผ ์ƒ์„ฑํ•˜๋Š” ์˜ต์…˜์— ๋Œ€ํ•ด ์ž์„ธํžˆ ์•Œ์•„๋ณด๋ ค๋ฉด kmsProviders ๊ฐ์ฒด ๋ฐ dataKeyOpts ๊ฐ์ฒด๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

ํŒ

์ฐธ์กฐ: ์ฝ”๋“œ ์™„์„ฑ

3
1

ํ‚ค ๋ณผํŠธ collection ๋„ค์ž„์ŠคํŽ˜์ด์Šค๋กœ encryption.__keyVault ์„ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค.

2

ํด๋ผ์šฐ๋“œ ๊ณต๊ธ‰์ž์™€ ์„œ๋น„์Šค ๊ณ„์ • ์ž๊ฒฉ ์ฆ๋ช…์„ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค.

3
4

์ฐธ๊ณ 

์ž๋™ ์•”ํ˜ธํ™” ์˜ต์…˜

์ž๋™ ์•”ํ˜ธํ™” ์˜ต์…˜์€ ์ž๋™ ์•”ํ˜ธํ™” ๊ณต์œ  ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ์— ๊ตฌ์„ฑ ์ •๋ณด๋ฅผ ์ œ๊ณตํ•˜์—ฌ ์•”ํ˜ธํ™”๋œ ํ•„๋“œ์— ์•ก์„ธ์Šคํ•  ๋•Œ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์˜ ๋™์ž‘์„ ์ˆ˜์ •ํ•ฉ๋‹ˆ๋‹ค.

์ž๋™ ์•”ํ˜ธํ™” ๊ณต์œ  ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ์— ๋Œ€ํ•œ ์ž์„ธํ•œ ๋‚ด์šฉ์€ Queryable Encryption์„ ์œ„ํ•œ ์ž๋™ ์•”ํ˜ธํ™” ๊ณต์œ  ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ ํŽ˜์ด์ง€์—์„œ ํ™•์ธํ•˜์„ธ์š”.

5

๋‹ค์Œ ์ž๋™ ์•”ํ˜ธํ™” ์„ค์ •์„ ์‚ฌ์šฉํ•˜์—ฌ MongoDB ํด๋ผ์ด์–ธํŠธ ๊ฐ์ฒด๋ฅผ ์ธ์Šคํ„ด์Šคํ™”ํ•ฉ๋‹ˆ๋‹ค.

4

Queryable Encryption์ด ํ™œ์„ฑํ™”๋œ MongoClient ์ธ์Šคํ„ด์Šค๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ๋‹ค์Œ ์ฝ”๋“œ ์Šค๋‹ˆํŽซ์„ ์‚ฌ์šฉํ•˜์—ฌ ์•”ํ˜ธํ™”๋œ ๋ฌธ์„œ๋ฅผ medicalRecords.patients ๋„ค์ž„์ŠคํŽ˜์ด์Šค์— ์‚ฝ์ž…ํ•ฉ๋‹ˆ๋‹ค.

๋ฌธ์„œ๋ฅผ ์‚ฝ์ž…ํ•˜๋ฉด Queryable Encryption์ด ํ™œ์„ฑํ™”๋œ ํด๋ผ์ด์–ธํŠธ๊ฐ€ ๋‹ค์Œ๊ณผ ๊ฐ™์ด ๋ฌธ์„œ์˜ ํ•„๋“œ๋ฅผ ์•”ํ˜ธํ™”ํ•ฉ๋‹ˆ๋‹ค.

{
"_id": { "$oid": "<_id value>" },
"firstName": "Jon",
"lastName": "Doe",
"patientId": {
"$binary": {
"base64": "<ciphertext>",
"subType": "06"
}
},
"address": "157 Electric Ave.",
"patientRecord": {
"ssn": {
"$binary": {
"base64": "<ciphertext>",
"subType": "06"
}
},
"billing": {
"$binary": {
"base64": "<ciphertext>",
"subType": "06"
}
}
},
"medications": {
"$binary": {
"base64": "<ciphertext>",
"subType": "06"
}
},
"__safeContent__": [
{
"$binary": {
"base64": "<ciphertext>",
"subType": "00"
}
},
{
"$binary": {
"base64": "<ciphertext>",
"subType": "00"
}
}
]
}

๊ฒฝ๊ณ 

__safeContent__ ํ•„๋“œ๋ฅผ ์ˆ˜์ •ํ•˜์ง€ ๋งˆ์„ธ์š”.

__safeContent__ ํ•„๋“œ๋Š” Queryable Encryption์— ๋ฐ˜๋“œ์‹œ ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค. ์ด ํ•„๋“œ์˜ ๋‚ด์šฉ์€ ์ˆ˜์ •ํ•˜์ง€ ๋งˆ์„ธ์š”.

ํŒ

์ฐธ์กฐ: ์ฝ”๋“œ ์™„์„ฑ

5

์ด ๊ฐ€์ด๋“œ์˜ ์•”ํ˜ธํ™”๋œ ํ•„๋“œ๊ฐ€ ์žˆ๋Š” ๋ฌธ์„œ ์‚ฝ์ž… ๋‹จ๊ณ„์—์„œ ์‚ฝ์ž…ํ•œ ์•”ํ˜ธํ™”๋œ ๋ฌธ์„œ๋ฅผ ๊ฒ€์ƒ‰ํ•ฉ๋‹ˆ๋‹ค.

Queryable Encryption์˜ ๊ธฐ๋Šฅ์„ ๋ณด์—ฌ์ฃผ๊ธฐ ์œ„ํ•ด ๋‹ค์Œ ์ฝ”๋“œ ์Šค๋‹ˆํŽซ์€ ์ž๋™ Queryable Encryption์œผ๋กœ ๊ตฌ์„ฑ๋œ ํด๋ผ์ด์–ธํŠธ์™€ ์ž๋™ Queryable Encryption์ด ๊ตฌ์„ฑ๋˜์ง€ ์•Š์€ ํด๋ผ์ด์–ธํŠธ๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ๋ฌธ์„œ๋ฅผ ์ฟผ๋ฆฌํ•ฉ๋‹ˆ๋‹ค.

์ด์ „ ์ฝ”๋“œ ์Šค๋‹ˆํŽซ์˜ ์ถœ๋ ฅ์€ ๋‹ค์Œ๊ณผ ๊ฐ™์•„์•ผ ํ•ฉ๋‹ˆ๋‹ค.

Finding a document with regular (non-encrypted) client.
{
_id: new ObjectId("628eabeb37590e84ea742665"),
firstName: 'Jon',
lastName: 'Doe',
patientId: new Binary(Buffer.from("0798810acc0f4f46c9a76883cee80fca12102e9ddcbcdae46a821fa108a8155a850f2d0919475b6531ada68973d436a199b537a05a98a708c36d2bfec4979d59cbe66878865ce19e392d3e4789d309bdacc336e32efcc851806ae0a41b355288c10d01e39147e1c40d919c41913a0c9d2d3fad0d0d1d2873c4fc82c6c22f27b517df5f3131b331b96ed16a7c5cf89e09082a2d898c2dcd73da91d08760ba74a70077b2d0fdbbe1eea75655a19fcc397812325ad40b102cbd16b8d36b22e11e3f93404f24a8ff68cfdec3c22b0e787cb30078a5227b2a", "hex"), 6),
address: '157 Electric Ave.',
patientRecord: {
ssn: new Binary(Buffer.from("07e8b69630c32f4a00a542af768f8abcf50223edd812ff20b0ecb046ee1a9f5a0eef8d85d99cd26076411129942752516ee605c55aadce73f3d44d81ea6ddbbb8134b108a9deb40d8cab9cb4f08ef210ab0c9d2ea4347f9d235b861baf29751e60abcf059eb5c120305bd5ac05a4e07ac8ccfa6d37283f4cdbfeb7a8accb65b71857d486b5cf55e354d6a95e287d9e2dd65f3f9d9c4c9d0bdb1f26c4bd549d7be77db81796be293e08b2223bac67b212423c4e06568578b5bd7a3c33cedc1b291bcda0b27e005144d344563711a489f24b8e9b65bbb721d3a0e9d9b227a0cec0cbad", "hex"), 6),
billing: new Binary(Buffer.from("06808ae69d4caa49cf90bb688f386f097f03f870a7b8fcebb1980c9ee5488b1f0f68558fc2163adcd92d00ea5f349f56ed34e7b391f54c48ed2760b4bde73022fc818dc7486a4e046b92ce9c82e00333c7779d9d6bb476713a20632b593b7de54812662cfc4d174d05451d3f4195514e12edba", "hex"), 6)
},
medications: new Binary(Buffer.from("06665ec15d38254dc4aa16da856789d33404f27bfea53e0d2fa4deaff166989ab33f469644d89c29112d33b41dbe54ec2d89c43f3de52cdc5d454e8694046216f533614fa7b42b7c5406d6518f7ed8f9e3ce52fda6c8b2146d0f8cc51e21a3467183697e1735a9f60c18e173c1916101", "hex"), 6),
__safeContent__: [
new Binary(Buffer.from("3044b134ad0f7c8a90dab1e05bb8b296a8ede540796bd7403ab47693cdba1b26", "hex"), 0),
new Binary(Buffer.from("a22ddf9a5657cdd56bef72febbba44371899e6486962a1c07d682082c4e65712", "hex"), 0)
]
}
Finding a document with encrypted client, searching on an encrypted field
{
_id: new ObjectId("628eaca1dcf9b63e2f43162d"),
firstName: 'Jon',
lastName: 'Doe',
patientId: 12345678,
address: '157 Electric Ave.',
patientRecord: {
ssn: '987-65-4320',
billing: { type: 'Visa', number: '4111111111111111' }
},
medications: [ 'Atorvastatin', 'Levothyroxine' ],
__safeContent__: [
new Binary(Buffer.from("fbdc6cfe3b4659693650bfc60baced27dcb42b793efe09da0ded54d60a9d5a1f", "hex"), 0),
new Binary(Buffer.from("0f92ff92bf904a858ef6fd5b1e508187f523e791f51d8b64596461b38ebb1791", "hex"), 0)
]
}

ํŒ

์ฐธ์กฐ: ์ฝ”๋“œ ์™„์„ฑ

์ด ๊ฐ€์ด๋“œ์— ์–ธ๊ธ‰๋œ ์ฃผ์ œ์— ๋Œ€ํ•ด ์ž์„ธํžˆ ์•Œ์•„๋ณด๋ ค๋ฉด ๋‹ค์Œ ๋งํฌ๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”:

  • ์ฐธ์กฐ ํŽ˜์ด์ง€์—์„œ Queryable Encryption ๊ตฌ์„ฑ ์š”์†Œ์— ๋Œ€ํ•ด ์ž์„ธํžˆ ์•Œ์•„๋ณด์„ธ์š”.

  • ํ‚ค ๋ฐ ํ‚ค ๋ณผํŠธ ํŽ˜์ด์ง€์—์„œ ๊ณ ๊ฐ ๋งˆ์Šคํ„ฐ ํ‚ค์™€ ๋ฐ์ดํ„ฐ ์•”ํ˜ธํ™” ํ‚ค๊ฐ€ ์–ด๋–ป๊ฒŒ ์ž‘๋™ํ•˜๋Š”์ง€ ์•Œ์•„๋ณด์„ธ์š”.

  • KMS ์ œ๊ณต์ž๊ฐ€ Queryable Encryption ํ‚ค๋ฅผ ๊ด€๋ฆฌํ•˜๋Š” ๋ฐฉ๋ฒ•์€ KMS ์ œ๊ณต์ž ํŽ˜์ด์ง€์—์„œ ํ™•์ธํ•˜์„ธ์š”.

โ†ย Azure์—์„œ ์ž๋™ Queryable Encryption ์‚ฌ์šฉ