MongoDB World 2019: New Encryption Capabilities in MongoDB 4.2: A Deep Dive into Protecting Sensitive Workloads
0 likes253 views
Many applications with high-sensitivity workloads require enhanced technical options to control and limit access to confidential and regulated data. In some cases, system requirements or compliance obligations dictate a separation of duties for staff operating the database and those who maintain the application layer. In cloud-hosted environments, certain data are sometimes deemed too sensitive to store on third-party infrastructure. This is a common pain for system architects in the healthcare, finance, and consumer tech sectors — the benefits of managed, easily expanded compute and storage have been considered unavailable because of data confidentiality and privacy concerns. This session will take a deep dive into new security capabilities in MongoDB 4.2 that address these scenarios, by enabling native client-side field-level encryption, using customer-managed keys. We will review how confidential data can be securely stored and easily accessed by applications running on MongoDB. Common query design patterns will be presented, with example code demonstrating strong end-to-end encryption in Atlas or on-premise. Implications for developers and others designing systems in regulated environments will be discussed, followed by a Q&A with senior MongoDB security engineers.
!["test.patients" : {
"bsonType" : "object",
"properties" : {
"medRecNum" : { "bsonType" : "int" },
"firstName" : { "bsonType" : "string" },
"lastName" : { "bsonType" : "string" },
"ssn" : {
"encrypt" : {
"bsonType" : "string",
"algorithm" : encryption_mode,
"keyId" : [ key1 ]
}
},
"mobile" : { "bsonType" : "string" },
"email" : { "bsonType" : "string" },
}}](https://image.slidesharecdn.com/suttonnday2300pm-kennwhiteencryption-190701172346/85/MongoDB-World-2019-New-Encryption-Capabilities-in-MongoDB-4-2-A-Deep-Dive-into-Protecting-Sensitive-Workloads-68-320.jpg)
!["test.patients" : {
"bsonType" : "object",
"properties" : {
"medRecNum" : { "bsonType" : "int" },
"firstName" : { "bsonType" : "string" },
"lastName" : { "bsonType" : "string" },
"ssn" : {
"encrypt" : {
"bsonType" : "string",
"algorithm" : encryption_mode,
"keyId" : [ key1 ]
}
},
"mobile" : { "bsonType" : "string" },
"email" : { "bsonType" : "string" },
}}](https://image.slidesharecdn.com/suttonnday2300pm-kennwhiteencryption-190701172346/85/MongoDB-World-2019-New-Encryption-Capabilities-in-MongoDB-4-2-A-Deep-Dive-into-Protecting-Sensitive-Workloads-69-320.jpg)
!["test.patients" : {
"bsonType" : "object",
"properties" : {
"medRecNum" : { "bsonType" : "int" },
"firstName" : { "bsonType" : "string" },
"lastName" : { "bsonType" : "string" },
"ssn" : {
"encrypt" : {
"bsonType" : "string",
"algorithm" : encryption_mode,
"keyId" : [ key1 ]
}
},
"mobile" : { "bsonType" : "string" },
"email" : { "bsonType" : "string" },
}}](https://image.slidesharecdn.com/suttonnday2300pm-kennwhiteencryption-190701172346/85/MongoDB-World-2019-New-Encryption-Capabilities-in-MongoDB-4-2-A-Deep-Dive-into-Protecting-Sensitive-Workloads-70-320.jpg)
![var encryptedDb = encryptedSession.getDB("test");
encryptedSession.getKeyStore().createKey(
"aws", env.KMSARN, ["key1"]
)
var keys = encryptedSession.getKeyStore().getKeys()
var key1 = keys.getKeyByAltName("key1”)](https://image.slidesharecdn.com/suttonnday2300pm-kennwhiteencryption-190701172346/85/MongoDB-World-2019-New-Encryption-Capabilities-in-MongoDB-4-2-A-Deep-Dive-into-Protecting-Sensitive-Workloads-73-320.jpg)
More Related Content
What's hot (20)
Similar to MongoDB World 2019: New Encryption Capabilities in MongoDB 4.2: A Deep Dive into Protecting Sensitive Workloads (20)
More from MongoDB (20)
![MongoDB .local San Francisco 2020: Powering the new age data demands [Infosys]](https://cdn.slidesharecdn.com/ss_thumbnails/315pminfosysfinalsfoversionvocalpart1-200120221508-thumbnail.jpg?width=560&fit=bounds)
Recently uploaded (20)
MongoDB World 2019: New Encryption Capabilities in MongoDB 4.2: A Deep Dive into Protecting Sensitive Workloads
- 1. Kenneth White MongoDB Product Security New encryption capabilities in MongoDB 4.2: A deep dive into protecting sensitive workloads @mongodb
- 2. New encryption capabilities in MongoDB 4.2: A deep dive into protecting sensitive workloads
- 3. New encryption capabilities in MongoDB 4.2: A deep dive into protecting sensitive workloads Agenda
- 4. New encryption capabilities in MongoDB 4.2: A deep dive into protecting sensitive workloads Agenda § A brief history of database security § Trust models: server vs. client § Encrypting data-in-use § Hands on deep dive § Q&A
- 5. A brief history of database security
- 6. A brief history of database security Evolution
- 7. A brief history of database security Evolution § access controls
- 8. A brief history of database security Evolution § access controls § passwords § plaintext > hashing > key derivation § bearer tokens § NTLM, Kerberos tickets, LDAP/S, SCRAM, web session § multi-factor auth § LCD fobs / SMS / 2FA apps / FIDO-U2F / WebAuthn / mobile enclaves § federated RBAC
- 9. A brief history of database security Evolution § network
- 10. A brief history of database security Evolution § network § (plaintext) native wire protocols § SSL encryption § TLS § TLS w/ PFS
- 11. A brief history of database security Evolution § storage
- 12. A brief history of database security Evolution § storage § plaintext / raw filesystem § encrypted
- 13. A brief history of database security Evolution § storage § volume-level / full disk encryption (FDE) § BitLocker, DMCrypt, FileVault, encrypted EBS § file-level encryption § whole database § per-database (WiredTiger ESE) § tablespace § database-level encryption § column / field
- 14. A brief history of database security These are all important defenses, but…
- 15. A brief history of database security What is the threat?
- 16. A brief history of database security Against whom/what are we defending?
- 17. A brief history of database security Against whom/what are we defending? § “hackers”?
- 18. A brief history of database security Against whom/what are we defending? § “hackers”? § criminal blackhats? § competitors? § activists? § unknown actors?
- 19. A brief history of database security Against whom/what are we defending? § “hackers”? § criminal blackhats? § competitors? § activists? § unknown actors? § insiders?
- 20. A brief history of database security Against whom/what are we defending? § “hackers”? § criminal blackhats? § competitors? § activists? § unknown actors? § insiders? § admins?
- 21. A brief history of database security Against whom/what are we defending?
- 22. A brief history of database security What is the threat?
- 23. A brief history of database security What is the threat?
- 24. A brief history of database security What is the threat?
- 25. The security model for many Prod databases Source: Imgur (author unknown)
- 26. The security model for many Prod databases Source: Imgur (author unknown)
- 27. A brief history of database security
- 28. A brief history of database security Let’s talk about breaches.
- 29. A brief history of database security Every sector of the global economy has been impacted.
- 30. A brief history of database security Every sector of the global economy has been impacted § enterprise § consumer tech § retail § government § healthcare § finance …
- 31. A brief history of database security Major shifts in regulatory & privacy climate
- 32. A brief history of database security Major shifts in regulatory & privacy climate § GDPR § HIPAA § PCI DSS § NIST/FISMA § Consumer protection § State & provincial
- 33. A brief history of database security System architect & developer security challenges
- 34. A brief history of database security System architect & developer security challenges Meeting legal/regulatory obligations § Controls § Audit/attestation
- 35. A brief history of database security System architect & developer security challenges Meeting legal/regulatory obligations § Controls § Audit/attestation Defending real-world attacks § First Principles: C/I/A § Separation of duties § Access control § Identifying & protecting sensitive data
- 36. A brief history of database security System architect & developer security challenges Meeting legal/regulatory obligations § Controls § Audit/attestation Defending real-world attacks § First Principles: C/I/A § Separation of duties § Access control § Identifying & protecting sensitive data
- 37. A brief history of database security System architects & develop security challenges Meeting legal/regulatory obligations § Controls § Audit/attestation Defending real-world attacks § First Principles: C/I/A § Separation of duties § Access control § Identifying & protecting sensitive data
- 38. Trust models: server vs. client
- 39. Trust models: server vs. client What is the source of trust?
- 40. Trust models: server vs. client What is the source of trust? § Traditionally, DB encryption has relied on server-side trust
- 41. Trust models: server vs. client What is the source of trust? § Traditionally, DB encryption has relied on server-side trust § This has implications, many not so obvious
- 42. Trust models: server vs. client What is the source of trust? § Traditionally, DB encryption has relied on server-side trust § This has implications, many not so obvious § With a few caveats, the database operator typically has unrestricted technical access, including: § DBAs § system admins § hosting/infrastructure providers
- 43. Trust models: server vs. client What is the source of trust? § In a server-side encryption model, a leak or breach can be catastrophic
- 44. Trust models: server vs. client What is the source of trust? § In a server-side encryption model, a leak or breach can be catastrophic § This potentially includes: logs, backups, temp files, process memory…
- 45. Trust models: server vs. client What is the source of trust? § In a server-side encryption model, a leak or breach can be catastrophic § This potentially includes: logs, backups, temp files, process memory… § They who hold the keys control the kingdom
- 46. Trust models: server vs. client This is particularly important in a cloud context, especially so when running highly sensitive workloads.
- 47. Trust models: server vs. client A common pain for system architects
- 48. Trust models: server vs. client A common pain for system architects • Most notably in healthcare, finance, and consumer tech • The benefits of managed, easily expanded compute & cloud storage have often been considered out of reach because of data confidentiality & privacy concerns.
- 49. Trust models: server vs. client The fundamental challenge is protecting the confidentiality of data while it’s in use.
- 50. Trust models: server vs. client The fundamental challenge is protecting the confidentiality of data while it’s in use.
- 51. Trust models: server vs. client The fundamental challenge is protecting the confidentiality of data while it’s in use.
- 53. Encrypting Data-in-Use Introducing MongoDB Client-Side Field-Level Encryption
- 54. Encrypting Data-in-Use Introducing MongoDB Client-Side Field-Level Encryption § encryption as a first-class citizen § modern, authenticated encryption algorithms § strong security guarantees § customer-managed keys § content is opaque to server & server operator
- 55. Encrypting Data-in-Use Introducing MongoDB Client-Side Field-Level Encryption § major investment § 2 years in the making § 16+ engineers spanning core server, query, security, drivers, cloud § targeting 12+ languages § all major hardware & operating system platforms § Linux, MacOS, Windows
- 56. MongoDB Client-Side Field-Level Encryption
- 57. MongoDB Client-Side Field-Level Encryption Core design
- 58. MongoDB Client-Side Field-Level Encryption Core design § Enabled in drivers § Drivers have expanded MQL awareness § Extends existing JSON Schema with new “encrypt” property § Adds JSON Schema validation to the client § Individual fields within collections can be marked as encrypted § Keys can be used on a per-field, per-document basis
- 59. MongoDB Client-Side Field-Level Encryption Cryptography
- 60. MongoDB Client-Side Field-Level Encryption Cryptography § multiple encryption options, including deterministic search § key services are natively integrated § modern authenticated encryption with AES-256 & SHA-2 § AEAD_AES_CBC_HMAC_SHA512 (2015 IETF draft: McGrew, Foley, Paterson) § abuse-resistant derived deterministic IVs § native system crypto libraries used for core operations
- 61. MongoDB Client-Side Field-Level Encryption Cryptography § raw key material never persisted to disk (in-memory only) § stored field keys protected by symmetric encryption § field wrapping keys secured in HSM-backed external KMS § key service master key rotation: scheduled or on-demand
- 62. MongoDB Client-Side Field-Level Encryption Developer view
- 63. MongoDB Client-Side Field-Level Encryption Developer view § new JSON Schema attribute “encrypt” § schema validation extended to the client/application § key management services integrated into drivers § driver generates secure request for field keys § all encryption/decryption is done in the driver (on the client) § server only sees encrypted binary data (BinData subtype-6)
- 64. MongoDB Client-Side Field-Level Encryption How does it work?
- 67. MongoDB Client-Side Field-Level Encryption Let’s look at some code
- 68. "test.patients" : { "bsonType" : "object", "properties" : { "medRecNum" : { "bsonType" : "int" }, "firstName" : { "bsonType" : "string" }, "lastName" : { "bsonType" : "string" }, "ssn" : { "encrypt" : { "bsonType" : "string", "algorithm" : encryption_mode, "keyId" : [ key1 ] } }, "mobile" : { "bsonType" : "string" }, "email" : { "bsonType" : "string" }, }}
- 69. "test.patients" : { "bsonType" : "object", "properties" : { "medRecNum" : { "bsonType" : "int" }, "firstName" : { "bsonType" : "string" }, "lastName" : { "bsonType" : "string" }, "ssn" : { "encrypt" : { "bsonType" : "string", "algorithm" : encryption_mode, "keyId" : [ key1 ] } }, "mobile" : { "bsonType" : "string" }, "email" : { "bsonType" : "string" }, }}
- 70. "test.patients" : { "bsonType" : "object", "properties" : { "medRecNum" : { "bsonType" : "int" }, "firstName" : { "bsonType" : "string" }, "lastName" : { "bsonType" : "string" }, "ssn" : { "encrypt" : { "bsonType" : "string", "algorithm" : encryption_mode, "keyId" : [ key1 ] } }, "mobile" : { "bsonType" : "string" }, "email" : { "bsonType" : "string" }, }}
- 71. var keystore = db.getCollection("__keystore") var clientSideFLEOptions = { "kmsProviders" : { "aws" : { "accessKeyId" : env.KMSKID , "secretAccessKey" : env.KMSKEY } }, "schemas" : { patientSchema } , "keyVaultCollection" : keystore } encryptedSession = new Mongo("localhost",clientSideFLEOptions)
- 72. var keystore = db.getCollection("__keystore") var clientSideFLEOptions = { "kmsProviders" : { "aws" : { "accessKeyId" : env.KMSKID , "secretAccessKey" : env.KMSKEY } }, "schemas" : { patientSchema } , "keyVaultCollection" : keystore } encryptedSession = new Mongo("localhost",clientSideFLEOptions)
- 73. var encryptedDb = encryptedSession.getDB("test"); encryptedSession.getKeyStore().createKey( "aws", env.KMSARN, ["key1"] ) var keys = encryptedSession.getKeyStore().getKeys() var key1 = keys.getKeyByAltName("key1”)
- 74. View to a client holding a valid key:
- 75. encryptedDb.patients.find( { "ssn": "901-01-0001" } ) View to a client holding a valid key:
- 76. { "firstName" : "Pat", "lastName" : "Lee", "medRecNum" : 235498, "ssn" : "901-01-0001", "mobile" : "212-555-1234", "email" : "[email protected]" } View to a client holding a valid key:
- 77. { "firstName" : "Pat", "lastName" : "Lee", "medRecNum" : 235498, "ssn" : BinData(6,"ASV2YBzOhUZZu643i7Y..."), "mobile" : "212-555-1234", "email" : "[email protected]" } View to a client lacking a valid key:
- 78. { "firstName" : "Pat", "lastName" : "Lee", "medRecNum" : 235498, "ssn" : BinData(6,"ASV2YBzOhUZZu643i7Y..."), "mobile" : "212-555-1234", "email" : "[email protected]" } View to legacy clients:
- 79. { "firstName" : "Pat", "lastName" : "Lee", "medRecNum" : 235498, "ssn" : BinData(6,"ASV2YBzOhUZZu643i7Y..."), "mobile" : "212-555-1234", "email" : "[email protected]" } View to database administrator:
- 80. { "firstName" : "Pat", "lastName" : "Lee", "medRecNum" : 235498, "ssn" : BinData(6,"ASV2YBzOhUZZu643i7Y..."), "mobile" : "212-555-1234", "email" : "[email protected]" } View to database, server memory, logs, backups:
- 81. MongoDB Client-Side Field-Level Encryption
- 82. MongoDB Client-Side Field-Level Encryption Roadmap
- 83. MongoDB Client-Side Field-Level Encryption Roadmap § Beta preview 4.2 rc1 in next two weeks – Java & shell first § Additional language beta previews in coming weeks § Server support in Atlas via rc0 preview § GA planned for late summer § Targeting all supported drivers on all supported platforms § 3rd party expert security audits & code reviews in progress
- 84. MongoDB Client-Side Field-Level Encryption Recap
- 85. MongoDB Client-Side Field-Level Encryption Recap § 4.2 introduces client-side field-level encryption § Designed for the most sensitive workloads § Enabled in drivers § Allows fields to be marked as encrypted, at the document-level § Multiple enforcement options (server-client, client-side, or both) § Backwards compatible with existing admin & cluster tools
- 86. MongoDB Client-Side Field-Level Encryption Q&A