Data Encryption

Geode provides enterprise-grade encryption for protecting sensitive graph data both at rest and in transit. This comprehensive encryption implementation uses industry-standard algorithms and follows cryptographic best practices to ensure data confidentiality, integrity, and compliance with security regulations. <h3 id="encryption-architecture" class="position-relative d-flex align-items-center group"> Encryption Architecture <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encryption-architecture" aria-haspopup="dialog" aria-label="Share link: Encryption Architecture"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Geode implements a multi-layered encryption architecture: <ul> <li>Encryption at Rest: All data files encrypted with AES-256-GCM</li> <li>Encryption in Transit: TLS 1.3 for all network communications</li> <li>Key Management: Hierarchical key structure with master keys, data encryption keys, and key encryption keys</li> <li>Memory Protection: Sensitive data encrypted in memory when possible</li> <li>Audit Log Encryption: Optional encryption of audit logs</li> <li>Backup Encryption: Encrypted backups with independent keys</li> </ul> <h3 id="encryption-at-rest" class="position-relative d-flex align-items-center group"> Encryption at Rest <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encryption-at-rest" aria-haspopup="dialog" aria-label="Share link: Encryption at Rest"> Share link </button> </h3>All data stored by Geode is encrypted using AES-256 in Galois/Counter Mode (GCM), providing both confidentiality and authenticity. This includes: <ul> <li>Graph data (nodes and relationships)</li> <li>Property values</li> <li>Indexes</li> <li>Transaction logs</li> <li>Metadata</li> <li>System catalogs</li> </ul> <h4 id="enabling-encryption-at-rest" class="position-relative d-flex align-items-center group"> Enabling Encryption at Rest <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="enabling-encryption-at-rest" aria-haspopup="dialog" aria-label="Share link: Enabling Encryption at Rest"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable encryption at rest with default settings geode serve --encryption-at-rest=enabled \ --encryption-algorithm=aes-256-gcm # Use custom encryption key file geode serve --encryption-at-rest=enabled \ --encryption-key-file=/etc/geode/keys/master.key # Generate a new master key geode keygen --algorithm=aes-256 \ --output=/etc/geode/keys/master.key \ --protect-with-passphrase </code></pre></div> <h4 id="key-storage-options" class="position-relative d-flex align-items-center group"> Key Storage Options <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-storage-options" aria-haspopup="dialog" aria-label="Share link: Key Storage Options"> Share link </button> </h4>Geode supports multiple key storage backends: File-based (Development) <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Store keys in protected file geode serve --encryption-key-file=/etc/geode/keys/master.key \ --key-file-permissions=0400 </code></pre></div>Environment Variable (Container Deployments) <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Pass key via environment variable export GEODE_MASTER_KEY="base64-encoded-key-here" geode serve --encryption-key-source=env:GEODE_MASTER_KEY </code></pre></div>Hardware Security Module (Production) <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Use HSM for key storage geode serve --encryption-key-source=hsm \ --hsm-provider=pkcs11 \ --hsm-library=/usr/lib/softhsm/libsofthsm2.so \ --hsm-slot=0 \ --hsm-pin-file=/etc/geode/hsm-pin.txt </code></pre></div>Cloud Key Management Service <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># AWS KMS geode serve --encryption-key-source=aws-kms \ --kms-key-id=arn:aws:kms:us-east-1:123456789012:key/abc123 # Google Cloud KMS geode serve --encryption-key-source=gcp-kms \ --kms-key-name=projects/PROJECT/locations/LOCATION/keyRings/RING/cryptoKeys/KEY # Azure Key Vault geode serve --encryption-key-source=azure-keyvault \ --keyvault-name=mygeodekeys \ --keyvault-key-name=master-key </code></pre></div> <h4 id="key-hierarchy" class="position-relative d-flex align-items-center group"> Key Hierarchy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-hierarchy" aria-haspopup="dialog" aria-label="Share link: Key Hierarchy"> Share link </button> </h4>Geode uses a hierarchical key structure for security and performance: <ol> <li>Master Key (MK): Root of the key hierarchy, stored in HSM or KMS</li> <li>Key Encryption Keys (KEK): Encrypted by master key, used to encrypt data encryption keys</li> <li>Data Encryption Keys (DEK): Encrypted by KEK, used to encrypt actual data</li> </ol> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Master Key (HSM/KMS) | +-- Key Encryption Key 1 | | | +-- Data Encryption Key 1 (Graph Data) | +-- Data Encryption Key 2 (Indexes) | +-- Key Encryption Key 2 | +-- Data Encryption Key 3 (Transaction Logs) +-- Data Encryption Key 4 (Backups) </code></pre></div>This hierarchy provides: <ul> <li>Key Rotation: Rotate master key without re-encrypting all data</li> <li>Performance: Data encryption keys cached in memory</li> <li>Isolation: Different data types use different keys</li> <li>Recovery: Separate keys for backups and operational data</li> </ul> <h4 id="key-rotation" class="position-relative d-flex align-items-center group"> Key Rotation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-rotation" aria-haspopup="dialog" aria-label="Share link: Key Rotation"> Share link </button> </h4>Regular key rotation is essential for security: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Rotate master key (KEKs re-encrypted, DEKs unchanged) geode key-rotate --key-type=master \ --new-key-source=hsm \ --old-key-file=/etc/geode/keys/old-master.key # Rotate data encryption keys (data re-encrypted in background) geode key-rotate --key-type=data \ --background=true \ --throttle=50mbps # Check key rotation progress geode key-rotate --status # Output: 45% complete, 1.2 TB of 2.7 TB re-encrypted </code></pre></div>Configure automatic key rotation: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Rotate master key quarterly, data keys annually geode serve --key-rotation-schedule=master:90d,data:365d \ --key-rotation-window=02:00-06:00 </code></pre></div> <h3 id="encryption-in-transit" class="position-relative d-flex align-items-center group"> Encryption in Transit <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encryption-in-transit" aria-haspopup="dialog" aria-label="Share link: Encryption in Transit"> Share link </button> </h3>All network communications are encrypted using TLS 1.3 with strong cipher suites. Geode’s QUIC transport provides encryption by default. <h4 id="tls-configuration" class="position-relative d-flex align-items-center group"> TLS Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tls-configuration" aria-haspopup="dialog" aria-label="Share link: TLS Configuration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Basic TLS configuration geode serve --tls-cert=/etc/geode/certs/server.crt \ --tls-key=/etc/geode/certs/server.key \ --tls-ca=/etc/geode/certs/ca.crt # Enforce TLS 1.3 only geode serve --tls-min-version=1.3 \ --tls-max-version=1.3 # Specify allowed cipher suites geode serve --tls-cipher-suites=TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256 </code></pre></div> <h4 id="client-certificate-authentication" class="position-relative d-flex align-items-center group"> Client Certificate Authentication <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="client-certificate-authentication" aria-haspopup="dialog" aria-label="Share link: Client Certificate Authentication"> Share link </button> </h4>Require clients to present valid certificates: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable mutual TLS (mTLS) geode serve --require-client-certificates=true \ --client-ca=/etc/geode/certs/client-ca.crt \ --verify-client-certificates=true # Allow specific client certificates only geode serve --client-cert-allowlist=/etc/geode/allowed-clients.txt </code></pre></div> <h4 id="certificate-management" class="position-relative d-flex align-items-center group"> Certificate Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="certificate-management" aria-haspopup="dialog" aria-label="Share link: Certificate Management"> Share link </button> </h4>Generate and manage TLS certificates: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate self-signed certificate for development geode cert-gen --output-dir=/etc/geode/certs \ --common-name=geode.example.com \ --san=DNS:geode.example.com,DNS:localhost,IP:127.0.0.1 # Generate certificate signing request for production geode cert-gen --csr-only \ --output=/etc/geode/certs/geode.csr \ --common-name=geode.production.example.com # Certificate rotation geode cert-rotate --new-cert=/etc/geode/certs/new-cert.crt \ --new-key=/etc/geode/certs/new-key.key \ --graceful=true \ --overlap-duration=24h </code></pre></div> <h4 id="perfect-forward-secrecy" class="position-relative d-flex align-items-center group"> Perfect Forward Secrecy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="perfect-forward-secrecy" aria-haspopup="dialog" aria-label="Share link: Perfect Forward Secrecy"> Share link </button> </h4>Geode enforces perfect forward secrecy (PFS) to protect past communications: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># PFS is enabled by default with ECDHE key exchange geode serve --tls-require-pfs=true \ --tls-key-exchange=ecdhe-secp256r1 </code></pre></div> <h3 id="field-level-encryption" class="position-relative d-flex align-items-center group"> Field-Level Encryption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="field-level-encryption" aria-haspopup="dialog" aria-label="Share link: Field-Level Encryption"> Share link </button> </h3>Encrypt specific fields within the graph for additional security: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Encrypt sensitive fields before storing INSERT (:Person { name: 'Alice Smith', email: 'alice@example.com', ssn: encrypt('123-45-6789', 'ssn-encryption-key'), salary: encrypt('95000', 'salary-encryption-key') }); -- Decrypt on retrieval (requires permission) MATCH (p:Person {email: 'alice@example.com'}) RETURN p.name, decrypt(p.ssn, 'ssn-encryption-key') AS ssn; </code></pre></div> <h4 id="deterministic-vs-randomized-encryption" class="position-relative d-flex align-items-center group"> Deterministic vs Randomized Encryption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="deterministic-vs-randomized-encryption" aria-haspopup="dialog" aria-label="Share link: Deterministic vs Randomized Encryption"> Share link </button> </h4>Deterministic Encryption: Same plaintext always produces same ciphertext, allowing equality searches: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Store with deterministic encryption for searchability INSERT (:Account { account_number: encrypt_deterministic($account_num, 'account-key'), balance: encrypt_random($balance, 'balance-key') }); -- Can search deterministically encrypted fields MATCH (a:Account) WHERE a.account_number = encrypt_deterministic('1234567890', 'account-key') RETURN decrypt_random(a.balance, 'balance-key') AS balance; </code></pre></div>Randomized Encryption: Same plaintext produces different ciphertext each time, maximum security: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Maximum security, no searchability INSERT (:MedicalRecord { patient_id: $patient_id, diagnosis: encrypt_random($diagnosis, 'medical-key'), notes: encrypt_random($notes, 'medical-key') }); </code></pre></div> <h3 id="transparent-data-encryption" class="position-relative d-flex align-items-center group"> Transparent Data Encryption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="transparent-data-encryption" aria-haspopup="dialog" aria-label="Share link: Transparent Data Encryption"> Share link </button> </h3>Enable transparent data encryption (TDE) for automatic encryption of all data: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable TDE - all data automatically encrypted/decrypted geode serve --transparent-encryption=enabled \ --encryption-key-source=hsm \ --encryption-algorithm=aes-256-gcm # Applications don't need to change - encryption is transparent # All data encrypted at storage layer automatically </code></pre></div>With TDE enabled: <ul> <li>No application code changes required</li> <li>All queries work normally</li> <li>Encryption/decryption handled automatically</li> <li>Performance impact: typically 5-10% for read/write operations</li> </ul> <h3 id="backup-encryption" class="position-relative d-flex align-items-center group"> Backup Encryption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="backup-encryption" aria-haspopup="dialog" aria-label="Share link: Backup Encryption"> Share link </button> </h3>Backups are encrypted separately from operational data: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Create encrypted backup geode backup create --encryption=enabled \ --encryption-key-source=file:/etc/geode/keys/backup.key \ --output=/backups/geode-2026-01-24.backup # Create backup with separate encryption key geode backup create --encryption=enabled \ --encryption-key-source=aws-kms \ --kms-key-id=arn:aws:kms:us-east-1:123456789012:key/backup-key \ --output=s3://my-backups/geode-backup.enc # Restore from encrypted backup geode backup restore --input=/backups/geode-2026-01-24.backup \ --encryption-key-source=file:/etc/geode/keys/backup.key </code></pre></div> <h3 id="audit-log-encryption" class="position-relative d-flex align-items-center group"> Audit Log Encryption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="audit-log-encryption" aria-haspopup="dialog" aria-label="Share link: Audit Log Encryption"> Share link </button> </h3>Protect audit logs from unauthorized access: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Encrypt audit logs geode serve --audit-log-encryption=enabled \ --audit-log-encryption-key=/etc/geode/keys/audit.key \ --audit-log-signing=true # Decrypt audit logs for analysis geode audit-log decrypt --input=/var/log/geode/audit.log.enc \ --key=/etc/geode/keys/audit.key \ --output=/tmp/audit.log </code></pre></div> <h3 id="encryption-performance" class="position-relative d-flex align-items-center group"> Encryption Performance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encryption-performance" aria-haspopup="dialog" aria-label="Share link: Encryption Performance"> Share link </button> </h3>Encryption has minimal performance impact due to hardware acceleration: <h4 id="hardware-acceleration" class="position-relative d-flex align-items-center group"> Hardware Acceleration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hardware-acceleration" aria-haspopup="dialog" aria-label="Share link: Hardware Acceleration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check for AES-NI support (Intel/AMD) geode check-crypto-accel # Output: # AES-NI: Available # AVX2: Available # SHA Extensions: Available # Estimated encryption overhead: 3-5% # Use hardware acceleration geode serve --use-crypto-acceleration=true \ --prefer-aes-ni=true </code></pre></div> <h4 id="performance-optimization" class="position-relative d-flex align-items-center group"> Performance Optimization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance-optimization" aria-haspopup="dialog" aria-label="Share link: Performance Optimization"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Tune encryption performance geode serve --encryption-cache-size=1GB \ --encryption-parallel-threads=4 \ --encryption-batch-size=4MB </code></pre></div>Typical performance impact: <ul> <li>Encryption at rest: 3-7% throughput reduction</li> <li>Encryption in transit: 1-3% throughput reduction with TLS 1.3</li> <li>Field-level encryption: 10-15% for encrypted fields only</li> <li>Transparent encryption: 5-10% overall system throughput</li> </ul> <h3 id="compliance-and-standards" class="position-relative d-flex align-items-center group"> Compliance and Standards <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-and-standards" aria-haspopup="dialog" aria-label="Share link: Compliance and Standards"> Share link </button> </h3>Geode’s encryption meets requirements for: <ul> <li>FIPS 140-2: Use FIPS-validated cryptographic modules</li> <li>PCI DSS: Strong cryptography for payment data</li> <li>HIPAA: Encryption of electronic protected health information</li> <li>GDPR: State-of-the-art encryption for personal data</li> </ul> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable FIPS mode for compliance geode serve --fips-mode=enabled \ --crypto-library=fips-validated \ --enforce-fips-algorithms=true </code></pre></div> <h3 id="key-management-best-practices" class="position-relative d-flex align-items-center group"> Key Management Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-management-best-practices" aria-haspopup="dialog" aria-label="Share link: Key Management Best Practices"> Share link </button> </h3><ol> <li>Never Store Keys in Code: Use environment variables, HSM, or KMS</li> <li>Rotate Keys Regularly: Master keys quarterly, data keys annually</li> <li>Separate Key Responsibilities: Different keys for different purposes</li> <li>Backup Keys Securely: Store backup keys separately from backups</li> <li>Monitor Key Access: Log all key access and rotation events</li> <li>Use HSM for Production: Hardware security modules for master keys</li> <li>Test Recovery: Regularly test key recovery procedures</li> <li>Document Procedures: Maintain clear documentation for key management</li> <li>Principle of Least Privilege: Limit key access to necessary personnel only</li> <li>Key Destruction: Securely destroy old keys after rotation</li> </ol> <h3 id="troubleshooting" class="position-relative d-flex align-items-center group"> Troubleshooting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting" aria-haspopup="dialog" aria-label="Share link: Troubleshooting"> Share link </button> </h3> <h4 id="decryption-failures" class="position-relative d-flex align-items-center group"> Decryption Failures <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="decryption-failures" aria-haspopup="dialog" aria-label="Share link: Decryption Failures"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check encryption status geode encryption-status # Verify key availability geode key-verify --key-source=hsm # Test decryption geode test-decrypt --key-source=file:/etc/geode/keys/master.key </code></pre></div> <h4 id="performance-issues" class="position-relative d-flex align-items-center group"> Performance Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance-issues" aria-haspopup="dialog" aria-label="Share link: Performance Issues"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check if hardware acceleration is working geode check-crypto-accel --verbose # Profile encryption overhead geode profile --component=encryption \ --duration=60s \ --output=encryption-profile.json </code></pre></div> <h4 id="key-rotation-issues" class="position-relative d-flex align-items-center group"> Key Rotation Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-rotation-issues" aria-haspopup="dialog" aria-label="Share link: Key Rotation Issues"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check rotation status geode key-rotate --status --verbose # Resume interrupted rotation geode key-rotate --resume \ --rotation-id=rot_abc123 # Roll back failed rotation geode key-rotate --rollback \ --rotation-id=rot_abc123 </code></pre></div> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/compliance/" >Compliance</a> - Regulatory compliance requirements</li> <li><a href="/tags/audit-logging/" >Audit Logging</a> - Comprehensive security audit trails</li> <li><a href="/tags/row-level-security/" >Row-Level Security</a> - Fine-grained access control</li> <li><a href="/tags/configuration/" >Configuration</a> - Security configuration best practices</li> <li><a href="/tags/connections/" >Connections</a> - Secure connection management</li> <li><a href="/docs/security/overview/" >Security Overview</a> - Security documentation</li> <li><a href="/docs/security/field-level-encryption/" >Field-Level Encryption</a> - Fine-grained encryption</li> <li><a href="/docs/security/kms-integration/" >KMS Integration</a> - Key management service integration</li> </ul>

Popular

Related Articles

Security and Compliance Guide

Security

Password Hashing with Argon2id