Tag: Transparent Data Encryption (TDE)

Documentation tagged with Transparent Data Encryption (TDE) in the Geode graph database. TDE provides encryption-at-rest for database files, protecting data stored on disk from unauthorized access while remaining transparent to applications and queries. <h3 id="introduction-to-transparent-data-encryption" class="position-relative d-flex align-items-center group"> Introduction to Transparent Data Encryption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="introduction-to-transparent-data-encryption" aria-haspopup="dialog" aria-label="Share link: Introduction to Transparent Data Encryption"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Transparent Data Encryption (TDE) is an enterprise security feature that encrypts database files on disk, ensuring that data remains protected even if storage media is stolen, improperly disposed of, or accessed by unauthorized users. The “transparent” aspect means encryption and decryption happen automatically—applications and users don’t need to modify queries or code. TDE addresses a critical security requirement: protecting data at rest. While network encryption (TLS) protects data in transit and authentication prevents unauthorized access, TDE ensures that raw database files, backups, and snapshots cannot be read without the encryption keys. This is essential for: <ul> <li>Compliance: Regulations like GDPR, HIPAA, PCI-DSS, and SOC 2 require encryption at rest</li> <li>Data breach protection: Stolen drives or backups are useless without keys</li> <li>Multi-tenant security: Prevent cloud providers or storage administrators from accessing data</li> <li>Secure decommissioning: Safely dispose of old hardware without data recovery risks</li> </ul> Geode’s TDE implementation uses industry-standard AES-256 encryption with hardware acceleration (AES-NI) for minimal performance overhead, typically less than 5% impact on throughput. <h3 id="core-tde-concepts" class="position-relative d-flex align-items-center group"> Core TDE Concepts <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="core-tde-concepts" aria-haspopup="dialog" aria-label="Share link: Core TDE Concepts"> Share link </button> </h3> <h4 id="encryption-at-rest-vs-in-transit" class="position-relative d-flex align-items-center group"> Encryption at Rest vs. In Transit <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encryption-at-rest-vs-in-transit" aria-haspopup="dialog" aria-label="Share link: Encryption at Rest vs. In Transit"> Share link </button> </h4>Geode provides multiple encryption layers: <ul> <li>TDE (Encryption at Rest): Protects data stored on disk</li> <li>TLS (Encryption in Transit): Protects data transmitted over networks</li> <li>FLE (Field-Level Encryption): Protects specific sensitive fields</li> </ul> Together, these provide defense-in-depth security. <h4 id="two-tier-key-architecture" class="position-relative d-flex align-items-center group"> Two-Tier Key Architecture <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="two-tier-key-architecture" aria-haspopup="dialog" aria-label="Share link: Two-Tier Key Architecture"> Share link </button> </h4>Geode uses a two-tier key hierarchy for security and operational flexibility: Master Encryption Key (MEK): <ul> <li>Stored in external Key Management Service (KMS) or Hardware Security Module (HSM)</li> <li>Never stored on disk with encrypted data</li> <li>Rotated infrequently (annually or when compromised)</li> <li>Examples: AWS KMS, Azure Key Vault, HashiCorp Vault, PKCS#11 HSM</li> </ul> Data Encryption Keys (DEK): <ul> <li>Generated per database/tablespace/file</li> <li>Encrypted with MEK and stored alongside encrypted data</li> <li>Rotated periodically for defense-in-depth</li> <li>Actual key used for encrypting data blocks</li> </ul> This architecture enables key rotation without re-encrypting the entire database—just re-encrypt the DEKs with the new MEK. <h4 id="encryption-scope" class="position-relative d-flex align-items-center group"> Encryption Scope <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encryption-scope" aria-haspopup="dialog" aria-label="Share link: Encryption Scope"> Share link </button> </h4>TDE encrypts: <ul> <li>Data files: Node storage, relationship storage, property storage</li> <li>Index files: All index structures (B-trees, HNSW graphs, etc.)</li> <li>WAL (Write-Ahead Log): Transaction log files</li> <li>Temporary files: Sort buffers, intermediate query results</li> <li>Backups: Backup archives and snapshots</li> </ul> TDE does NOT encrypt: <ul> <li>Configuration files: Database configuration (not sensitive data)</li> <li>Logs: Application logs (use separate log encryption if needed)</li> <li>In-memory data: Data in RAM (use encrypted memory for extreme security)</li> <li>Query text: GQL queries themselves (use TLS for query privacy)</li> </ul> <h4 id="encryption-algorithms" class="position-relative d-flex align-items-center group"> Encryption Algorithms <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encryption-algorithms" aria-haspopup="dialog" aria-label="Share link: Encryption Algorithms"> Share link </button> </h4>Geode supports industry-standard algorithms: <ul> <li>AES-256-GCM: Recommended default (authenticated encryption, parallelizable)</li> <li>AES-256-CBC: Alternative for compatibility (requires separate HMAC for authentication)</li> <li>ChaCha20-Poly1305: Software-friendly alternative for systems without AES-NI</li> </ul> All algorithms use 256-bit keys meeting FIPS 140-2 requirements. <h3 id="how-tde-works-in-geode" class="position-relative d-flex align-items-center group"> How TDE Works in Geode <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="how-tde-works-in-geode" aria-haspopup="dialog" aria-label="Share link: How TDE Works in Geode"> Share link </button> </h3> <h4 id="enabling-tde" class="position-relative d-flex align-items-center group"> Enabling TDE <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="enabling-tde" aria-haspopup="dialog" aria-label="Share link: Enabling TDE"> Share link </button> </h4>Enable TDE when creating a new database: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate or retrieve master encryption key from KMS $ geode init --enable-tde \ --kms-provider aws-kms \ --kms-key-id arn:aws:kms:us-east-1:123456789:key/abc-def-123 \ --encryption-algorithm aes-256-gcm </code></pre></div>For existing databases, enable TDE through encryption conversion: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable TDE on existing database (requires downtime) $ geode convert-to-tde \ --data-dir /var/lib/geode/data \ --kms-provider vault \ --kms-endpoint https://vault.example.com \ --kms-token $VAULT_TOKEN </code></pre></div> <h4 id="configuration" class="position-relative d-flex align-items-center group"> Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="configuration" aria-haspopup="dialog" aria-label="Share link: Configuration"> Share link </button> </h4>Configure TDE in <code>geode.yaml</code>: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">security: encryption: enabled: true algorithm: aes-256-gcm # Key Management Service configuration kms: provider: aws-kms # aws-kms, azure-kv, gcp-kms, vault, pkcs11 key_id: arn:aws:kms:us-east-1:123456789:key/abc-def-123 region: us-east-1 # DEK rotation policy dek_rotation: enabled: true interval_days: 90 # Performance tuning cache_deks: true # Cache decrypted DEKs in memory cache_size_mb: 128 # DEK cache size </code></pre></div> <h4 id="key-management-integration" class="position-relative d-flex align-items-center group"> Key Management Integration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-management-integration" aria-haspopup="dialog" aria-label="Share link: Key Management Integration"> Share link </button> </h4>Geode integrates with enterprise key management systems: AWS KMS: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">kms: provider: aws-kms key_id: arn:aws:kms:us-east-1:123456789:key/abc-def-123 region: us-east-1 credentials_profile: geode-production </code></pre></div>Azure Key Vault: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">kms: provider: azure-kv vault_url: https://my-keyvault.vault.azure.net key_name: geode-master-key tenant_id: 12345-abcd-... client_id: 67890-efgh-... </code></pre></div>HashiCorp Vault: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">kms: provider: vault endpoint: https://vault.example.com transit_mount: transit key_name: geode-mek token: $VAULT_TOKEN # Or use AppRole, K8s auth </code></pre></div>PKCS#11 HSM: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">kms: provider: pkcs11 library_path: /usr/lib/softhsm/libsofthsm2.so slot_id: 0 pin: $HSM_PIN key_label: geode-master-key </code></pre></div> <h4 id="runtime-operations" class="position-relative d-flex align-items-center group"> Runtime Operations <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="runtime-operations" aria-haspopup="dialog" aria-label="Share link: Runtime Operations"> Share link </button> </h4>TDE operates transparently: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Queries work exactly the same with TDE enabled MATCH (p:Person {id: $userId}) SET p.last_login = datetime(); -- Application code doesn't change INSERT (:Document { id: 'doc-123', title: 'Sensitive Data', content: 'This will be encrypted on disk automatically' }); </code></pre></div>Encryption and decryption happen automatically in the storage layer. <h3 id="use-cases" class="position-relative d-flex align-items-center group"> Use Cases <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="use-cases" aria-haspopup="dialog" aria-label="Share link: Use Cases"> Share link </button> </h3> <h4 id="regulatory-compliance" class="position-relative d-flex align-items-center group"> Regulatory Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="regulatory-compliance" aria-haspopup="dialog" aria-label="Share link: Regulatory Compliance"> Share link </button> </h4>Meet encryption requirements for regulated industries: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># HIPAA-compliant TDE configuration security: encryption: enabled: true algorithm: aes-256-gcm fips_mode: true # Use FIPS 140-2 validated crypto kms: provider: aws-kms key_id: $HIPAA_COMPLIANT_KMS_KEY audit: log_key_access: true log_encryption_events: true </code></pre></div> <h4 id="multi-tenant-saas" class="position-relative d-flex align-items-center group"> Multi-Tenant SaaS <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="multi-tenant-saas" aria-haspopup="dialog" aria-label="Share link: Multi-Tenant SaaS"> Share link </button> </h4>Isolate tenant data with per-tenant encryption: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">security: encryption: enabled: true per_tenant_keys: true # Each tenant gets unique DEK kms: provider: vault endpoint: https://vault.example.com </code></pre></div>Query with tenant context: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Tenant ID determines which DEK to use for decryption SET SESSION tenant_id = 'tenant-abc-123'; MATCH (d:Document) RETURN d.content; </code></pre></div> <h4 id="secure-cloud-deployments" class="position-relative d-flex align-items-center group"> Secure Cloud Deployments <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="secure-cloud-deployments" aria-haspopup="dialog" aria-label="Share link: Secure Cloud Deployments"> Share link </button> </h4>Protect data from cloud provider access: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Deploy to cloud with customer-managed keys $ geode deploy \ --cloud aws \ --enable-tde \ --kms-provider aws-kms \ --customer-managed-key arn:aws:kms:us-east-1:MY_ACCOUNT:key/MY_KEY </code></pre></div>Even cloud administrators cannot decrypt your data without your KMS key. <h4 id="data-lifecycle-management" class="position-relative d-flex align-items-center group"> Data Lifecycle Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="data-lifecycle-management" aria-haspopup="dialog" aria-label="Share link: Data Lifecycle Management"> Share link </button> </h4>Securely retire old data: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Crypto-shredding: Destroy encryption key to make data unrecoverable $ geode retire-data \ --tablespace archived_2023 \ --method crypto-shred # Delete DEK, data becomes permanently unreadable </code></pre></div>Faster and more secure than deleting millions of records. <h3 id="best-practices" class="position-relative d-flex align-items-center group"> Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="best-practices" aria-haspopup="dialog" aria-label="Share link: Best Practices"> Share link </button> </h3> <h4 id="key-management" class="position-relative d-flex align-items-center group"> Key Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-management" aria-haspopup="dialog" aria-label="Share link: Key Management"> Share link </button> </h4><ol> <li> Use external KMS: Never store MEK with encrypted data <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># Good: MEK in AWS KMS kms: provider: aws-kms key_id: arn:aws:kms:... # Bad: MEK in config file # NEVER DO THIS encryption: master_key: "base64-encoded-key-here" # Insecure! </code></pre></div></li> <li> Rotate MEK annually: Regular rotation limits exposure <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">$ geode rotate-mek \ --old-key-id arn:aws:kms:.../old-key \ --new-key-id arn:aws:kms:.../new-key </code></pre></div></li> <li> Rotate DEKs quarterly: Defense-in-depth <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">dek_rotation: enabled: true interval_days: 90 </code></pre></div></li> <li> Backup keys separately: Store key backups in different location than data backups </li> </ol> <h4 id="performance-optimization" class="position-relative d-flex align-items-center group"> Performance Optimization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance-optimization" aria-haspopup="dialog" aria-label="Share link: Performance Optimization"> Share link </button> </h4><ol> <li> Enable hardware acceleration: Use AES-NI when available <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Verify AES-NI support $ grep -o aes /proc/cpuinfo | wc -l # If > 0, AES-NI is available </code></pre></div></li> <li> Cache DEKs: Reduce KMS roundtrips <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">encryption: cache_deks: true cache_size_mb: 256 # Larger cache for more tablespaces </code></pre></div></li> <li> Use AES-GCM: Faster than AES-CBC (parallel encryption) <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">encryption: algorithm: aes-256-gcm # Recommended </code></pre></div></li> <li> Benchmark impact: Measure before deploying <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">$ geode benchmark --with-tde --without-tde # Expect < 5% overhead with AES-NI </code></pre></div></li> </ol> <h4 id="operational-security" class="position-relative d-flex align-items-center group"> Operational Security <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="operational-security" aria-haspopup="dialog" aria-label="Share link: Operational Security"> Share link </button> </h4><ol> <li> Principle of least privilege: Limit KMS key access <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json">{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::123:role/geode-prod"}, "Action": ["kms:Decrypt", "kms:DescribeKey"], "Resource": "*" }] } </code></pre></div></li> <li> Enable audit logging: Track all key usage <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">audit: log_key_access: true log_to: /var/log/geode/tde-audit.log </code></pre></div></li> <li> Test disaster recovery: Practice key recovery procedures <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Test MEK recovery from backup $ geode recover-mek \ --backup-location s3://backup-bucket/mek-backup.enc \ --recovery-key $RECOVERY_PASSPHRASE </code></pre></div></li> </ol> <h3 id="performance-characteristics" class="position-relative d-flex align-items-center group"> Performance Characteristics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance-characteristics" aria-haspopup="dialog" aria-label="Share link: Performance Characteristics"> Share link </button> </h3> <h4 id="throughput-impact" class="position-relative d-flex align-items-center group"> Throughput Impact <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="throughput-impact" aria-haspopup="dialog" aria-label="Share link: Throughput Impact"> Share link </button> </h4>Typical overhead with AES-NI: <ul> <li>Read throughput: 2-5% slower</li> <li>Write throughput: 3-7% slower</li> <li>CPU usage: +10-15%</li> <li>Memory usage: Minimal (DEK cache: 128-256 MB)</li> </ul> Without AES-NI (software AES): <ul> <li>Read throughput: 15-25% slower</li> <li>Write throughput: 20-30% slower</li> <li>CPU usage: +50-100%</li> </ul> <h4 id="latency-impact" class="position-relative d-flex align-items-center group"> Latency Impact <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="latency-impact" aria-haspopup="dialog" aria-label="Share link: Latency Impact"> Share link </button> </h4>Typical latency overhead: <ul> <li>Query latency: +0.5-2ms per query</li> <li>Write latency: +1-3ms per transaction</li> <li>Startup time: +5-30 seconds (DEK loading)</li> </ul> <h3 id="monitoring-and-troubleshooting" class="position-relative d-flex align-items-center group"> Monitoring and Troubleshooting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="monitoring-and-troubleshooting" aria-haspopup="dialog" aria-label="Share link: Monitoring and Troubleshooting"> Share link </button> </h3> <h4 id="monitoring" class="position-relative d-flex align-items-center group"> Monitoring <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="monitoring" aria-haspopup="dialog" aria-label="Share link: Monitoring"> Share link </button> </h4>Track TDE health: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Check encryption status CALL dbms.security.encryption.status() YIELD enabled, algorithm, kms_provider, dek_count, last_rotation RETURN enabled, algorithm, kms_provider, dek_count, last_rotation; -- Monitor key access CALL dbms.security.encryption.audit() YIELD timestamp, operation, key_id, success, error WHERE success = false RETURN timestamp, operation, key_id, error; -- Performance metrics CALL dbms.monitor.encryption.stats() YIELD encrypt_ops_per_sec, decrypt_ops_per_sec, avg_latency_ms RETURN encrypt_ops_per_sec, decrypt_ops_per_sec, avg_latency_ms; </code></pre></div> <h4 id="common-issues" class="position-relative d-flex align-items-center group"> Common Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="common-issues" aria-haspopup="dialog" aria-label="Share link: Common Issues"> Share link </button> </h4>KMS unavailable: <ul> <li>Symptom: Cannot start database, “Failed to retrieve MEK”</li> <li>Cause: KMS service unreachable</li> <li>Solution: Verify network connectivity, check KMS service status, use cached DEKs (if enabled)</li> </ul> Performance degradation: <ul> <li>Symptom: Slow queries after enabling TDE</li> <li>Cause: Missing AES-NI support or software encryption</li> <li>Solution: Verify AES-NI availability, consider hardware upgrade</li> </ul> Key rotation failures: <ul> <li>Symptom: DEK rotation fails</li> <li>Cause: Insufficient KMS permissions</li> <li>Solution: Grant required KMS permissions (GenerateDataKey, Decrypt)</li> </ul> <h3 id="tde-implementation-patterns" class="position-relative d-flex align-items-center group"> TDE Implementation Patterns <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tde-implementation-patterns" aria-haspopup="dialog" aria-label="Share link: TDE Implementation Patterns"> Share link </button> </h3> <h4 id="multi-tenant-key-isolation" class="position-relative d-flex align-items-center group"> Multi-Tenant Key Isolation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="multi-tenant-key-isolation" aria-haspopup="dialog" aria-label="Share link: Multi-Tenant Key Isolation"> Share link </button> </h4>Isolate tenant data with separate encryption keys: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml security: encryption: enabled: true per_tenant_keys: true tenant_key_mapping: tenant-123: kms_key_id: arn:aws:kms:us-east-1:111:key/tenant-123-key tenant-456: kms_key_id: arn:aws:kms:us-east-1:111:key/tenant-456-key </code></pre></div>Query with tenant context: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Set tenant context for session SET SESSION tenant_id = 'tenant-123'; -- Geode automatically uses tenant-123's DEK for decryption MATCH (d:Document) WHERE d.category = 'financial' RETURN d.title, d.content; </code></pre></div>Each tenant’s data is encrypted with their unique key, preventing cross-tenant data access even if database is compromised. <h4 id="tablespace-level-encryption" class="position-relative d-flex align-items-center group"> Tablespace-Level Encryption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tablespace-level-encryption" aria-haspopup="dialog" aria-label="Share link: Tablespace-Level Encryption"> Share link </button> </h4>Encrypt different tablespaces with different keys: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create encrypted tablespace for sensitive data CREATE TABLESPACE sensitive_data LOCATION '/var/lib/geode/tablespaces/sensitive' WITH (encryption = 'aes-256-gcm', kms_key_id = 'high-security-key'); -- Create encrypted tablespace for regular data CREATE TABLESPACE regular_data LOCATION '/var/lib/geode/tablespaces/regular' WITH (encryption = 'aes-256-gcm', kms_key_id = 'standard-security-key'); -- Assign graphs to tablespaces CREATE GRAPH financial_data TABLESPACE sensitive_data; CREATE GRAPH analytics_data TABLESPACE regular_data; </code></pre></div>Benefits: Different security levels, independent key rotation, compliance segmentation. <h4 id="key-rotation-without-downtime" class="position-relative d-flex align-items-center group"> Key Rotation Without Downtime <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-rotation-without-downtime" aria-haspopup="dialog" aria-label="Share link: Key Rotation Without Downtime"> Share link </button> </h4>Rotate encryption keys while database remains online: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Initiate key rotation geode admin rotate-tde-key \ --old-key-id arn:aws:kms:us-east-1:123:key/old-key \ --new-key-id arn:aws:kms:us-east-1:123:key/new-key \ --rotation-mode online # Monitor rotation progress geode admin show-key-rotation-status # Output: # Rotation ID: rot-20260124-001 # Status: In Progress # Progress: 1,234,567 / 5,000,000 pages (24.7%) # Estimated completion: 2026-01-24 18:30:00 # Old DEKs re-encrypted: 45 / 100 # New DEKs created: 45 </code></pre></div>Online rotation process: <ol> <li>New DEKs created with new MEK</li> <li>Background process re-encrypts old DEKs with new MEK</li> <li>Newly written data uses new DEKs</li> <li>Old data gradually re-encrypted during maintenance windows</li> <li>Rollback possible until 100% complete</li> </ol> <h4 id="hardware-security-module-hsm-integration" class="position-relative d-flex align-items-center group"> Hardware Security Module (HSM) Integration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hardware-security-module-hsm-integration" aria-haspopup="dialog" aria-label="Share link: Hardware Security Module (HSM) Integration"> Share link </button> </h4>Use hardware-backed key storage for maximum security: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml with PKCS#11 HSM security: encryption: enabled: true algorithm: aes-256-gcm kms: provider: pkcs11 library_path: /usr/lib/softhsm/libsofthsm2.so slot_id: 0 pin_file: /secure/hsm_pin key_label: geode-master-encryption-key # HSM-specific settings use_hsm_crypto: true # Use HSM for encrypt/decrypt operations cache_deks_in_hsm: true # Store DEKs in HSM memory </code></pre></div>Initialize HSM key: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Initialize HSM slot softhsm2-util --init-token --slot 0 --label "geode-hsm" # Generate master key in HSM pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so \ --login --keypairgen --key-type AES:32 \ --label geode-master-encryption-key </code></pre></div> <h4 id="encryption-performance-optimization" class="position-relative d-flex align-items-center group"> Encryption Performance Optimization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encryption-performance-optimization" aria-haspopup="dialog" aria-label="Share link: Encryption Performance Optimization"> Share link </button> </h4>Optimize TDE for your hardware: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml performance tuning security: encryption: enabled: true algorithm: aes-256-gcm # Performance optimizations use_aes_ni: true # Use hardware AES acceleration cache_deks: true dek_cache_size_mb: 512 # Large cache for many tablespaces dek_cache_ttl_seconds: 3600 # Parallelization encrypt_threads: 8 # Parallel encryption for writes decrypt_threads: 16 # Parallel decryption for reads # Batching encryption_batch_size: 128 # Pages to encrypt in batch </code></pre></div>Benchmark configuration: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Test read performance with TDE geode benchmark read \ --queries=1000000 \ --threads=32 \ --with-tde \ --output=tde-read-results.json # Test write performance geode benchmark write \ --inserts=1000000 \ --threads=32 \ --with-tde \ --output=tde-write-results.json # Compare with non-encrypted baseline geode benchmark read --queries=1000000 --threads=32 --without-tde </code></pre></div>Typical results with AES-NI: <ul> <li>Read overhead: 2-4%</li> <li>Write overhead: 4-8%</li> <li>CPU increase: 10-15%</li> </ul> <h4 id="compliance-audit-trail" class="position-relative d-flex align-items-center group"> Compliance Audit Trail <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-audit-trail" aria-haspopup="dialog" aria-label="Share link: Compliance Audit Trail"> Share link </button> </h4>Generate TDE compliance reports: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Verify encryption status CALL dbms.security.encryption.audit() YIELD tablespace, encrypted, algorithm, key_id, key_created_at, last_rotation, pages_encrypted, pages_total, encryption_percentage RETURN tablespace, encrypted, encryption_percentage, last_rotation ORDER BY tablespace; -- List all encryption keys CALL dbms.security.encryption.listKeys() YIELD key_id, algorithm, created_at, status, usage_count RETURN key_id, algorithm, created_at, status, usage_count ORDER BY created_at DESC; -- Check key access logs SELECT timestamp, key_id, operation, -- encrypt, decrypt, rotate user_id, success, error_message FROM system.tde_audit WHERE timestamp > current_timestamp() - INTERVAL '7 days' ORDER BY timestamp DESC; </code></pre></div>Export for compliance reporting: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">def generate_tde_compliance_report(): """Generate quarterly TDE compliance report""" report = { 'period': f"Q{datetime.now().quarter} {datetime.now().year}", 'encryption_status': {}, 'key_management': {}, 'access_audit': {} } # Verify all data encrypted result = db.execute(""" CALL dbms.security.encryption.audit() YIELD tablespace, encrypted, encryption_percentage RETURN tablespace, encrypted, encryption_percentage """) report['encryption_status'] = { row['tablespace']: { 'encrypted': row['encrypted'], 'percentage': row['encryption_percentage'] } for row in result } # Verify key rotation compliance result = db.execute(""" CALL dbms.security.encryption.listKeys() YIELD key_id, created_at, last_rotation RETURN key_id, created_at, last_rotation """) for row in result.rows: days_since_rotation = (datetime.now() - row['last_rotation']).days report['key_management'][row['key_id']] = { 'age_days': days_since_rotation, 'compliant': days_since_rotation < 365 # Annual rotation required } return report </code></pre></div> <h4 id="crypto-shredding-for-data-deletion" class="position-relative d-flex align-items-center group"> Crypto-Shredding for Data Deletion <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="crypto-shredding-for-data-deletion" aria-haspopup="dialog" aria-label="Share link: Crypto-Shredding for Data Deletion"> Share link </button> </h4>Implement cryptographic erasure for secure data deletion: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Delete data cryptographically by destroying its DEK CALL dbms.security.cryptoShred('tablespace_archived_2023') YIELD tablespace, dek_id, dek_destroyed, data_rendered_unrecoverable, timestamp RETURN *; </code></pre></div>Crypto-shredding is faster than deleting billions of records and provides mathematical certainty that data is unrecoverable. Essential for GDPR “right to be forgotten” compliance. <h4 id="tde-disaster-recovery" class="position-relative d-flex align-items-center group"> TDE Disaster Recovery <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tde-disaster-recovery" aria-haspopup="dialog" aria-label="Share link: TDE Disaster Recovery"> Share link </button> </h4>Backup encryption keys securely: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Export MEK reference (NOT the key itself) geode admin export-tde-config \ --output=/backups/tde-config.json # Backup should contain: # - KMS key ARN/ID # - Algorithm configuration # - DEK metadata # NOT the actual encryption keys! # Keys remain in KMS - disaster recovery restores access, not keys themselves </code></pre></div>Recover TDE-encrypted database: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Step 1: Restore database from backup geode restore --backup=/backups/geode-full-20260124.tar.gz # Step 2: Configure KMS access geode admin configure-tde \ --kms-provider aws-kms \ --kms-key-id arn:aws:kms:us-east-1:123:key/abc-def # Step 3: Verify key access geode admin test-tde-access # Step 4: Start database (auto-loads DEKs from KMS) geode serve --data /var/lib/geode </code></pre></div> <h3 id="tde-monitoring-and-alerting" class="position-relative d-flex align-items-center group"> TDE Monitoring and Alerting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tde-monitoring-and-alerting" aria-haspopup="dialog" aria-label="Share link: TDE Monitoring and Alerting"> Share link </button> </h3>Set up monitoring for encryption health: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># prometheus_rules.yml groups: - name: geode_tde rules: - alert: TDEKeyUnavailable expr: geode_tde_key_access_failures > 0 for: 5m annotations: summary: "TDE encryption key unavailable" - alert: TDEPerformanceDegradation expr: rate(geode_tde_decrypt_duration_seconds[5m]) > 0.01 for: 10m annotations: summary: "TDE decryption taking longer than expected" - alert: TDEKeyRotationOverdue expr: geode_tde_key_age_days > 365 annotations: summary: "TDE key rotation overdue (>365 days)" </code></pre></div> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/fle/" >Field-Level Encryption (FLE)</a> : Encrypt specific sensitive fields</li> <li><a href="/tags/security/" >Security</a> : Overall security features</li> <li><a href="/tags/encryption/" >Encryption</a> : Encryption capabilities</li> <li><a href="/tags/compliance/" >Compliance</a> : Regulatory compliance</li> <li><a href="/tags/authentication/" >Authentication</a> : Access control</li> <li><a href="/tags/audit-logging/" >Audit Logging</a> : Security audit trails</li> <li><a href="/tags/backup/" >Backup</a> : Encrypted backup strategies</li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li><a href="/docs/security/" >Security Guide</a> : Complete security documentation</li> <li><a href="/docs/security/kms-integration/" >KMS Integration</a> : Key management service integration</li> <li><a href="/docs/query/performance-tuning/" >Performance Tuning</a> : TDE performance optimization</li> <li><a href="/docs/operations/disaster-recovery/" >Disaster Recovery</a> : TDE-encrypted backup recovery</li> </ul> Geode’s Transparent Data Encryption provides enterprise-grade protection for data at rest with minimal performance overhead and zero application changes—essential for regulated industries and security-conscious deployments.

Popular

Related Articles

Security and Compliance Guide