All pages
Powered by GitBook
1 of 5

Loading...

Loading...

Loading...

Loading...

Loading...

Aria Encryption

Learn about Aria encryption in MariaDB Server for data at rest. This section details how to encrypt Aria tablespaces, providing enhanced security for your stored data.

Aria Encryption Overview

MariaDB can encrypt data in tables that use the Aria storage engine. This includes both user-created tables and internal on-disk temporary tables that use the Aria storage engine. This ensures that your Aria data is only accessible through MariaDB.

For encryption with the InnoDB and XtraDB storage engines, see Encrypting Data for InnoDB/XtraDB.

Basic Configuration

In order to enable encryption for tables using the Aria storage engine, there are a couple server system variables that you need to set and configure. Most users will want to set aria_encrypt_tables and encrypt_tmp_disk_tables.

Users of data-at-rest encryption will also need to have a key management and encryption plugin configured. Some examples are File Key Management Plugin and AWS Key Management Plugin.

Determining Whether a Table is Encrypted

The has the that can be used to get information about which tables are encrypted. Aria does not currently have anything like that (see about that).

To determine whether an Aria table is encrypted, you currently have to search the data file for some plain text that you know is in the data.

For example, let's say that we have the following table:

Then, we could search the data file that belongs to db1.aria_tab for str1 using a command-line tool, such as :

If you can find the plain text of the string, then you know that the table is not encrypted.

Encryption and the Aria Log

Only Aria tables are currently encrypted. The is not yet encrypted. See about that.

This page is licensed: CC BY-SA / Gnu FDL

[mariadb]
...

# File Key Management
plugin_load_add = file_key_management
file_key_management_filename = /etc/mysql/encryption/keyfile.enc
file_key_management_filekey = FILE:/etc/mysql/encryption/keyfile.key
file_key_management_encryption_algorithm = AES_CTR

# Aria Encryption
aria_encrypt_tables=ON
encrypt_tmp_disk_tables=ON
InnoDB storage engine
information_schema.INNODB_TABLESPACES_ENCRYPTION table
MDEV-17324
strings
Aria log
MDEV-8587
SELECT * FROM db1.aria_tab LIMIT 1;
+----+------+
| id | str  |
+----+------+
|  1 | str1 |
+----+------+
1 row IN SET (0.00 sec
$ sudo strings /var/lib/mysql/db1/aria_tab.MAD | grep "str1"
str1

Aria Enabling Encryption

In order to enable data-at-rest encryption for tables using the Aria storage engine, you first need to configure the server to use an Encryption Key Management plugin. Once this is done, you can enable encryption by setting the relevant system variables.

Encrypting User-created Tables

With tables that the user creates, you can enable encryption by setting the aria_encrypt_tables system variable to ON, then restart the Server. Once this is set, Aria automatically enables encryption on all tables you create after with the ROW_FORMAT table option set to PAGE.

Currently, Aria does not support encryption on tables where the ROW_FORMAT table option is set to the FIXED or DYNAMIC values.

Unlike InnoDB, Aria does not support the table option (see about that). Encryption for Aria can only be enabled globally using the system variable.

Encrypting Existing Tables

In cases where you have existing Aria tables that you would like to encrypt, the process is a little more complicated. Unlike InnoDB, Aria does not utilize to automatically perform encryption changes (see about that). Therefore, to encrypt existing tables, you need to identify each table that needs to be encrypted, and then you need to manually rebuild each table.

First, set the aria_encrypt_tables system variable to encrypt new tables.

Identify Aria tables that have the ROW_FORMAT table option set to PAGE.

For each table in the result-set, issue an ALTER TABLE statement to rebuild the table.

This statement causes Aria to rebuild the table using the ROW_FORMAT table option. In the process, with the new default setting, it encrypts the table when it writes to disk.

Encrypting Internal On-disk Temporary Tables

During the execution of queries, MariaDB routinely creates internal temporary tables. These internal temporary tables initially use the storage engine, which is entirely stored in memory. When the table size exceeds the allocation defined by the system variable, MariaDB writes the data to disk using another storage engine. If you have the set to ON, MariaDB uses Aria in writing the internal temporary tables to disk.

Encryption for internal temporary tables is handled separately from encryption for user-created tables. To enable encryption for these tables, set the system variable to ON. Once set, all internal temporary tables that are written to disk using Aria are automatically encrypted.

Manually Encrypting Tables

Currently, Aria does not support manually encrypting tables through the and table options. For more information, see .

In cases where you want to encrypt tables manually or set the specific encryption key, use .

This page is licensed: CC BY-SA / Gnu FDL

ENCRYPTED
MDEV-18049
aria_encrypt_tables
background encryption threads
MDEV-18971
MEMORY
max_heap_table_size
aria_used_for_temp_tables
encrypt_tmp_disk_tables
ENCRYPTED
ENCRYPTION_KEY_ID
MDEV-18049
InnoDB

Aria Encryption Keys

As with other storage engines that support data-at-rest encryption, Aria relies on an Encryption Key Management plugin to handle its encryption keys. Where the support is available, Aria can use multiple keys.

Encryption Keys

MariaDB keeps track of each encryption key internally using a 32-bit integer, which serves as the key identifier. Unlike InnoDB, Aria does not support the ENCRYPTION_KEY_ID table option (for more information, see MDEV-18049), which allows the user to specify the encryption key to use. Instead, Aria defaults to specific encryption keys provided by the Encryption Key Management plugin.

  • When working with user-created tables, Aria encrypts them to disk using the ID 1 key.

  • When working with internal temporary tables written to disk, Aria encrypts them to disk using the ID 2 key, unless there is no ID 2 key, then it falls back on the ID 1 key.

Key Rotation

Some allow you to automatically rotate and version your encryption keys. If a plugin support key rotation, and if it rotates the encryption keys, then InnoDB's can re-encrypt InnoDB pages that use the old key version with the new key version. However, Aria does not have a similar mechanism, which means that the tables remain encrypted with the older key version. For more information, see .

In order for key rotation to work, both the backend key management service (KMS) and the corresponding have to support key rotation. See to determine which plugins currently support key rotation.

This page is licensed: CC BY-SA / Gnu FDL

SET GLOBAL aria_encrypt_tables=ON;
SELECT TABLE_SCHEMA, TABLE_NAME 
FROM information_schema.TABLES 
WHERE ENGINE='Aria' 
  AND ROW_FORMAT='PAGE'
  AND TABLE_SCHEMA != 'information_schema';
ALTER TABLE test.aria_table ENGINE=Aria ROW_FORMAT=PAGE;
key management and encryption plugins
background encryption threads
MDEV-18971
key management and encryption plugin
Encryption Key Management: Support for Key Rotation in Encryption Plugins

Aria Disabling Encryption

The process involved in safely disabling data-at-rest encryption for your Aria tables is very similar to that of enabling encryption. To disable, you need to set the relevant system variables and then rebuild each table into an unencrypted state.

Don't remove the Encryption Key Management plugin from your configuration file until you have unencrypted all tables in your database. MariaDB cannot read encrypted tables without the relevant encryption key.

Disabling Encryption on User-Created Tables

For user-created tables, you can disable encryption by setting the aria_encrypt_tables system variable to OFF. Once this is set, MariaDB no longer encrypts new tables created with the Aria storage engine.

Unlike , Aria does not currently use background encryption threads. Before removing the plugin from the configuration file, you need to manually rebuild each table to an unencrypted state.

To find the encrypted tables, query the Information Schema, filtering the table for those that use the Aria storage engine and the PAGE .

Each table in that result set was written to disk in an encrypted state.

To remove the encryption of those tables,

  • Set the aria_encrypt_tables variable to OFF;

  • Leave the configuration for the encryption keys in place (otherwise, you cannot decrypt tables!);

  • Run the following statement for each encrypted table.

Once all of the Aria tables are rebuilt, they're unencrypted.

Optionally, you can remove the configuration for the encryption keys now.

Disabling Encryption for Internal On-Disk Temporary Tables

MariaDB routinely creates internal temporary tables. When these temporary tables are written to disk and the system variable is set to ON, MariaDB uses the Aria storage engine.

To decrypt these tables, set the to OFF. Once set, all internal temporary tables that are created from that point on are written unencrypted to disk.

This page is licensed: CC BY-SA / Gnu FDL

SET GLOBAL aria_encrypt_tables = OFF;
InnoDB
Encryption Key Management
TABLES
ROW_FORMAT
ALTER TABLE
aria_used_for_temp_tables
encrypt_tmp_disk_tables
SELECT TABLE_SCHEMA, TABLE_NAME
FROM information_schema.TABLES
WHERE ENGINE = 'Aria'
  AND ROW_FORMAT = 'PAGE'
  AND TABLE_SCHEMA != 'information_schema'
  AND CREATE_OPTIONS LIKE '%`encrypted`=yes%';
ALTER TABLE test.aria_table ENGINE = Aria ROW_FORMAT = PAGE;