Date: 2019-02-01
Time: 10:20–11:10
Room: Hotel
Data encryption is one of the powerful methods to protect data from threats such as eavesdropping and theft. It is essential when storing confidential information such as credit card numbers, personal information of users, etc. Also, various data protection standards and regulations such as PCI DSS, GDPR, etc. require it.
There are various methods to encrypt data stored in PostgreSQL, such as pgcrypto and file system level data encryption using LUKS. In practice, some security standards require database encryption to have the following four properties:
* Transparent data encryption (TDE)
* More robust and secure encryption key management while integrating key management systems (KMS)
* Minimize performance degradation
* Platform-independent
But our research tells us that there is no open source solution satisfying all four of them. So we decided to both implement TDE on PostgreSQL and design it such that it integrates seamlessly with various KMSs. Our solution consists of per-tablespace database encryption. It encrypts and decrypts database data transparently to users by doing them at a layer between PostgreSQL's shared buffers and storages. We've tried to make sure that our implementation has minimum performance overhead. Also, it can seamlessly store and fetch encryption keys by integrating with KMSs via KMIP protocol.
In this talk, we will first introduce some studies about TDE and KMS. Then, we will provide some internal details about implementing TDE and the details of integrating with KMSs. Lastly, we will discuss our choice of design and a proof of concept explaining that.
The following slides have been made available for this session: