Definitions

  • Primary key encrypts the Keystore and is stored in the primary key file. MicroStrategy Intelligence Server looks up the path to the master key in the registry at startup.
  • Keystore – Contains the keys used to encrypt metadata and file caches. The master key encrypts these keys.
  • Secure Package – A password-protected file that allows administrators to securely deploy encryption keys between clusters or intelligence servers that share the same metadata.
  • Secure Package Code – The password used to protect the Secure Package file.

What is Encryption key Management?

Encryption Key is a process that uses processes to encrypt data in the form of ciphertext. This ciphertext can only be helpful if the person or application accessing the data has the encryption keys necessary to decrypt the ciphertext. Therefore, if data  accidentally stolen or transmitted, it is protected with data encryption as it cannot be interpreted.

Monitoring and maintaining data encryption keys is an essential part of any data encryption strategy, as a cybercriminal can use encryption keys to restore coded data to its original, unencrypted state. An encoding key management system includes the generation, exchange, storage, use, destruction, and talk of encryption keys.

Encryption Key Manager

Encryption Key Manager (EKM) creates and maintains unique encryption keys for each MicroStrategy environment. These keys can encrypt sensitive information stored in the session, cache, bucket, history list, and metadata retrieval files. EKM functions include creating, importing, and exporting these unique keys through the configuration wizard.

Encryption key Storage And Backup

Key management is about protecting encryption keys against loss, damage, and unauthorized access. Many developments can control Client management, including periodically changing keys and managing how keys assigned and who receives them. Organizations should also consider whether one key should used for all backup types or whether each class should have its key.

The importance of managing encryption keys cannot be overstated. Unless the creation, secure storage, manipulation, and disposal of encryption keys are carefully controlled, unauthorized persons can view them. If keys are lost or tainted, it can cause access to systems and data and render the system utterly unusable unless it  reformatted and reinstalled.

Choose an Encryption key Management Solution

How MariaDB handles encryption keys depends on the  management solution you choose. MariaDB currently offers three options:

File key Management Plugin

Therefore,  File Key Management plug-in included with MariaDB is a basic. management plug-in that reads keys from a plain text file. It can also serve as an example and starting point for developing a key management plug-in.

AWS key Management plug-in

The AWS Key Management Plug-in is a management and encryption plug-in that uses the Amazon Web Services (AWS) Key Management Service (KMS). The AWS Key Management plug-in depends on the AWS SDK for, which uses the Apache license, version 2.0. This license is not compatible with the MariaDB Server GPL 2.0 license, so we cannot distribute packages that cover the AWS Key Management plug-in. The only way to currently get the plugin is to install it from the source.

Expert key Management Plugin

The Eperi Key Management Plug-In a key management and encryption plug-in that  used by the eperi Gateway for databases. The eperi Database Gateway stores encryption keys on the key server outside the database server and thus offers an additional level of security. The eperi Database Gateway also supports the implementation of all data encryption operations on the key server, but this is optional.

Use multiple Encryption keys

The encryption and key management plug-ins support the use of multiple encryption keys. Each  can be clear with a different 32-bit integer as the key identifier.

The multi-key support opens up possible use cases. For example, suppose a hypothetical key management and encryption plug-in configured to provide two encryption keys. An can used on “low security” tables. You could use short keys that might not rotated and the data could  encrypted using a fast encryption algorithm. Another  may be for “high security” tables. You could use long keys that rotated frequently and the data could encrypted using a slower but more secure encryption algorithm. The user would specify the key id they want to use for different tables and only use high security when needed.

There are two encryption key IDs that have special meaning in MariaDB. Encryption key 1 used to encrypt system data such as InnoDB recovery logs, binary logs, etc. It should always present when data encryption at rest enabled.2 used to encrypt temporary data, such as B. And also, Temporary files and temporary tables. It’s optional. If it doesn’t exist, MariaDB will use 1 for these purposes.