-
Allen Lai authored
WL#9290 InnoDB: Support Transparent Data Encryption for Redo Log Based on wl#8548, we provide encryption support for redo log and undo tablespaces. For encrypting redo/undo log, as same as we did in wl#8548, we will en/decrypt the redo log blocks/undo log pages in the I/O layer. Which means, the en/decryption only happens when the redo/undo log read or write from/to disk. For redo log, encryption metadata will be stored in the header of first log file. Same as wl#8548, there're 2 key levels here, master key and tablespace key. Master key is stored in keyring plugin, and it's used to en/decrypt tablespace key and iv. Tablespace key is for en/decrypt redo log blocks, and it will be stored into the 3rd block of first redo log file(ib_logfile0). For undo log, Same as regular tablespace, the encryption metadata will be stored in the first page of data file. We also added 2 new global variables innodb_redo_log_encrypt=ON/OFF, innodb_undo_log_encrypt=ON/OFF for en/disable redo/undo log encryption. Reviewed-by:
Sunny Bains <sunny.bains@oracle.com> Annamalai Gurusami <annamalai.gurusami@oracle.com> Shaohua Wang <shaohua.wang@oracle.com>
Allen Lai authoredWL#9290 InnoDB: Support Transparent Data Encryption for Redo Log Based on wl#8548, we provide encryption support for redo log and undo tablespaces. For encrypting redo/undo log, as same as we did in wl#8548, we will en/decrypt the redo log blocks/undo log pages in the I/O layer. Which means, the en/decryption only happens when the redo/undo log read or write from/to disk. For redo log, encryption metadata will be stored in the header of first log file. Same as wl#8548, there're 2 key levels here, master key and tablespace key. Master key is stored in keyring plugin, and it's used to en/decrypt tablespace key and iv. Tablespace key is for en/decrypt redo log blocks, and it will be stored into the 3rd block of first redo log file(ib_logfile0). For undo log, Same as regular tablespace, the encryption metadata will be stored in the first page of data file. We also added 2 new global variables innodb_redo_log_encrypt=ON/OFF, innodb_undo_log_encrypt=ON/OFF for en/disable redo/undo log encryption. Reviewed-by:
Sunny Bains <sunny.bains@oracle.com> Annamalai Gurusami <annamalai.gurusami@oracle.com> Shaohua Wang <shaohua.wang@oracle.com>
Loading