Skip to content
  • Allen Lai's avatar
    71e656a3
    WL#9289 InnoDB: Support Transparent Data Encryption for Undo Tablespaces · 71e656a3
    Allen Lai authored
    
    WL#9290 InnoDB: Support Transparent Data Encryption for Redo Log
    
    Based on wl#8548, we provide encryption support for redo log and undo tablespaces.
    
    For encrypting redo/undo log, as same as we did in wl#8548, we will en/decrypt the
    redo log blocks/undo log pages in the I/O layer.
    Which means, the en/decryption only happens when the redo/undo log read or
    write from/to disk.
    
    For redo log, encryption metadata will be stored in the header of first log file.
    Same as wl#8548, there're 2 key levels here, master key and tablespace key.
    Master key is stored in keyring plugin, and it's used to en/decrypt tablespace
    key and iv. Tablespace key is for en/decrypt redo log blocks, and it will be
    stored into the 3rd block of first redo log file(ib_logfile0).
    
    For undo log, Same as regular tablespace, the encryption metadata will be stored
    in the first page of data file.
    
    We also added 2 new global variables innodb_redo_log_encrypt=ON/OFF,
    innodb_undo_log_encrypt=ON/OFF for en/disable redo/undo log encryption.
    
    Reviewed-by: default avatarSunny Bains <sunny.bains@oracle.com>
                 Annamalai Gurusami <annamalai.gurusami@oracle.com>
                 Shaohua Wang <shaohua.wang@oracle.com>
    71e656a3
    WL#9289 InnoDB: Support Transparent Data Encryption for Undo Tablespaces
    Allen Lai authored
    
    WL#9290 InnoDB: Support Transparent Data Encryption for Redo Log
    
    Based on wl#8548, we provide encryption support for redo log and undo tablespaces.
    
    For encrypting redo/undo log, as same as we did in wl#8548, we will en/decrypt the
    redo log blocks/undo log pages in the I/O layer.
    Which means, the en/decryption only happens when the redo/undo log read or
    write from/to disk.
    
    For redo log, encryption metadata will be stored in the header of first log file.
    Same as wl#8548, there're 2 key levels here, master key and tablespace key.
    Master key is stored in keyring plugin, and it's used to en/decrypt tablespace
    key and iv. Tablespace key is for en/decrypt redo log blocks, and it will be
    stored into the 3rd block of first redo log file(ib_logfile0).
    
    For undo log, Same as regular tablespace, the encryption metadata will be stored
    in the first page of data file.
    
    We also added 2 new global variables innodb_redo_log_encrypt=ON/OFF,
    innodb_undo_log_encrypt=ON/OFF for en/disable redo/undo log encryption.
    
    Reviewed-by: default avatarSunny Bains <sunny.bains@oracle.com>
                 Annamalai Gurusami <annamalai.gurusami@oracle.com>
                 Shaohua Wang <shaohua.wang@oracle.com>
Loading