Top 3 MongoDB Encryption Features

Top 3 MongoDB Encryption Features

What Is MongoDB Encryption?

MongoDB is a distributed document database supporting large data volumes. For MongoDB databases that store sensitive data, administrators can encrypt data at rest while it is stored in permanent data and backups, and also encrypt it in transit while transferred over the network. When users work with data on the MongoDB server, data can be encrypted at the field level to protect sensitive fields within a dataset.

Encryption is a key part of a MongoDB security strategy. It ensures that only authenticated entities can read the encrypted data, and protects sensitive data from eavesdropping and unauthorized access.

MongoDB Encryption Features

1. MongoDB Network Encryption

MongoDB can encrypt network traffic for clients. A client is an entity that can connect to a MongoDB server, including users, administrators, applications that interface with the MongoDB database, nodes that make up the MongoDB cluster, and MongoDB tools like mongodump.

MongoDB supports TLS, allowing clients to connect over an encrypted channel. TLS protocol is also supported with x.509 certificates and Forward Secrecy, so even if the server’s private key is compromised, the user’s session key remains secure.

2. MongoDB Data at Rest Encryption

There are several ways to encrypt data at rest using MongoDB, including external disk and filesystem-based encryption and application-level encryption. However, these approaches require additional technology, increasing complexity and costs.

The MongoDB Encrypted Storage Engine lets you build at-rest data protection into the database. Administrators can natively encrypt database files on disk to eliminate performance and management overhead. The engine adds a layer of defense—only staff members with the appropriate database credentials can access the encrypted data.

MongoDB supports various encryption schemas, including the default AES-256 in CBC mode and AES-256 in GCM mode. It lets you configure the schema for FIPS 140-2 compliance.

3. MongoDB Field Level Encryption

When the database server handles data encryption and decryption, users with elevated privileges (i.e., administrators) can potentially read memory used by the host operating system. To completely protect your data from compromised administrator accounts, ensure the database engine never exposes the plaintext of the encrypted data.

MongoDB’s Client-Side Field Level Encryption (FLE) lets you selectively encrypt document fields and secure them with individual keys. FLE is separate from the database, transparent to the server, and handled exclusively in the MongoDB drivers on the client.

Configure Encryption in MongoDB

When using MongoDB Atlas, the data is already encrypted. MongoDB provides cloud provider-level management for Atlas encryption, but you can manage keys with another solution.

Key Management

MongoDB Enterprise lets you transfer keys securely using a KMIP-compliant key management appliance.

You can create new keys by connecting the key manager to mongod through various options for starting mongod.

mongod --enableEncryption --kmipServerName <KMIP Server HostName> \
  --kmipPort <KMIP server port> --kmipServerCAFile ca.pem \
  --kmipClientCertificateFile client.pem

Managing Keys Locally

You need a base64-encoded key file containing a single 16- or 32-character string to enable key file-based encryption. The file must be accessible only to the mongod process owner. Use the following steps to manage keys locally:

  1. Create the base64-encoded key file with the 16- or 32-character string. You can use any method you like to generate the encoded key file. Here’s one example:
openssl rand -base64 32 > mongodb-keyfile
  1. Configure the file permissions:
chmod 600 mongodb-keyfile
  1. Launch mongod to start using the key file. You can start with:
mongod –enableEncryption –encryptionKeyFile mongodb-keyfile
  1. Verify if the encryption key manager initialized successfully with the key file. A successful operation should generate a log this message:
[initandlisten] Encryption KEY manager initialized WITH KEY file: <path TO keyfile>

MongoDB Security with Satori

Satori’s data security platform provides cloud-based security for MongoDB users.