EDUCBA

EDUCBA

MENUMENU
  • Blog
  • Free Courses
  • All Courses
  • All in One Bundle
  • Login
Home Data Science Data Science Tutorials MongoDB Tutorial MongoDB Encryption

MongoDB Encryption

Updated March 8, 2023

MongoDB Encryption

Definition of MongoDB Encryption

Mongodb encryption process involves to generate a master key of an entire database, after generating master key we are creating the unique keys for every database. Then we are encrypting our data with the database which was we have created, we can also encrypt our whole database by using master key. Any of the database involves the two forms either data at rest or data in motion, data at rest is the forms where data is not moving anywhere its static data forms. Data in motions will moves the data in network its static data forms.

Start Your Free Data Science Course

Hadoop, Data Science, Statistics & others

Syntax:

Below is the syntax of encryption in MongoDB.

1) Connect MongoDB instance by using encryption –

# mongo –ssl –host <Instance hostname> --sslCAFile <Name of certificate authority file name>

2) Connect MongoDB instance by using client certificate and certificate authority file –

# mongo –ssl –host <Instance hostname> --sslPEMKeyFile (PEM key file name) --sslCAFile <Name of certificate authority file name>

3) Rotate KMIP master encryption key –

# mongod –enableEncryption (enable encryption while rotating key) –kmipRotateMasterKey (Rotate KMIP master key) \ --kmipServerName <hostname of KMIP server> \--kmipServerCAFile <Certificate authority filename> --kmipClientCertificateFile <client certificate file name>

Parameter description syntax of MongoDB encryption are as follows.

1) Mongo – This parameter is used to login into MongoDB instance. In MongoDB we can login database instance using mongo command.

2) SSL – This is defined as login into the MongoDB database instance by using SSL authentication.

3) Host – The host and hostname is defined as IP or hostname used to login specified database instance in MongoDB. While login into any MongoDB database instance we need to use hostname.

4) sslCAFile – This is certificate authority file used to verify that certificate is present or not on database server. This file is used while login into the database server by using encryption.

5) sslPEMKeyFile – This file contains the certificate of mongo shell and this key is present on mongos or mongod instance.

6) enableEncryption – This parameter is define as use of encryption at the time of rotating master key.

7) kmipRotateMasterKey – This parameter is used to rotate master key of KMIP server. Using this parameter we can rotate master key in MongoDB.

8) kmipServerName – This is nothing but the KMIP server hostname which was used at the time of rotating master key.

9) kmipServerCAFile – This is certificate authority file of KMIP server. This file is used while rotating the master key.

10) kmipClientCertificateFile – This is client certificate file of KMIP server. This file is used while rotating the master key.

How encryption works in MongoDB?

MongoDB involves two types of data encryption forms.

1) Data at rest encryption
2) Data in motion encryption

To encrypt the data using data at rest encryption enterprise MongoDB will provides the storage based and native symmetric key.

We can say that data at rest encryption is the data not moving over the network, we can say that it’s in static forms. Data at rest database encryption is also called as transparent data encryption its abbreviation is TDE. MongoDB uses the AES 256-bit standard encryption algorithm to encrypt the database. MongoDB uses the same encryption cipher key to encrypt as well as decrypt the data.

Data in motion is defined as data is moving over the network, we can say that its steam forms. MongoDB encryption process involves below steps.

1) First step is generate master key to the whole database.
2) Second step is generate unique key for every database.
3) Third step is encrypt the database data using key which was we have generated in first and second step.
4) Fourth step is encrypt whole database by using the master key which was we have generated in first step.

In MongoDB, data is transacted between server application and database in two ways.

TLS and SSL are most secure protocols of encryption to send and receive data from two systems. This protocols is used in MongoDB encryption is some PEM file which was issued by the certificate authority. There are multiple settings available in MongoDB to configure the TLS and SSL protocol for client certificates.

We can also use sslCAFile to create certificate. We can store this file in MongoDB instance to use the encryption while login into the MongoDB instance. We can also rotate our encryption key. We can rotate our key by using KMIP master rotation.

Example

Below example shows encryption in MongoDB. Below steps shows how to use encryption in MongoDB.

1) First step is to create locally managed key file to manage the key management service. We can create by using OpenSSL. We have created the file name as mongodb_client.key.

Code:

# mkdir /encryption
# touch /encryption/mongodb_client.key
# openssl rand -hex 50 | head -c 96 | base64 | tr -d '\n' > /encryption/mongodb_client.key
# chmod 600 /encryption/mongodb_client.key
# chown mongod:mongod /encryption/mongodb_client.key
# cat /encryption/mongodb_client.key

MongoDB encryption 1

Figure – Example to create locally managed key file to manage the key management service.

2) After creating the key file, open the mongo shell command and login by using the keyfile, –shell, and –nodb option.

Code:

# mongo (Command connect to DB) --shell (Parameter) --nodb (Parameter) --eval (Parameter) "var LOCAL_KEY = cat('https://cdn.educba.com/encryption/mongodb_client.key')"
LOCAL_KEY

MongoDB encryption 2

Figure – Example open the mongo shell command and login by using the keyfile.

3) Third step involves load the documents of encryption using client-side encryption configuration.

Code:

var ClientSideFieldLevelEncryptionOptions = {
"keyVaultNamespace" : "MongoDB._encryption",
"kmsProviders" : {
"local" : {
"key" : BinData (0, LOCAL_KEY)
}
}
}

MongoDB encryption 3

Figure – Example to load the documents of encryption using client-side encryption configuration.

4) After setting configuration connect to the local host database.

Code:

csfleDatabaseConnection = Mongo(ClientSideFieldLevelEncryptionOptions)

MongoDB encryption 4

Figure – Example to connect the local host database.

5) Fifth stage is show the database, connect to the database and show the collections from connected database.

Code:

show dbs
use MongoDB
show collections

output

Figure – show the database, connect to the database and show the collections.

Conclusion

Data at rest encryption and data in motion encryption has two forms of MongoDB data encryption. Data encryption is very important in MongoDB to secure data. Encryption involves generate master key for the database. We can rotate our master key using KMIP master rotation algorithm.

Recommended Articles

This is a guide to MongoDB Encryption. Here we discuss the Definition, How encryption works in MongoDB? examples with code implementation respectively. You may also have a look at the following articles to learn more –

  1. MongoDB Join
  2. MongoDB findOne()
  3. MongoDB Database
  4. MongoDB group by
C++ PROGRAMMING Course Bundle - 9 Courses in 1 | 5 Mock Tests
37+ Hour of HD Videos
9 Courses
5 Mock Tests & Quizzes
Verifiable Certificate of Completion
Lifetime Access
4.5
ASP.NET Course Bundle - 28 Courses in 1 | 5 Mock Tests
123+ Hours of HD Videos
28 Courses
5 Mock Tests & Quizzes
Verifiable Certificate of Completion
Lifetime Access
4.5
SQL Course Bundle - 51 Courses in 1 | 6 Mock Tests
204+ Hours of HD Videos
51 Courses
6 Mock Tests & Quizzes
Verifiable Certificate of Completion
Lifetime Access
4.5
SOFTWARE TESTING Course Bundle - 13 Courses in 1
53+ Hour of HD Videos
13 Courses
Verifiable Certificate of Completion
Lifetime Access
4.5
Primary Sidebar
Popular Course in this category
MONGODB Course Bundle - 6 Courses in 1
 20+ Hours of HD Videos
6 Courses
Verifiable Certificate of Completion
  Lifetime Access
4.5
Price

View Course
Footer
About Us
  • Blog
  • Who is EDUCBA?
  • Sign Up
  • Live Classes
  • Certificate from Top Institutions
  • Contact Us
  • Verifiable Certificate
  • Reviews
  • Terms and Conditions
  • Privacy Policy
  •  
Apps
  • iPhone & iPad
  • Android
Resources
  • Free Courses
  • Database Management
  • Machine Learning
  • All Tutorials
Certification Courses
  • All Courses
  • Data Science Course - All in One Bundle
  • Machine Learning Course
  • Hadoop Certification Training
  • Cloud Computing Training Course
  • R Programming Course
  • AWS Training Course
  • SAS Training Course

ISO 10004:2018 & ISO 9001:2015 Certified

© 2023 - EDUCBA. ALL RIGHTS RESERVED. THE CERTIFICATION NAMES ARE THE TRADEMARKS OF THEIR RESPECTIVE OWNERS.

Let’s Get Started

By signing up, you agree to our Terms of Use and Privacy Policy.

EDUCBA

*Please provide your correct email id. Login details for this Free course will be emailed to you

EDUCBA
Free Data Science Course

Hadoop, Data Science, Statistics & others

By continuing above step, you agree to our Terms of Use and Privacy Policy.
*Please provide your correct email id. Login details for this Free course will be emailed to you

EDUCBA

*Please provide your correct email id. Login details for this Free course will be emailed to you
EDUCBA

*Please provide your correct email id. Login details for this Free course will be emailed to you
EDUCBA Login

Forgot Password?

By signing up, you agree to our Terms of Use and Privacy Policy.

This website or its third-party tools use cookies, which are necessary to its functioning and required to achieve the purposes illustrated in the cookie policy. By closing this banner, scrolling this page, clicking a link or continuing to browse otherwise, you agree to our Privacy Policy

Loading . . .
Quiz
Question:

Answer:

Quiz Result
Total QuestionsCorrect AnswersWrong AnswersPercentage

Explore 1000+ varieties of Mock tests View more