FDB native Encryption data at-rest

(Disclaimer: This post is intentionally kept terse and doesn’t discuss the detailed design. My intention is to keep the community aware of upcoming feature additions to the FDB. Please ask questions as needed)

At Snowflake we are currently working on the FDB native Encryption data at-rest feature. With this post I want to share the feature details with the broader community incase it is useful for others and they want to start preparatory work to utilize the feature (or want to participate in early testing as soon as the feature is code-complete in the main branch)

Status Quo

FoundationDB being a multi-model, easily scalable and fault-tolerant, with an ability to provide great performance even with commodity hardware, plays a critical role enabling enterprises to deploy, manage and run mission critical applications. Data-at-rest encryption support is considered a table-stake feature for any modern enterprise service offering.

FDB currently does not support data-at-rest encryption semantics; a customer needs to implement application level encryption schemes to protect their data/metadata stored in FDB. Given the criticality of the feature, it seems highly desirable to implement FDB native data-at-rest encryption support adhering to the latest security standards.

Goals

  • Implement end-user transparent, FDB native data-at-rest encryption support.
  • Isolation guarantees: the encryption domain matches the “tenant” partition semantics supported by a FDB cluster. For details on “tenant” concepts refer to documentation
  • KMS integration: Ease of integration with external Key Management Service/Solutions.

Refer to Encryption data at rest wiki for more details.