Mongodb Encryption And Data Protection Complete Guide

Step 1: Set Up Your MongoDB Environment

Before diving into encryption, ensure you have MongoDB installed on your system. You can use either a local MongoDB instance or a managed service like MongoDB Atlas.

Local MongoDB Installation

1. Download and Install MongoDB:

   # For Ubuntu/Debian
   wget -qO - https://www.mongodb.org/static/pgp/server-6.0.asc | sudo apt-key add -
   echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/6.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list
   sudo apt-get update
   sudo apt-get install -y mongodb-org
   

2. Start the MongoDB Service:

   sudo systemctl start mongod
   sudo systemctl enable mongod
   

Using MongoDB Atlas

1. Create an Account:

   • Go to MongoDB Atlas and sign up for an account.

2. Deploy a Cluster:

   • Follow the guided setup to create a new cluster.
   • Configure the cluster with security options as needed (e.g., encryption at rest).

3. Set Up Network Access:

   • White-list your IP addresses to allow connections to the cluster.

4. Configure Database Users:

   • Create users and assign them appropriate roles.

5. Connect to Your Cluster:

   • Use the connection string provided by MongoDB Atlas to connect from your application.

Step 2: Encrypting Data at Rest

MongoDB Enterprise edition supports transparent encryption of data at rest using the WiredTiger storage engine.

Prerequisites:

1. MongoDB Enterprise Edition:

   • Ensure you installed MongoDB Enterprise and not the community edition.

2. PEM Key File:

   • Generate a PEM key file that will be used for encryption.

   openssl rand -base64 741 > master-key.txt
   cat master-key.txt | tr -d '\n' > master-key.pem
   

Configuration:

1. Edit the MongoDB Configuration File:

   • Open the mongod.conf file typically located in /etc/mongod.conf.

2. Add the Security Configuration:

   security:
     enableEncryption: true
     encryptionKeyFile: /path/to/master-key.pem
   

3. Restart the MongoDB Service:

   sudo systemctl restart mongod
   

4. Verify Encryption Status:

   mongo --host localhost --port 27017
   db.runCommand({ getCmdLineOpts: 1 })
   

   Look for the enableEncryption parameter in the output.

Example:

Assuming MongoDB Enterprise is already installed, perform the following steps to enable encryption at rest.

1. Generate PEM Key File:

   • Generate a PEM key file.

   openssl rand -base64 741 > master-key.txt
   cat master-key.txt | tr -d '\n' > master-key.pem
   

2. Edit Configuration File (mongod.conf):

   • Add the necessary security configurations.

   storage:
     wiredTiger:
       engineConfig:
         cacheSizeGB: 1
   
   security:
     encryptionKeyFile: /etc/security/master-key.pem
   

3. Place PEM Key File in Correct Location:

   • Ensure the master-key.pem file is copied to /etc/security/ (or wherever specified in encryptionKeyFile).

4. Set File Permissions:

   • The key file must only be readable by the mongod process.

   sudo chmod 600 /etc/security/master-key.pem
   sudo chown mongod:mongod /etc/security/master-key.pem
   

5. Restart MongoDB:

   • Apply changes.

   sudo systemctl restart mongod
   

6. Check Encryption Status:

   • Connect to the MongoDB shell.

   mongo --host localhost --port 27017
   db.runCommand({ getCmdLineOpts: 1 })
   

   Look for enableEncryption: true.

Step 3: Encrypting Data in Transit

To secure data transmission between MongoDB clients and servers, use SSL/TLS certificates.

Prerequisites:

1. SSL Certificates:

   • Obtain or generate SSL certificates. You can use self-signed certificates for testing.

   openssl req -newkey rsa:2048 -new -x509 -days 365 -nodes -out mongodb-cert.crt -keyout mongodb-cert.key
   

2. Combine Certificate and Key:

   • Combine the certificate and key into a single .pem file.

   cat mongodb-cert.key mongodb-cert.crt > mongodb-cert.pem
   

Configuration:

1. Edit the MongoDB Configuration File (mongod.conf):

   • Add the SSL configuration.

   net:
     ssl:
       mode: requireSSL
       PEMKeyFile: /etc/ssl/mongodb-cert.pem
   

2. Restart the MongoDB Service:

   sudo systemctl restart mongod
   

3. Connect to MongoDB with SSL:

   mongo --ssl --host localhost --sslCAFile /etc/ssl/mongod-cert.pem --sslAllowInvalidCertificates
   

   Note: The --sslAllowInvalidCertificates flag is used for testing purposes with self-signed certificates. Remove it for production.

Step 4: Field Level Encryption (FLE)

Field Level Encryption (FLE) is an advanced feature available in MongoDB Enterprise Server that encrypts specific fields within documents.

Prerequisites:

1. MongoDB KMS Providers:

   • Choose a KMS provider (AWS, Azure, GCP, KMIP, or local).
   • Set up the necessary credentials and configuration for your KMS provider.

2. Crypt Library:

   • Ensure the appropriate crypt shared library is installed. For example, for AWS:

   curl "https://s3.amazonaws.com/mongodb-crypt-gpg/libgpgme-deb10-20230228-ubuntu1804-0.1.0.tar.gz" --output libgpgme-deb10-20230228-ubuntu1804-0.1.0.tar.gz
   tar xvfz libgpgme-deb10-20230228-ubuntu1804-0.1.0.tar.gz
   cd libgpgme-deb10-20230228-ubuntu1804-0.1.0/ 
   sudo service mongod stop
   sudo ./install_crypt_shared.sh
   sudo service mongod start
   

Example Setup (Using Local KMS Provider):

1. Create a Key Management System (KMS) Configuration File:

   Save the following content to kms.json.

   {
      "local": {
         "key": "6e37c97709cc72f208094623698e3149e1a88cddc5bdc8ac4ef386c718084617"
      }
   }
   

2. Set Up the MongoDB Crypt Daemon:

   mongocryptd --idleShutdownTimeoutSecs 3600
   

3. Create Client-Side Field Level Encryption Settings:

   const { MongoClient, AutoEncryptionLoggerLevel } = require('mongodb');
   const fs = require('fs');
   
   const client = new MongoClient('mongodb://localhost:27017', {
      autoEncryption: {
         keyVaultNamespace: 'encryption.__dataKeys',
         kmsProviders: {
            local: {
               key: fs.readFileSync('/path/to/kms-plain-data-key-local.txt')
            }
         },
         schemaMap: {
            'people.users': JSON.parse(fs.readFileSync('/path/to/schema.json'))
         },
         logger: { level: AutoEncryptionLoggerLevel.DEBUG }
      }
   });
   

4. Create a Schema Map Definition:

   {
      "bsonType": "object",
      "encryptMetadata": {
         "keyId": "/path/to/generated/key-id.binary"
      },
      "properties": {
         "ssn": {
            "encrypt": {
               "bsonType": "string",
               "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
            }
         },
         "creditCard": {
            "encrypt": {
               "bsonType": "string",
               "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
            }
         }
      }
   }
   

5. Connect to MongoDB and Insert an Encrypted Document:

   async function run() {
      try {
         await client.connect();
         const db = client.db("people");
         const usersColl = db.collection("users");
   
         // Insert a Document
         await usersColl.insertOne({
            firstName: "John",
            lastName: "Doe",
            ssn: "123-45-6789",
            creditCard: "4111-1111-1111-1111"
         });
   
         const user = await usersColl.findOne({});
         console.log(user);
      } finally {
         await client.close();
      }
   }
   
   run().catch(console.dir);
   

6. Decrypt and View Documents:

   • When retrieving the document, the driver automatically decrypts the fields based on schemas.
   • The fields ssn and creditCard should be decrypted if you configured correctly.

Important Considerations:

• Key Management: Securely manage the keys used for encryption.
• Performance: FLE can introduce latency due to encryption and decryption operations. Monitor performance.
• Backup: Ensure backups of encryption keys and configuration files are properly secured.

By following these steps, you can effectively implement encryption at rest and in transit, as well as field-level encryption, to protect sensitive data in MongoDB.

Conclusion