MongoDB Deep Dive
WELCOME
What is MongoDB ?
Non Relational�> Alternative to traditional RDBMS as workload and data volume needs change
Document Oriented Database�> Simple human readable JSON Data model
Dynamic Schemas�> Flexible schemas, agile development, developer friendly
Built-in Replication for High Availability�> Provides data redundancy; automatically recovers from node failures
Built-in Sharding for Horizontal Scalability�> Auto partition; supports very large data sets and high throughput operations
High Performance�> 5X – 10X times faster than traditional RDMBS
MongoDB ( Hu’mongo’us ) is a scalable, high-performance, open-source, document oriented Database. Written in C++
About Queryable Encryption
Queryable Encryption is the next generation of in-use encryption technology that allows querying on a fully randomly encrypted data
Moving and storing data: most databases have it covered
In-flight, over the network
TLS Encryption
Data is decrypted when it's received on the DB server
Reminder: TLS is to protect against network eavesdropping
Moving and storing data: most databases have it covered
At-rest, on disk
Volume Encryption
Storage Engine Encryption
Network
Data is decrypted when the DB starts up
Reminder: At-rest encryption is (mostly) to protect non-running databases & backups
But what about data here?
Network
Disk
In-use, in memory
Very few practical solutions exist to protect data in-use
Data is in plaintext while its being processed by the database
Data is vulnerable to insider access and active database breaches:
In-use, in memory
This is why we built Client-Side Field Level Encryption!
Option#1 – No encryption of data from client side
Query to find ssn = “901-10-4312”
{payer: “Acme Corp”, ssn: “901-10-4312”}
{payer: “Jones Inc”, ssn: “901-10-4312”}
…
{payer: “Baker Co”, ssn: “901-10-4312”}
1 million records total
10 records with ssn = “901-10-4312”
10 records fetched with ssn = “901-10-4312”
Option#2 – Using popular cloud SDK client-side encryption
Query to ssn = “901-10-4312”
{payer: “Acme Corp”, ssn: “901-10-4312”}
{payer: “Jones Inc”, ssn: “901-10-4312”}
…
{payer: “Baker Co”, ssn: “901-10-4312”}
1 million records total
10 records with ssn: “901-10-4312”
{payer: “Acme Corp”, ssn: “3DwK354xz”}
{payer: “Jones Inc”, ssn: “23awW124xz”}
…
{payer: “Baker Co”, ssn: “75fdwswed”}
1 million records total
10 Randomly encrypted field
10 records fetched with ssn = “901-10-4312”
All 1 million records fetched
Problem: You can't actually directly search encrypted fields. Not feasible for many use cases.
Queryable Encryption
Query to find ssn = “901-10-4312”
{payer: “Acme Corp”, ssn: “3DwK354xz”}
{payer: “Jones Inc”, ssn “23awW124xz”}
…
{payer: “Baker Co”, ssn: “75fdwswed”}
1 million records total
10 Randomly encrypted fields
10 records fetched with ssn = “901-10-4312”
An Industry First: Queryable Encryption
"Jones Glee",
"r6EaUcgZ41Gerrwd”,
"iu233oh35sdso743",
"oR72CW4WferrSE3j",
"d76b3ad038c0e0ed"
payer:
cardNum:
email: �phone:
ssn:
Query from an authenticated client
MongoDB
Driver
1
ssn: "901-10-4312"
db.billing.find (
{
}
6
2
Encrypted fields are always stored, transmitted, processed, and retrieved as ciphertext, including queries
payer:
cardNum:
email: �phone:
ssn:
{
{
5
3
Customer Provisioned
Key Provider
Cloud Provider KMS,
On-prem HSM/Key Service,
Cross-cloud KMS
4
ssn encrypted search key: "d76b3ad038c0e0ed"
"er493grtee4erw"
"f72a9a1103d88b6"
Customer Environment
MongoDB Data Platform
Queryable Encryption – Key Benefits
Rich querying capabilities on encrypted data
Run expressive queries like range, equality, prefix, suffix, substring, and more on encrypted data
Ground breaking technology, standards based cryptography
Based on strong, standards-based cryptographic primitives
End-to-end fully randomized encryption
Data never exists in the clear outside of the client
Dramatically reduces attack surface
Faster application development
No crypto experience required
Intuitive and easy for developers to set up and use
Strong technical controls for critical data privacy use cases
Meet the strictest data privacy requirements for confidentiality and integrity �(HIPAA, GDPR, CCPA)
Reduce institutional risk
Confident in storing and processing your sensitive workloads in MongoDB Atlas (Cloud)
Queryable Encryption Use Cases
DEMO TIME
1) MongoDB is a _________________ Database ?
A) Graph
B) Key value
C) Document
D) All of the above
1) MongoDB is a _________________ Database ?
A) Graph
B) Key value
C) Document
D) All of the above
2) Which feature of MongoDB ensures the high availability maintenance in the case of server failures ?
2) Which feature of MongoDB ensures the high availability maintenance in the case of server failures ?
3) Which of the following are compression algorithms available for WiredTiger in MongoDB 4.0? Select all that applicable .
3) Which of the following are compression algorithms available for WiredTiger in MongoDB 4.0? Select all that applicable .
4) What is the URL to access MongoDB Atlas .
4) What is the URL to access MongoDB Atlas .
5) A collection and a document in MongoDB is equivalent to............. Concepts (RDBMS) respectively.
A. Table and Column
B. Table and Row
C. Column and Row
D. Database and Table
5) A collection and a document in MongoDB is equivalent to............. Concepts (RDBMS) respectively.
A. Table and Column
B. Table and Row
C. Column and Row
D. Database and Table
APPENDIX