Encryption Key Management加密键管理

Encryption Components加密组件

MongoDB uses the following components to perform Client-Side Field Level Encryption:MongoDB使用以下组件执行客户端字段级加密：

• Data Encryption Keys (DEK)s
• Customer Master Keys (CMK)s
• Key Vault collections
• Key Management System (KMS)

To learn more about keys and key vaults, see Keys and Key Vaults.若要了解有关钥匙和钥匙库的详细信息，请参阅键和键库。

Supported Key Management Services支持的键管理服务

Client-Side Field Level Encryption supports the following Key Management System providers:客户端字段级加密支持以下键管理系统提供程序：

• Amazon Web Services KMS
• Azure Key Vault
• Google Cloud KMS
• Any KMIP Compliant Key Management System
• Local Key Provider (for testing only)

The default KMIP protocol version is 1.2. You can configure MongoDB to use KMIP version 1.0 or 1.1 in the MongoDB server configuration file.默认的KMIP协议版本是1.2。您可以在MongoDB服务器配置文件中将MongoDB配置为使用KMIP 1.0或1.1版本。

To learn more about these providers, including diagrams that show how your application uses them to perform Client-Side Field Level Encryption, see CSFLE KMS Providers.要了解有关这些提供程序的更多信息，包括显示应用程序如何使用它们执行客户端字段级加密的图表，请参阅CSFLE KMS提供程序。

Manage a Data Encryption Key's Alternate Name管理数据加密键的备用名称

You can assign a Data Encryption Key alternate names to make the key easier to reference. 您可以为数据加密键分配备用名称，以使键更易于引用。Assigning alternate names allows you to perform the following actions:指定备用名称可以执行以下操作：

• Reference a DEK by different means than the _id field.通过与_id字段不同的方式引用DEK。
• Dynamically assign DEKs at runtime.在运行时动态分配DEK。

const encryption = new ClientEncryption(client, {
  keyVaultNamespace,
  kmsProviders,
});
const masterKey = {
  "<Your dataKeyOpts Key>": "<Your dataKeyOpts Value>",
};
const key = await encryption.createDataKey(provider, {
  masterKey: masterKey,
  keyAltNames: ["<Your Key Alt Name>"],
});

{
  "<database>.<collection>": {
    "bsonType": "object",
    "properties": {
      "salary": {
        "encrypt": {
          "bsonType": "int",
          "keyId": "/fieldWithAltName",
          "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
        }
      }
    }
  }
}

{
  "name": "Jon Doe",
  "salary": 45000,
  "fieldWithAltName": "my-alt-name"
}

{
    "name": "Jon Doe",
    "salary": 45000,
    "fieldWithAltName": "my-alt-name"
},
{
    "name": "Jane Smith",
    "salary": 70000,
    "fieldWithAltName": "my-other-alt-name"
}

Procedure: Rotate Encryption Keys Using Mongo Shell步骤：使用Mongo Shell旋转加密键

With version 1.5 and later of the Mongo Shell, you can rotate encryption keys using the rewrapManyDataKey method. 使用1.5版及更高版本的MongoShell，可以使用rewriteManyDataKey方法旋转加密键。The rewrapManyDataKey method automatically decrypts multiple data keys and re-encrypts them using a specified Customer Master Key. It then updates the rotated keys in the key vault collection. rewriteManyDataKey方法会自动解密多个数据键，并使用指定的客户主键对其进行重新加密。然后，它会更新键库集合中旋转的键。This method allows you to rotate encryption keys based on two optional arguments:此方法允许您基于两个可选参数旋转加密键：

• A filter used to specify which keys to rotate. If no data key matches the given filter, no keys are rotated. Omit the filter to rotate all keys in your key vault collection.用于指定要旋转的关键点的筛选器。如果没有与给定筛选器匹配的数据键，则不会旋转任何键。省略筛选器以旋转键保管库集合中的所有键。
• An object that represents a new CMK. Omit this object to rotate the data keys using their current CMKs.表示新CMK的对象。省略此对象可使用数据键的当前CMK旋转数据键。

The rewrapManyDataKey uses the following syntax:rewriteManyDataKey使用以下语法：

keyVault = db.getKeyVault()

keyVault.rewrapManyDataKey(
   {
      "<Your custom filter>"
   },
   {
      provider: "<KMS provider>",
      masterKey: {
         "<dataKeyOpts Key>" : "<dataKeyOpts Value>"
      }
   }
)

To learn more about the dataKeyOpts object for your KMS provider, see Supported Key Management Services.要了解有关KMS提供程序的dataKeyOpts对象的更多信息，请参阅支持的键管理服务。

Delete a Data Encryption Key删除数据加密键

You can delete a Data Encryption Key from your Key Vault collection using standard CRUD delete operations. If you delete a DEK, all fields encrypted with that DEK become permanently unreadable.您可以使用标准CRUD删除操作从键保管库集合中删除数据加密键。如果删除一个DEK，则使用该DEK加密的所有字段都将永久不可读。

keyVault = db.getKeyVault()
keyVault.deleteKey(UUID("<UUID String>"))

Learn More了解更多信息

For tutorials detailing how to set up a CSFLE-enabled application with each of the supported KMS providers, see the following pages:有关详细说明如何使用每个受支持的KMS提供程序设置启用CSFLE的应用程序的教程，请参阅以下页面：

• Use Automatic Client-Side Field Level Encryption with AWS使用AWS自动客户端字段级加密
• Use Automatic Client-Side Field Level Encryption with Azure使用Azure的自动客户端字段级加密
• Use Automatic Client-Side Field Level Encryption with GCP在GCP中使用自动客户端字段级加密
• Use Automatic Client-Side Field Level Encryption with KMIP使用KMIP的自动客户端字段级加密

To view additional examples of encryption schemas, see 要查看加密模式的其他示例，请参阅CSFLE Encryption Schemas.CSFLE加密架构。