Database Manual / Security / Encryption / In-Use Encryption / Queryable Encryption / Fundamentals

Enabling Queryable Encryption when Creating Collections创建集合时启用可查询加密

Overview概述

Enable Queryable Encryption at collection creation. You can't encrypt fields on documents that are already in a collection.在创建集合时启用可查询加密。您无法加密已在集合中的文档上的字段。

Important

Explicitly create your collection, rather than creating it implicitly with an insert operation. When you create a collection using createCollection(), MongoDB creates an index on the encrypted fields. Without this index, queries on encrypted fields may run slowly.显式创建集合，而不是通过插入操作隐式创建。当您使用createCollection()创建集合时，MongoDB会在加密字段上创建索引。如果没有此索引，对加密字段的查询可能会运行缓慢。

Enable Queryable Encryption on a Collection在集合上启用可查询加密

You can enable Queryable Encryption on fields in one of two ways. The following examples use Node.js to enable Queryable Encryption:您可以通过以下两种方式之一在字段上启用可查询加密。以下示例使用Node.js启用可查询加密：

  • Pass the encryption schema, represented by the encryptedFieldsObject constant, to the client that the application uses to create the collection:将加密模式（由encryptedFieldsObject常量表示）传递给应用程序用于创建集合的客户端：

    const client = new MongoClient(uri, {
       autoEncryption: {
          keyVaultNameSpace: "<your keyvault namespace>",
          kmsProviders: "<your kms provider>",
          extraOptions: {
             cryptSharedLibPath: "<path to Automatic Encryption Shared Library>"
          },
          encryptedFieldsMap: {
             "<databaseName.collectionName>": { encryptedFieldsObject }
          }
       }

       ...

       await client.db("<database name>").createEncryptedCollection("<collection name>");
    }

    For more information on autoEncryption configuration options, see the section on MongoClient Options for Queryable Encryption.有关autoEncryption配置选项的更多信息，请参阅可查询加密的MongoClient选项一节。

  • Pass the encryption schema encryptedFieldsObject to createEncryptedCollection():将加密模式encryptedFieldsObject传递给createEncryptedCollection()：

    await encryptedDB.createEncryptedCollection("<collection name>", {
       encryptedFields: encryptedFieldsObject
    });

    Tip

    Specify the encryptedFieldsObject when you create the collection, and also when you create a client to access the collection. 创建集合时以及创建访问集合的客户端时，请指定encryptedFieldsObject。For more information about the security considerations of not defining the encryptedFieldsObject, see Security Considerations.有关不定义encryptedFieldsObject的安全注意事项的更多信息，请参阅安全注意事项。