Encryption¶
This page introduces the two independent encryption types in KX Sensors: on-disk IDB/HDB encryption and in-transit TLS encryption.
KX Sensors supports two types of encryption, on-disk encryption and data-in-transit (TLS) encryption. The two types operate independently of each other, and you can choose to use one or the other, both, or neither.
| On-disk | In-transit (TLS) | |
|---|---|---|
| Data Type | On-disk HDB and IDB data only (RDB data is not eligible for encryption) | Data in-transit between the server and external clients |
| Technology/Prerequisites | OpenSSL | TLS (Transport Layer Security) |
| Maintenance Console Operational Commands | A suite of commands allowing you to view the encryption state of your database, generate/import encryption keys, change the password of encryption keys, and delete encryption keys | N/A |
| Enabled in: | systemParams.yaml, hdbTiers.yaml, schema.yaml |
manifest.yaml, kxsenv |
| Applies to: | Historical and intra-day on-disk data, and the symbol file | Service classes such as GW, SDL, MDL, etc. |
| Selective Support | Individual tables, individual table columns, individual table categories, individual database tiers, and any combination of HDB/IDB/symbol file. | N/A |
| Encryption occurs when: | Write-down of data at EOI and EOD | Dynamically during data ingestion and query processing |
EOI and EOD write-down of on-disk data¶
Encryption occurs during write-down at EOI and EOD. After encryption is enabled, unencrypted HDB partitions are encrypted during database migration (DBM) that occurs after EOD.
In the following example, EOD is 12 midnight. EOI is hourly. Encryption is activated at 3:00 pm.
| Partition Number | Time | Event | IDB Encryption Status | HDB Encryption Status |
|---|---|---|---|---|
| 1 | 1:00 am | Ingestion | O | O |
| 2 | 2:00 am | O | O | |
| . . . | . . . | . . . | . . . | |
| 12 | 12:00 noon | O | O | |
| 13 | 1:00 pm | O | O | |
| 14 | 2:00 pm | O | O | |
| 15 | 3:00 pm | Encryption activated in systemParams.yaml |
O | O |
| 16 | 4:00 pm | P | O | |
| 17 | 5:00 pm | P | O | |
| 18 | 6:00 pm | P | O | |
| 19 | 7:00 pm | P | O | |
| 20 | 8:00 pm | P | O | |
| 21 | 9:00 pm | P | O | |
| 22 | 10:00 pm | P | O | |
| 23 | 11:00 pm | P | O | |
| 24 | 12:00 am | P | O | |
| EOD | EOD | EOD | EOD | EOD |
| Post EOD 1 | New HDB partitions encrypted DBM stages migrated encrypted partitions | P | Mixed | |
| Post EOD 2 | Encrypted partitions joined to HDB | P | P |