apache / apache/lucene

Directory based approach for index encryption [LUCENE-9379]

Open
#10,419 25 comments 0 reactions 1 assignee Claimed by @bruno-roustant View on GitHub
legacy-jira-priority:Major type:enhancement
Dominant language
Java
Stars
3.6k
Forks
1.4k
Avg merge
2d 11h
Merged PRs (30d)
88

Description

Important: This Lucene Directory wrapper approach is to be considered only if an OS level encryption is not possible. OS level encryption better fits Lucene usage of OS cache, and thus is more performant.
But there are some use-case where OS level encryption is not possible. This Jira issue was created to address those.

____________________________________________

 

The goal is to provide optional encryption of the index, with a scope limited to an encryptable Lucene Directory wrapper.

Encryption is at rest on disk, not in memory.

This simple approach should fit any Codec as it would be orthogonal, without modifying APIs as much as possible.

Use a standard encryption method. Limit perf/memory impact as much as possible.

Determine how callers provide encryption keys. They must not be stored on disk.

---
Migrated from [LUCENE-9379](https://issues.apache.org/jira/browse/LUCENE-9379) by Bruno Roustant (@bruno-roustant), 3 votes, updated Jun 03 2021
Linked issues:
- #3304
- #8023

Pull requests: https://github.com/apache/lucene-solr/pull/1608

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.