Page History

...

1. Initiating message is sent by discovery. 
   1. Initiating message should contain: 
      1. New master key hash. 
      2. New master key id.
   2. When server node processed message following actions are executed: 
      1. It obtain hash of new master key.
      2. Compares it with the one in message
      3. If it differs then error added to the message.
2. If on step1 there are some errors we log it and cancel process. Otherwise got to step3.
3. Action message is sent by discovery.
   1. Action message sould contain:
      1. New master key hash. 
      2. New master key id.
   2. When server node processed message following actions are executed: 
      1. Blocks creation of encrypted cache key. 
      2. Encrypt cache group keys with new master key. 
      3. Unblock creation of encrypted cache key. 
      4. EncryptionSPI executes keys rotation (implementation specific).

Atomic keys rotation should be done in the following way:

1. Reencrypt all cache group keys with new master key in a temporary datastructure.
   No changes in MetaStore.
2. Create WAL logical record (MasterKeyChangeRecord) that consist of:
   1. New master key hash
   2. Reenctyped cache group keys.
3. Write cache group keys to MetaStore.

Node recovery:

1. If during node recovery with logical records we found MasterKeyChangeRecord it passed to EncryptionManager.
2. When MetaStore becomes available for write, EncryptionManager writes new cache group keys to it.

Process completion: 

Process completes when all nodes in cluster will process action message.

...