The decryption operations are expected to be handled by the external key provider, like HSM. Encryption operations using the public key of the main encryption key can be performed inside the controller itself, or, the controller can distribute the public key to Hadoop KMS so that Hadoop KMS can perform encryption locally.However, the private key is not needed inside the controldb and SQL Server Big Data Clusters will not require the private key material.

For encryption keys from a Hardware Security Module (HSM) or any other external provider, the private keys are not stored inside the controller database (unless the application for external keys brings the private key with it). The private key is stored in the controller database for system managed main encryption key.

The public key corresponding to the main encryption key is always stored in the controller database or controldb.

A main encryption key is created for SQL Server master instance and another for HDFS.

The main encryption keys are asymmetric RSA keys.

The properties of main encryption key are: This concept allows SQL Server Big Data Clusters control plane to allow the main encryption key to reside outside the cluster as well. There are two main encryption keys, one for SQL Server and one for HDFS. In SQL Server Big Data Clusters control plane, to protect the Encryption zone keys and to provision asymmetric keys in SQL Server, there is a concept of the main encryption key. SQL Server Big Data Clusters main encryption key SQL Server stores the public key, but only to identify the asymmetric key and doesn't encrypt using the public key.

Hence all the encryption and decryption operations of the Database Encryption Key (DEK) are done inside the controller. The asymmetric key in SQL Server has metadata containing a URL link to the key inside the control plane. To change the DEK protector use ALTER DATABSE ENCRYPTION KEY statement. The DEK protector can be a certificate or asymmetric key. The DEK is persisted with the database in an encrypted format. SQL Server databases are encrypted by a symmetric key, also known as a Database encryption key (DEK). For more information, see Resources deployed with Big Data Cluster. The system managed main encryption key and the HDFS EZ keys are stored inside the controldb, which will be named controldb-, for example controldb-0. The below graphic explains how files are protected by the DEK and how the DEK is protected by the EZ key securelakekey. The DEK is randomly generated per file and the strength of the symmetric DEK is the same as the strength of the EZ Key. To persist the DEK, it is first Encrypted by the Encryption Zone Key and then persisted with data. Once the DEK is created, it is persisted with the data. Encrypted Data Encryption Key: Every file in Encryption zone is encrypted by a Data Encryption Key (DEK) generated for the file.The EZ keys are encrypted in Hadoop KMS by fetching the public part of main encryption key and the decryption requests are sent to the control plane. The EZ keys are further protected by a main encryption key stored in controldb (discussed in sections below). The encryption zone keys are managed using Hadoop KMS (Key Management Server) running inside the name node pods of SQL Server Big Data Clusters. The default system-managed provisioned in SQL Server Big Data Clusters is 'securelakekey'. Encryption Zone keys (EZ Key): A named symmetric key.Default provisioned EZ in SQL Server Big Data Clusters is called 'securelake'. Encryption zones (EZ): The encryption zone is a folder in HDFS that is associated with a key.SQL Server Big Data Clusters transparent data encryption (TDE) at rest usage guideДЇor using encryption at rest in HDFS, the following concepts are involved:.SQL Server Big Data Clusters HDFS Encryption Zones usage guide.Encryption at rest concepts and configuration guide.The article includes details about how the versions can incorporate customer's keys.ДЇor general information on securing SQL Server Big Data Clusters, see Security concepts for SQL Server Big Data Clusters.ДЇor information on configuring and using the encryption at rest feature see the following guides: This article provides details of how key versions are used in SQL Server Big Data Clusters for key management and key rotation for HDFS and SQL Server keys. For more information, see Big data options on the Microsoft SQL Server platform. Support for SQL Server 2019 Big Data Clusters will end on February 28, 2025. The Microsoft SQL Server 2019 Big Data Clusters add-on will be retired.

Ez clusters