Support Features to Optimize System Security

[scsldb]

Description

P0 Task List:

Authentication

• [x] Support Transport Layer Security(TLS) for TiFlash https://github.com/pingcap/tidb/issues/18080 @lidezhu
• [x] Support TLS in the internal communication of TiDB cluster https://github.com/pingcap/tiup/issues/529 @AstroProfundis

Transparent Data Encryption(TDE)

• [x] Support Transparent Data Encryption(TDE) for TiFlash https://github.com/pingcap/tidb/issues/18082 @lidezhu
• [x] Support Transparent Data Encryption(TDE) for PD https://github.com/pingcap/tidb/issues/18262 @yiwu-arbug

Data Mask and De-Identification

• [x] Support De-Sensitization TiDB General Log https://github.com/pingcap/tidb/issues/18034 @lysu
• [x] Support error/info log desensitization https://github.com/pingcap/tidb/issues/18566 @crazycs520

P1 Task List:

Authentication

• [x] Supports TLS and online reload with new certs in CDC https://github.com/pingcap/ticdc/issues/250
• [x] Support TLS and online reload with new certs in DM https://github.com/pingcap/dm/issues/467
• [ ] Support Security for TiSpark on Reading TiKV and TiFlash https://github.com/pingcap/tidb/issues/18087
• [x] Support Authentication and Privileges for TiSpark https://github.com/pingcap/tidb/issues/18081

Data Mask and De-Identification

• [ ] Support Data Mask and De-Identification like MySQL https://github.com/pingcap/tidb/issues/18083

For more details task: https://docs.google.com/document/d/1fMj6rCGrK_Gr4WeMJmBNGfPoZKG-dtVsq1VfWIHf558/edit#heading=h.r8aswyjagfkz

Category

Feature, Security

Value

Improve system security

Schedule

GanttStart: 2020-07-04 GanttDue: 2020-11-28 GanttProgress: 30%

Progress Tracking

• TiDB v5.0 Project Management Weekly Report - Security features Imporve

[kolbe]

Can we add "Support De-Sensitization TiDB Error Log" to the "Mask" section?

One implementation idea for that might be to avoid printing prepared statement arguments in the error log.

https://github.com/pingcap/tidb/issues/18566

[nolouch]

@kolbe I have added it, I think the implementation idea you mentioned already done in https://github.com/pingcap/tidb/pull/18578. am I right?