Diagram
The following diagram illustrates the relationships between a MongoDB
driver or mongosh and each component of Client-Side Field Level Encryption
(CSFLE):
Components
The following sections discuss the individual components of the preceding diagram.
libmongocrypt
libmongocrypt is the Apache-licensed open-source core cryptography
library used by the official MongoDB drivers and mongosh to
power Client-Side Field Level Encryption. Some drivers may require specific integration steps to install
or link the library.
To view steps for installing libmongocrypt,
see the libmongocrypt reference page.
Automatic Encryption Shared Library
The Automatic Encryption Shared Library is a dynamic library that enables your client application to perform automatic encryption.
The Automatic Encryption Shared Library is a preferred alternative to mongocryptd and does
not require you to spawn another process to perform automatic encryption.
Note
Starting in MongoDB 9.0, mongocryptd is deprecated. Use the
Automatic Encryption Shared Library instead.
To learn more about automatic encryption, see CSFLE Features.
mongocryptd
Important
mongocryptd is Deprecated
Starting in MongoDB 9.0, mongocryptd is deprecated. Use the
Automatic Encryption Shared Library instead.
mongocryptd is installed with MongoDB Enterprise
Server.
When you create a CSFLE-enabled MongoDB client, the mongocryptd
process starts automatically by default.
The mongocryptd process:
Uses the specified automatic encryption rules to mark fields in read and write operations for encryption.
Prevents unsupported operations from executing on encrypted fields.
Parses the encryption schema specified for the database connection. Automatic encryption rules use a strict subset of JSON schema syntax. If the rules contain invalid automatic encryption syntax or any
schema validationsyntax,mongocryptdreturns an error.
mongocryptd only performs the previous functions, and doesn't
perform any of the following:
mongocryptddoesn't perform encryption or decryptionmongocryptddoesn't access any encryption key materialmongocryptddoesn't listen over the network
To perform field encryption and automatic decryption, the drivers use the Apache-licensed libmongocrypt library.
The official MongoDB drivers require access to the
mongocryptd process on the client host machine. These
clients search for the mongocryptd process in the system
PATH by default.
Key Vault collection
The Key Vault collection is a standard MongoDB collection that stores all Data Encryption Keys used to encrypt application data. Data Encryption Keys are themselves encrypted using a Customer Master Key (CMK) prior to storage in the Key Vault collection. You can host your Key Vault collection on a different MongoDB cluster than the cluster storing your encrypted application data.
To learn more about the Key Vault collection, see Encryption Keys and Key Vaults.
Key Management System
The Key Management System (KMS) stores the Customer Master Key (CMK) used to encrypt Data Encryption Keys.
To view a list of all KMS providers MongoDB supports, see KMS Providers.
MongoDB Cluster
The MongoDB cluster which stores the encrypted data may also enforce Client-Side Field Level Encryption. For more information on server-side schema enforcement, see CSFLE Server-Side Schema Enforcement.