tde_method

Description

tde_method specifies the method for transparent tablespace encryption.

Privilege requirements

• Query the parameter

  The sys tenant and all user tenants can query the value of this parameter by using the SHOW PARAMETERS statement or the GV$OB_PARAMETERS view.

• Modify the parameter

  The sys tenant and user tenants can modify this parameter.

Attributes

Considerations

The column encryption feature is also controlled by the tde_method parameter. For more information about column encryption, see ENHANCED_AES_ENCRYPT and ENHANCED_AES_DECRYPT.

obcloud mode

Starting from V4.3.5 BP2, you can use the obcloud option to enable the transparent encryption service to use a unified KMS proxy service to manage the primary key.

To use this option, perform the following steps:

1. Enable encryption: Use the obcloud option to enable the transparent encryption service to use a unified KMS proxy service to manage the primary key.

   ALTER SYSTEM SET tde_method = 'obcloud';
   

2. Configure the parameters: Specify the required parameters for the KMS proxy service in the external_kms_info parameter.

   • kms_host: the endpoint of the OceanBase Cloud KMS service.
   • access_key_id: the AccessKey ID for signature authentication.
   • access_key_secret: the AccessKey secret for signature authentication.
   • cmk_id: the ID of the user's primary key.

Examples

Set the transparent tablespace encryption method to internal.

obclient> ALTER SYSTEM SET tde_method= 'internal';

Set the transparent tablespace encryption method to obcloud.

obclient> ALTER SYSTEM SET tde_method= 'obcloud';

References

For more information about transparent encryption, see Transparent encryption.