Data encryption overview

OceanBase Database provides multi-level data encryption capabilities to protect data security at different stages. Based on the location and stage of encryption, OceanBase Database supports the following data encryption methods:

Data transmission encryption

Data transmission encryption protects data transmitted between the client and database server, as well as between server nodes. OceanBase Database implements data transmission encryption using the SSL/TLS protocol, relying on the certificate system provided by OpenSSL or a third-party SSL library.

Transparent data encryption (TDE)

Transparent data encryption (TDE) protects data stored on disk. Once TDE is enabled, data is automatically encrypted before being written to disk and automatically decrypted when read, with the process transparent to the user. TDE uses a two-tier key system, where the tenant master key is used to protect the data key.

Column encryption

Column encryption protects sensitive data in query results. By creating sensitive rules to specify the columns to be protected, the system determines whether to return plaintext or ciphertext based on the encryption rules when users query these columns. Column encryption shares the tenant master key with TDE.

Function encryption

Function encryption protects sensitive function data. By calling the ENHANCED_AES_ENCRYPT and ENHANCED_AES_DECRYPT encryption and decryption functions, you can perform AES encryption and decryption on data. Function encryption shares the tenant master key with TDE.

Tenant master key

The tenant master key serves as the encryption infrastructure for both TDE and column encryption. Before using these features, you need to generate the tenant master key.

For more information, see Manage tenant master keys.