tde_method

Description

The tde_method parameter specifies the method for transparent tablespace encryption.

Privilege requirements

• Query the parameter

  The sys tenant and all user tenants can use the SHOW PARAMETERS statement or the GV$OB_PARAMETERS view to query this parameter.

• Modify the parameter

  Both the sys tenant and user tenants can use the ALTER SYSTEM SET statement to modify this parameter under the user tenant.

Attributes

Considerations

You can use this parameter to enable or disable the following features:

• Column encryption: To enable this feature, set the tde_method parameter to a value other than none. For more information about column encryption, see Overview of column encryption.
• Encryption/decryption through manually calling the AES function: To enable this feature, set the tde_method parameter to a value other than none. For more information about the function, see ENHANCED_AES_ENCRYPT and ENHANCED_AES_DECRYPT.

Use obcloud

The obcloud option specifies that the KMS proxy service of OceanBase Cloud is used for key management in transparent tablespace encryption.

To use obcloud, perform the following steps:

1. Enable encryption: Set the tde_method parameter to obcloud to use the KMS proxy service of OceanBase Cloud.

   ALTER SYSTEM SET tde_method = 'obcloud';
   

2. Configure the external_kms_info parameter: Set the external_kms_info parameter to specify the parameters required for the KMS proxy service.

   • kms_host: the endpoint of the OceanBase Cloud KMS service.
   • access_key_id: the AccessKey ID for signature authentication.
   • access_key_secret: the AccessKey secret for signature authentication.
   • cmk_id: the ID of the customer master key (CMK).

clog encryption

The bkmi and obcloud methods support clog encryption, but you must manually enable clog encryption by setting the enable_clog_encryption parameter.

Examples

Set the transparent tablespace encryption method to internal.

obclient> ALTER SYSTEM SET tde_method= 'internal';

Set the transparent tablespace encryption method to obcloud.

obclient> ALTER SYSTEM SET tde_method= 'obcloud';

References

• For more information about transparent tablespace encryption, see Transparent encryption.
• For more information about column encryption, see Overview of column encryption.
• For more information about encryption and decryption through manually calling the AES function, see ENHANCED_AES_ENCRYPT and ENHANCED_AES_DECRYPT.