Overview

OceanBase Database provides multi-layered data encryption capabilities to protect data security at different stages. Based on the location and stage of encryption, OceanBase Database supports the following data encryption methods:

Data Transmission Encryption

Data transmission encryption is used to protect data transmitted between the client and database server, as well as between server nodes. OceanBase Database implements data transmission encryption using the SSL/TLS protocol, relying on the certificate system provided by OpenSSL or a third-party SSL library.

Transparent Data Encryption (TDE)

Transparent Data Encryption (TDE) is used to protect data stored on disk. Once TDE is enabled, data is automatically encrypted before being written to disk and automatically decrypted when read, with the process transparent to the user. TDE uses a two-tier key system, where the tenant master key is used to protect the data key.

Column Encryption

Column encryption is used to protect sensitive data in query results. By creating sensitive rules, you can specify which columns need protection. When users query these columns, the system decides whether to return plaintext or ciphertext based on the encryption rules. Column encryption shares the tenant master key with TDE.

Function Encryption

Function encryption is used to protect sensitive function data. By calling the ENHANCED_AES_ENCRYPT and ENHANCED_AES_DECRYPT encryption and decryption functions, you can perform AES encryption/decryption on data. Function encryption shares the tenant master key with TDE.

Tenant Master Key

The tenant master key is shared by the TDE and column encryption features as the encryption infrastructure. Before using these features, you need to generate the tenant master key.

For more information, see Manage Tenant Master Keys.