Note
For V2.2.50, this parameter is available starting with V2.2.50.
Description
The tde_method parameter specifies the method for transparent tablespace encryption.
Privilege requirements
Query the parameter
The
systenant and all user tenants can query the value of this parameter by using theSHOW PARAMETERSstatement or theGV$OB_PARAMETERSview.Modify the parameter
The
systenant and user tenants can use theALTER SYSTEM SETstatement to modify the value of this parameter in a user tenant.
Attributes
| Attribute | Description |
|---|---|
| Parameter type | String |
| Default value | none |
| Value range |
|
| Modifiable | Yes. You can use the ALTER SYSTEM SET statement to modify the parameter. |
| Effective upon OBServer node restart | No. The setting takes effect immediately. |
Considerations
tde_method is a prerequisite parameter for data encryption. Different encryption features have different requirements on the value of tde_method:
| Encryption feature | Supported value of tde_method |
Description |
|---|---|---|
| Transparent data encryption (TDE) | A value other than none. For OBCloud deployments, we recommend that you set the value to obcloud. For OCP deployments, we recommend that you set the value to ocp. |
For more information, see Transparent data encryption. |
| Column encryption | A value other than none. For OBCloud deployments, we recommend that you set the value to obcloud. For OCP deployments, we recommend that you set the value to ocp. |
For more information, see Column encryption. |
| Function encryption | A value other than none. For OBCloud deployments, we recommend that you set the value to obcloud. For OCP deployments, we recommend that you set the value to ocp. |
For more information, see ENHANCED_AES_ENCRYPT. |
obcloud mode
The obcloud option is applicable to OBCloud deployments. The primary key is managed by the OceanBase Cloud KMS service.
To use this option, perform the following steps:
Enable encryption: Use the
obcloudKMS proxy service to manage the primary key.ALTER SYSTEM SET tde_method = 'obcloud';Configure the parameters: Configure the required parameters for the KMS proxy service in the
external_kms_infoparameter.kms_host: the endpoint of the OceanBase Cloud KMS service.access_key_id: the AccessKey ID for signature authentication.access_key_secret: the AccessKey secret for signature authentication.cmk_id: the ID of the user primary key.
For more information about the TDE service of OceanBase Cloud, see Transparent data encryption of OceanBase Cloud. For information about the KMS keys of cloud service providers, see Grant permissions to the cloud service provider account.
ocp mode
Note
This option is available starting with V4.6.0.
The ocp option is applicable to OCP deployments. The primary key is managed by the OCP KMS proxy service.
To use this option, perform the following steps:
Enable encryption: Use the
ocpKMS proxy service to manage the primary key.ALTER SYSTEM SET tde_method = 'ocp';Configure the parameters: Configure the required parameters for the KMS proxy service in the
external_kms_infoparameter.kms_host: the endpoint of the OCP KMS service.access_key_id: the AccessKey ID for signature authentication.access_key_secret: the AccessKey secret for signature authentication.cmk_id: the ID of the user primary key.
Examples
Set the transparent tablespace encryption method to internal.
obclient> ALTER SYSTEM SET tde_method= 'internal';
Set the transparent tablespace encryption method to obcloud.
obclient> ALTER SYSTEM SET tde_method= 'obcloud';
Set the transparent tablespace encryption method to ocp.
obclient> ALTER SYSTEM SET tde_method= 'ocp';
References
- For more information about transparent encryption, see Transparent encryption.
- For more information about column encryption, see Overview of column encryption.
- For more information about the AES encryption and decryption functions, see ENHANCED_AES_ENCRYPT and ENHANCED_AES_DECRYPT.
