Generate a tenant master key (MySQL mode)

This topic describes how to generate a tenant master key in a MySQL mode tenant. After the tenant master key is generated, you can use the transparent data encryption (TDE), column encryption, and function encryption features.

Prerequisites

• You have created a MySQL mode tenant.
• You have logged in to the tenant as the administrator.

Generate a tenant master key

Before you generate a tenant master key, make sure that the following conditions are met:

1. To enable the TDE feature, you must generate a tenant master key whose value is not none. To avoid a circular dependency during log replay, if the tde_method parameter is set to internal, the TDE clogs are not encrypted.
2. To enable the column encryption feature, you must generate a tenant master key whose value is not none.
3. To enable the function encryption feature, you must generate a tenant master key whose value is not none.
4. We recommend that you set the tde_method parameter to obcloud for the TDE, column encryption, and function encryption features.

The following example shows how to generate a tenant master key by using the obcloud method. If you want to use an external key management service (KMS), set the tde_method parameter to obcloud and configure the external_kms_info parameter.

1. Log in to the MySQL tenant of the cluster as the administrator.

2. Execute the following statement to enable the obcloud encryption method.

   The tde_method parameter specifies the storage method of the tenant master key. The default value is none, which indicates that encryption is disabled.

   For more information about the tde_method parameter, see tde_method.

   Notice

   Once the tde_method parameter is set, it cannot be modified.

   ALTER SYSTEM SET tde_method='obcloud';
   

3. Execute the following statement to confirm that the value of the tde_method parameter is obcloud on all OBServer nodes of the tenant.

   SHOW PARAMETERS LIKE 'tde_method';
   

4. Execute the following statement to configure the key management information.

   For more information about the external_kms_info parameter, see external_kms_info.

   -- The following example is for reference only. Replace the key management information with the actual information.
   ALTER SYSTEM SET external_kms_info='{
            "KMS_HOST": "kms.ob.com:443",
            "ROOT_CERT": "******",
            "PRIVATE_KEY": "******",
            "PRIVATE_KEY_PHRASE": "ob2025",
            "SCENE": "ANT",
            "KEY_NAME": "ob_cluster_key",
            "CALLER": "oceanbase_admin"}';
   

5. Execute the following statement to generate a tenant master key.

   Note

   This statement can be executed only when the value of the tde_method parameter is internal on all OBServer nodes of the tenant. The first execution of this statement takes about 20 seconds to take effect.

   ALTER INSTANCE ROTATE INNODB MASTER KEY;
   

Rotate a tenant master key

For security reasons, we recommend that you rotate the tenant master key regularly. After the tenant master key is rotated, new data is encrypted with the new key, and old data can still be decrypted with the old key.

ALTER INSTANCE ROTATE INNODB MASTER KEY;

What to do next

After you generate a tenant master key, you can:

• Use the TDE feature: For more information, see Enable transparent encryption for a new table.
• Use the column encryption feature: For more information, see Create a column encryption rule.
• Use the function encryption feature: For more information, see ENHANCED_AES_ENCRYPT and ENHANCED_AES_DECRYPT.

References

• Overview of tenant master keys
• Generate a tenant master key (Oracle mode)