Purpose
This statement is used to create a tablespace, a logical object, which supports encryption.
Syntax
To create an encrypted tablespace.
CREATE TABLESPACE tablespace_name [ENCRYPTION [=] 'tablespace_encryption_option']; tablespace_encryption_option: N | Y | AES-256 | AES-256-GCM | AES-128 | AES-128-GCM | AES-192 | AES-192-GCM | SM4-CBC | SM4-GCMTo create a tablespace.
CREATE TABLESPACE tablespace_name [ADD DATAFILE 'file_name'] [FILE_BLOCK_SIZE = value] USE LOGFILE GROUP logfile_group [EXTENT_SIZE [=] extent_size] [INITIAL_SIZE [=] initial_size] [AUTOEXTEND_SIZE [=] autoextend_size] [MAX_SIZE [=] max_size] [NODEGROUP [=] nodegroup_id] [WAIT] [COMMENT [=] 'string'] [ENGINE [=] engine_name]Notice
Only the syntax with the keyword is supported, and the feature does not take effect. This keyword cannot be used with
ENCRYPTION. Otherwise, an error will be returned.
Parameters
| Parameter | Description |
|---|---|
| tablespace_name | The name of the tablespace to be created. |
| ENCRYPTION | Optional. Specifies the keyword to indicate the encryption algorithm used for the tablespace. If you do not specify the encryption algorithm by using the keyword ENCRYPTION, an unencrypted tablespace is created by default. For more information about the encryption algorithms, see tablespace_encryption_option. |
tablespace_encryption_option
N: indicates that no encryption is performed.Y: indicates that the default encryption algorithm isAES-256.AES-256: indicates that 256-bit keys are used for encryption and decryption.AES-256-GCM: indicates that 256-bit keys are used in GCM mode.AES-128: indicates that 128-bit keys are used for encryption and decryption.AES-128-GCM: indicates that 128-bit keys are used in GCM mode.AES-192: indicates that 192-bit keys are used for encryption and decryption.AES-192-GCM: indicates that 192-bit keys are used in GCM mode.SM4-CBC: indicates that the SM4 algorithm is used in CBC mode, where each data block is XORed with the output of the previous block before encryption.SM4-GCM: indicates that the SM4 algorithm is used in GCM mode, which provides both data encryption and authentication.
Note
- AES (Advanced Encryption Standard) is a symmetric encryption algorithm, which means the same key is used for encryption and decryption. AES is a block-based encryption algorithm, which typically encrypts data in 128-bit blocks.
- AES-GCM (Galois/Counter Mode) is an operation mode used to process block-based encryption algorithms such as AES, providing both encryption and data authentication (also known as message authentication code).
- The block length and key length of the SM4 algorithm are both 128 bits.
Examples
Create an unencrypted tablespace.
CREATE TABLESPACE tablespace001;Create an encrypted tablespace by using transparent data encryption (TDE).
Set the encryption method to built-in transparent encryption.
ALTER SYSTEM SET tde_method = 'internal';Display the current encryption method configuration.
SHOW PARAMETERS LIKE 'tde_method';Generate a new primary encryption key.
ALTER INSTANCE ROTATE INNODB MASTER KEY;Notice
Although the command can be executed, if the disk space is full, the new primary encryption key cannot be generated.
Create an encrypted tablespace named
tablespace2by using theSM4-GCMencryption algorithm.CREATE TABLESPACE tablespace002 ENCRYPTION = 'SM4-GCM';