Manage TDE

OceanBase Database supports encryption at the data storage layer, namely Transparent Data Encryption (TDE).

TDE encrypts sensitive data stored on disks. Data is automatically encrypted before being written to storage devices and decrypted automatically when read. This process is transparent to users, and authenticated database users can access data without restrictions. If a storage medium is stolen, TDE ensures that sensitive data stored on it cannot be accessed by unauthorized users. Even if a storage medium is lost, data loss can still be prevented, maximizing the protection of user data security.

This topic describes how to enable TDE and create tablespaces for tenants.

Enable TDE

You can refer to this section to enable TDE for a cluster.

Prerequisites

• Ensure the current OCP user is in the ADMIN or ORG_ADMIN role.
• The tenant to be encrypted is in the RUNNING state.
• When using an OCP-provided key, ensure the OceanBase cluster is version V4.x or later.
• When using a third-party vendor key, ensure the OceanBase cluster meets one of the following version requirements:
  • [V4.2.5.4, V4.3.0)
  • [V4.3.5.2, +∞)
• When using a key provided by the third-party vendor Geer, configure the following parameters in advance based on the service type:
  • Standard Edition: Set both the ocp.kms.tde.koal.useTLS.enabled and ocp.kms.tde.koal.kcsp.mode.enabled parameter values to false.
  • Password: Set both the ocp.kms.tde.koal.useTLS.enabled and ocp.kms.tde.koal.kcsp.mode.enabled parameter values to true. For more information about the parameters, see the Parameter description section in this topic.

Procedure

1. Log in to OCP.

2. In the left navigation bar, click Cluster. The system goes to the Clusters page by default.

3. On the Clusters page, find the target cluster and click its name to go to the cluster Overview page.

4. In the left navigation bar of the displayed page, click Security.

5. Switch to the Transparent Data Encryption tab.

6. Select the tenant for which you want to enable encryption and click Enable Encryption in the Actions column.

7. Select the key type in the dialog box.

   • Use an OCP-provided key: An automatically generated key by OCP. In this case, the tde_method value is internal, indicating the master key is stored in an internal OceanBase table.

   • Use a third-party vendor key: A key managed by KMS. Configure the key information as follows.

     Parameter	Description
     Vendor	Supports six vendor types: Alibaba Cloud, Tencent Cloud, Jiangnan Tianan, KOAL, Sansec, and JN Union.
     Service Type	Selected when the vendor is KOAL, specifying the KMS service type. Standard Edition: Ensure the KMS Standard service version is 2.0 or later. Password: Ensure the KMS Password service version is 3.2.0 or later.
     Access Domain Name	The KMS endpoint information.
     AK	The access_key_id used for signature authentication.
     SK	The access_key_secret used for signature authentication.
     SK Version Number	Filled in when the vendor is KOAL and the service type is Password. The specific SK version number.
     Master Key ID	The user's master key ID.
     Region	The region information of KMS. This parameter is required when the vendor is Tencent Cloud.

8. Click Enable.

Parameters

Create a tablespace

OceanBase supports enabling transparent data encryption on a per-tablespace basis to ensure secure data storage.

Prerequisites

• Ensure the current OCP user is in the ADMIN or ORG_ADMIN role.
• Ensure the OceanBase cluster version is V4.x or later.
• Transparent data encryption (TDE) is enabled.

Procedure

1. Log in to OCP.

2. In the left navigation pane, click Cluster. The system goes to the Clusters page by default.

3. On the Clusters page, find the target cluster and click its name. The cluster Overview page appears.

4. In the left navigation pane of the displayed page, click Security.

5. Switch to the Transparent Data Encryption tab.

6. Select the target tenant and click Create Tablespace in the Actions column.

7. In the dialog box, specify the following information:

   Information	Description
   Encrypted Tablespace Name	Multiple encrypted tablespaces can be created under a tenant, with each having a unique name. The name must start with a letter, can contain letters, numbers, and underscores, and be 2 to 30 characters long.
   Encryption Algorithm	The encryption algorithm cannot be modified or converted after selection. Note that supported algorithms may vary by OceanBase version. Choose an appropriate algorithm based on the official documentation.

8. Enter the encrypted tablespace name, select the encryption algorithm, and click Create.

9. After enabling TDE and creating an encrypted tablespace, you need to perform the DDL operation to create an encrypted table for data encryption. The DDL statement is as follows:

   CREATE TABLE t1 (id int,id2 int) TABLESPACE sectest_ts1;
   

   Note

   After adding historical tables to the encrypted tablespace, perform a full compaction to persist the encryption. Otherwise, historical table data cannot be encrypted.

10. Click the name of the encrypted table to view its details in the right-side panel, including information such as the tenant to which it belongs, the encrypted table name, encryption status, and encryption progress. The encryption progress indicates the percentage of data blocks in the current table that have been encrypted.