tencent cloud

All product documents
TDSQL-C for MySQL
DocumentationTDSQL-C for MySQLOperation GuideDatabase Security and EncryptionEncryptionTransparent Data Encryption
Transparent Data Encryption
Download PDF
Last updated: 2024-12-18 15:00:53
Transparent Data Encryption
Last updated: 2024-12-18 15:00:53
Download PDF
This document describes the Transparent Data Encryption (TDE) feature of TDSQL-C for MySQL.

Feature Overview

The TDE feature makes data encryption and decryption operations transparent to the user.

Application Scenario

With the TDE feature, real-time I/O encryption and decryption are supported for data files. Data is encrypted before being written to the disk and decrypted when memory is read from the disk, which can meet compliance requirements for static data encryption.

Prerequisites

Instance version is MySQL 5.7 2.1.12 or later, or MySQL 8.0 3.1.15.005 or later.
The instance is running.

Precautions

To use the TDE feature, the Key Management Service (KMS) should be enabled. If not enabled, it can be enabled during the TDE enablement process as guided.
To use the TDE feature, KMS key permissions should be granted. If not granted, they can be granted during the TDE enablement process as guided.
To operate the account, you should have QcloudAccessForMySQLRole permissions. If you do not have the permissions, you can be granted with them during the TDE enablement process as guided.

Billing Instructions

The keys used for encryption are generated and managed by the Key Management Service (KMS) . The TDSQL-C for MySQL data encryption feature incurs no additional charges, but KMS may generate additional fees. For more details, please refer to the Billing Overview .

Use Limitations

Only symmetric encryption is supported.
If the grant of permissions is revoked after TDE is enabled to operate the account, instance re-enablement will cause the database to be unavailable.
TDE can only be enabled and cannot be disabled. Once TDE is enabled, the certificate key on the instance cannot be deleted.
After the KMS Custom Master Key is deleted, the user instance will become unavailable.
If the TDE feature is enabled and the account is in an overdue status, keys cannot be obtained from KMS, which may cause migration, upgrade, and other tasks to fail to proceed normally.

Operations

Enabling data encryption

1. Log in to the TDSQL-C for MySQL console and click cluster ID in the cluster list to enter the cluster management page.
2. Select the Data Security tab on the cluster management page.
3. Select Data Encryption and click the button before Not activated to enable the data encryption feature.

4. In the pop-up dialog box, select the key method and click OK.
Note:
If you have not enabled the KMS service or have not been granted with KMS key permissions before, you need to follow the prompts in the dialog box to click Enable after the KMS service and then click Proceed to authorize after the grant of KMS key permissions, so as to complete the corresponding enablement or authorization operations to unlock subsequent settings of the data encryption feature.

Selecting Keys
Use of the key auto-generated by Tencent Cloud: The system will automatically generate the key.
Use of an existing custom key: You can select a key that you have custom-created.
Region: If you use an existing custom key, you need to select the region where the existing key is located.
Key: If you use an existing custom key, you can select the existing key by its name. If there are no created keys, you can click Go to Create to create one in the KMS console, and then reselect.
5. When the cluster running status changes from "Running Asynchronous Task: Data Encryption" to "Running", data encryption is successfully enabled. To check task progress, you can go to the Task List to query.

Encrypting Data Tables

After the data encryption feature is enabled, users need to perform the following Data Definition Language (DDL) operations on the database tables to encrypt data.
If you want to encrypt the table during table creation, execute the following command:
CREATE TABLE t1 (c1 INT) ENCRYPTION='Y';
If you want to encrypt an existing table, execute the following command:
ALTER TABLE t1 ENCRYPTION='Y';

Decrypting Data Tables

After the data encryption feature is enabled, perform the following DDL operations if you need to decrypt an encrypted table.
ALTER TABLE t1 ENCRYPTION='N';
Was this page helpful?
You can also Contact Sales or Submit a Ticket for help.
Yes
No

Feedback

Contact Us

Contact our sales team or business advisors to help your business.

Contact Us
Technical Support

Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

Submit a Ticket
7x24 Phone Support
Hong Kong, China
+852 800 906 020 (Toll Free)
United States
+1 844 606 0804 (Toll Free)
United Kingdom
+44 808 196 4551 (Toll Free)
Canada
+1 888 605 7930 (Toll Free)
Australia
+61 1300 986 386 (Toll Free)
EdgeOne hotline
+852 300 80699
More local hotlines coming soon