Column encryption is a sensitive column protection feature provided by Database Autonomy Service (DAS). You can configure encryption for data columns in databases such as RDS for MySQL, RDS for PostgreSQL, PolarDB for MySQL, and PolarDB for PostgreSQL to protect sensitive column data in databases.
Feature introduction
Column encryption ensures both confidentiality and integrity of your data:
Confidentiality: Sensitive columns are encrypted by using the internationally standardized AES-GCM algorithm or the Chinese national cryptographic SM4-GCM algorithm. Users who are not granted plaintext permissions or who do not hold the master encryption key (MEK) can obtain only meaningless ciphertext, even if they receive query results.
Integrity: Each ciphertext carries a verification tag, which is checked before decryption. If the ciphertext is tampered with during transmission or on the application side, the verification fails and the ciphertext is not decrypted into incorrect plaintext.
You can configure encryption rules for sensitive columns such as phone numbers, ID card numbers, and bank card numbers, and integrate the feature with a small amount of code. Unauthorized accounts and applications can see only ciphertext when they query the columns. Authorized applications automatically decrypt the ciphertext by using the column encryption clients (EncJDBC and the Go driver) to obtain plaintext.