ApsaraDB RDS for MySQL always-confidential database uses confidential computing to encrypt sensitive data throughout its lifecycle while complying with data protection regulations. Cloud providers, unauthorized users, DBAs, developers, and O&M personnel cannot access plaintext data. Compare approaches in Comparison of database encryption technologies.
How it works
The always-confidential database supports all operations on encrypted data, including transactions, queries, and analytics. Data is processed inside a secure enclave, such as an application and a database. Outside the enclave, data remains in ciphertext. Query results are encrypted before being returned.
This defends against both external and internal threats, protecting data throughout its lifecycle and keeping cloud data private.
Preventing data leaks on the cloud
The always-confidential database encrypts protected data in query results. Even if credentials are leaked, the data stays confidential.
Combine the always-confidential database with one of the following disk encryption features for multi-layer encryption:
-
Cloud disk encryption (recommended). Use the cloud disk encryption feature.
-
Transparent data encryption (TDE). Configure TDE.
Both cloud disk encryption and TDE provide disk-level encryption. Combine them with the always-confidential database based on your business requirements.
Use cases
The always-confidential database provides architecture-level data confidentiality while maintaining high stability, performance, and cost-effectiveness.
Platform O&M
Protects database services in trusted execution environments (TEEs) on third-party platforms. Data owners are typically application service providers who want to prevent unauthorized database service providers and O&M personnel from accessing application data.
Examples:
-
A database migrated to the cloud stays protected from unauthorized cloud providers and O&M personnel.
-
A database deployed in a data center stays protected from unauthorized O&M personnel.
Protected data compliance
Protects user-owned data (health, financial) in TEEs. Enables data management and analytics without exposing plaintext to service providers.
Examples:
-
Enterprises using third-party services to manage commercial data can prevent trade secrets from being exposed to those providers.
-
Third-party providers managing PII or genomic data can meet compliance requirements for end-to-end encryption.
Security levels
ApsaraDB RDS provides the following security levels in ascending order of protection:
|
Security level |
Protection |
Trust requirements |
Isolation method |
Availability |
|
Regular database on the cloud |
Blocks most external attacks when used with Alibaba Cloud security services |
Operating system, database software, Infrastructure as a Service (IaaS) O&M personnel, and database users |
Alibaba Cloud security services |
Available |
|
Always-confidential database (basic edition) Recommended |
Data is available but invisible to all database users, including DBAs. Works with the always-confidential access control module to limit the ability of database users to manipulate data. |
Operating system, database software, and IaaS O&M personnel |
Always-confidential access control module |
Available for all instance types |
|
Always-confidential database (hardware-enhanced edition) |
Uses TEE technologies to allow RDS instances that use the always-confidential database (basic edition) to run in TEE environments, with all external security threats isolated. |
Operating system and database software |
TEE technologies: Intel SGX, Intel TDX, ARM TrustZone, AMD SEV, Hygon CSV, and confidential containers |
Not officially released. The TDX-based edition is preliminarily developed. |
All security levels share consistent features and advanced cryptographic capabilities, including fully homomorphic encryption (FHE) and homomorphic encryption. To try the TDX-based hardware-enhanced edition, apply for a trial.