How to enable transparent data encryption (TDE) (Beta) -

Lindorm supports the transparent data encryption (TDE) feature. After the TDE feature is enabled, Lindorm uses a key hierarchy to encrypt data files. All data stored on the file system is in ciphertext. To improve data security, you can enable the TDE feature in the console to encrypt instance data. This topic describes the specific steps to enable the TDE feature.

Prerequisites

The deployment solution for a Lindorm instance is Single Zone. For more information, see Create an instance.
You have activated Key Management Service (KMS). For more information, see Activate Key Management Service.
You have authorized Lindorm to access KMS using a service-linked role. For more information, see Service-linked roles for Lindorm.

Background

The Transparent Data Encryption (TDE) feature of Lindorm supports the AES and SM4 algorithms. The keys used for TDE are generated and managed by Key Management Service (KMS). KMS provides you with a customer master key (CMK) to encrypt a data key, and the data key then encrypts your data. This process is called envelope encryption. During decryption, the ciphertext of the data key is read. The CMK is used to decrypt the ciphertext of the data key to obtain the plaintext data key. The plaintext data key is then used to decrypt the data. The CMK is created by using a KMS API. If you provide a password, you can also encrypt the CMK to enhance its security.

Considerations

When you enable TDE, the instance restarts once, which causes a transient disconnection. We recommend that you perform this operation during off-peak hours and ensure that your application has a reconnection mechanism.
The instance restart and transient disconnection do not cause data loss.
Once enabled, TDE cannot be disabled.

Procedure

Log on to the Lindorm console.
Click the target instance ID to go to the Instances page.
In the left navigation bar, select Wide Table Engine > Data Security. The Transparent Data Encryption (TDE) page is displayed by default.
Turn on the Current Status: switch.
In the Enable TDE dialog box, select Use Automatically Generated Key or Use Custom Key.
- If you select Use Automatically Generated Key, click OK to enable TDE.
- If you select Use Custom Key, from the Set Key: list, select a key from Key Management Service (KMS) and click OK to enable TDE.
  
  Note
  If you need to create a custom key, click Manage Key to go to the KMS console. In the KMS console, create a key and import your key material. For more information, see Create a key.

Next steps

After you enable TDE, connect to the instance using Lindorm-cli and run a Data Definition Language (DDL) statement on a table to apply encryption. For more information about how to connect to an instance, see Connect to and use the wide table engine with Lindorm-cli.

When you create a new table, add the WITH (FILEVERSION = 5, ENCRYPTION = AES) statement.

CREATE table testsql (p1 varchar, p2 varchar, p3 bigint, c1 varchar, c2 double, constraint primary key (p1, p2, p3 desc)) WITH (FILEVERSION = 5, ENCRYPTION = AES);

For existing tables, you need to use the ALTER keyword and the WITH (FILEVERSION = 5, ENCRYPTION = SMS4) clause.
```
ALTER table testsql WITH (FILEVERSION = 5, ENCRYPTION = SMS4) ;
```

Note

FILEVERSION specifies the file version, which must be set to 5 to use the encryption feature.
ENCRYPTION specifies the encryption algorithm type. The value can be AES or SMS4.
You can use the ENCRYPTION=NONE statement to decrypt the data.
You can switch the encryption algorithm, for example, from AES to SMS4. However, this method is not recommended. To do so, perform the following steps:
1. Use the ENCRYPTION=NONE statement to decrypt the table data.
2. Perform a major_compact operation on the table and wait for the operation to complete.
3. Use the ENCRYPTION=SMS4 statement to set the data encryption type to SMS4.