Feature Background
As data security protection requirements become increasingly stringent, information security protection laws in various countries and regions mandate encrypted storage for databases. Data encryption is used to prevent data leakage issues caused by accidental loss of data files.
Feature Introduction
TencentDB for PostgreSQL provides the Transparent Data Encryption (TDE) feature. Transparent encryption means the encryption and decryption operations are transparent to users. This feature supports real-time I/O encryption and decryption for data files, encrypting data before it is written to disk and decrypting it when read from disk into memory. This meets the compliance requirements for data-at-rest encryption. The keys used for encryption are generated and managed by the Key Management Service (KMS).
Supported Versions
PostgreSQL 10 and later versions.
Use Cases
Transparent Data Encryption means that the encryption and decryption operations are transparent to users. It supports real-time I/O encryption and decryption for data files, encrypting data before it is written to disk and decrypting it when read from disk into memory. This meets the compliance requirements for data-at-rest encryption.
Feature Overview
Encryption Principles
TDE performs encryption and decryption on the data page read/write path within the database kernel. This process is completely transparent to applications, requiring no awareness from the business side and no modifications to any SQL or application code. Its working principle is as follows:
Encryption Timing: Data pages are encrypted before being written to disk and are decrypted immediately after being read from disk into memory. No additional operations are required during business read/write processes.
Encryption Granularity: Encryption is performed at the data page level (8KB by default). The header metadata of a data page, such as the LSN and page type, remains in plaintext to allow the database to properly identify the page structure. The data area within the page is encrypted using the AES-256 algorithm.
Encryption and Decryption Process: Each time a data page is flushed to disk, the kernel encrypts the page's data area in the buffer before writing it to the disk. Each time a data page is read from the disk, the kernel decrypts it before returning it to the upper layer for use. Consequently, the data stored on the disk is always ciphertext, while the data in memory and during network transmission remains plaintext.
Encryption Scope: Primary data files, such as tables and indexes, are encrypted. WAL logs are not encrypted.
Security: Encrypted data files cannot be deciphered without the corresponding key. Even if a data file is illegally copied, the plaintext data within it cannot be directly obtained. This satisfies the compliance requirements for data-at-rest encryption.
Key Management
|
Customer Master Key (CMK) | Used to encrypt and protect data keys. Can be created and managed in the key management service, or use the system default master key. |
Data Encryption Key (DEK) | Generated by KMS based on the master key. Used for AES-256 encryption of business data and stored in ciphertext form. Decrypted by KMS and delivered to the database kernel only when the instance is running. |
Activation Methods
TDE is enabled when an instance is created. Once created, it cannot be disabled, and the encryption algorithm cannot be changed. For detailed information on enabling the Transparent Data Encryption feature and database transparent encryption, see Transparent Data Encryption. Viewing Encryption Status
Viewing via SQL
You can execute the following statement under any available account to view the encryption status of the instance:
postgres=> SHOW data_encryption_cipher;
data_encryption_cipher
none
(1 row)
Return value description:
|
aes-256 | Data encryption is enabled for the instance. |
none | Data encryption is not enabled for the instance. |
View Through Console
Log in to the TencentDB for PostgreSQL console, go to the instance details page of your TencentDB for PostgreSQL instance, and check whether data encryption is enabled for the instance in the Configuration Information area. Use Limits
The encryption capability is determined when the instance is created. After creation, encryption cannot be disabled, and the encryption algorithm cannot be changed.
WAL logs are not encrypted.
Encrypted instances do not currently support upgrading the kernel major version through the database major version upgrade method. If you need to change the kernel major version, evaluate the situation, then create a new instance in the target major version and migrate your data.
FAQs
Q: Do I Need to Modify Business Code After TDE Encryption is enabled?
A: No. TDE encryption and decryption are performed within the database kernel, making it completely transparent to applications. The method of reading and writing data is the same as for unencrypted instances.
Q: Are the Backup, Restore, and Read-Only Instance Features of Encrypted Instances Affected?
A: No. Conventional capabilities such as backup and recovery, and read-only instances, all operate based on the same key system. Their usage is consistent with that of unencrypted instances.