DZone
Thanks for visiting DZone today,
Edit Profile
  • Manage Email Subscriptions
  • How to Post to DZone
  • Article Submission Guidelines
Sign Out View Profile
  • Post an Article
  • Manage My Drafts
Over 2 million developers have joined DZone.
Log In / Join
Refcards Trend Reports
Events Video Library
Over 2 million developers have joined DZone. Join Today! Thanks for visiting DZone today,
Edit Profile Manage Email Subscriptions Moderation Admin Console How to Post to DZone Article Submission Guidelines
View Profile
Sign Out
Refcards
Trend Reports
Events
View Events Video Library
Zones
Culture and Methodologies Agile Career Development Methodologies Team Management
Data Engineering AI/ML Big Data Data Databases IoT
Software Design and Architecture Cloud Architecture Containers Integration Microservices Performance Security
Coding Frameworks Java JavaScript Languages Tools
Testing, Deployment, and Maintenance Deployment DevOps and CI/CD Maintenance Monitoring and Observability Testing, Tools, and Frameworks
Culture and Methodologies
Agile Career Development Methodologies Team Management
Data Engineering
AI/ML Big Data Data Databases IoT
Software Design and Architecture
Cloud Architecture Containers Integration Microservices Performance Security
Coding
Frameworks Java JavaScript Languages Tools
Testing, Deployment, and Maintenance
Deployment DevOps and CI/CD Maintenance Monitoring and Observability Testing, Tools, and Frameworks

UK-US Data Bridge: Join TechnologyAdvice and OneTrust as they discuss the UK extension to the EU-US Data Privacy Framework (DPF).

Migrate, Modernize and Build Java Web Apps on Azure: This live workshop will cover methods to enhance Java application development workflow.

Kubernetes in the Enterprise: The latest expert insights on scaling, serverless, Kubernetes-powered AI, cluster security, FinOps, and more.

A Guide to Continuous Integration and Deployment: Learn the fundamentals and understand the use of CI/CD in your apps.

Related

  • SQL Commands: A Brief Guide
  • Non-blocking Database Migrations
  • Building an Enterprise CDC Solution
  • 5 Key Postgres Advantages Over MySQL

Trending

  • A Maven Story
  • The Advantage of Using Cache to Decouple the Frontend Code
  • REST API Microservice AI Design and Spreadsheet Rules
  • JBang: How to Script With Java for Data Import From an API
  1. DZone
  2. Data Engineering
  3. Databases
  4. Setting Up TDE in MySQL RDS

Setting Up TDE in MySQL RDS

There are different ways to encrypt the data that are all very practical. In this article, we will set up Transparent Data Encryption (TDE) for MySQL on Alibaba Cloud.

Leona Zhang user avatar by
Leona Zhang
·
Aug. 06, 18 · Tutorial
Like (2)
Save
Tweet
Share
7.6K Views

Join the DZone community and get the full member experience.

Join For Free

Transparent Data Encryption (TDE) is a technology used to encrypt databases by offering encryption at a file level. If you have critical and sensitive data, TDE can help protect the privacy of your information and prevent data breaches by enabling data-at-rest encryption in the database. TDE helps you meet various regulatory requirements including PCI DSS and HIPAA.

Image title

Source: https://www.mysql.com/products/enterprise/tde.html

According to MySQL, "TDE enables data-at-rest encryption by encrypting the physical files of the database. Data has encrypted automatically, in real time, prior to writing to storage and decrypted when read from storage. As a result, hackers and malicious users are unable to read sensitive data from tablespace files, database backups or disks. RDS TDE uses industry standard AES algorithms."

TDE Basics

Transparent Data Encryption (TDE) can be used to perform real-time I/O encryption and decryption on instance data files. To increase data security, you can enable TDE to encrypt instance data. Data is encrypted before it is written to disk and decrypted when it is read from disk. TDE does not:

  1. Increase the size of the data file.
  2. Require developers to make any code changes to use TDE.

Alibaba Cloud ApsaraDB for RDS fully supports TDE for MySQL. In this article, we will look at setting up TDE for MySQL on Alibaba Cloud.

Note: TDE is currently only applicable to SQL Server 2008 R2 and MySQL 5.6. To view or modify TDE settings, you need to log in with an Alibaba Cloud account rather than a RAM account.

Prerequisites

  1. Key Management System (KMS) is enabled.
  2. The RDS is based on either MySQL 5.6 or MS SQL 2008.RDS specifications are high enough to support the overhead of encryption.

Setting Up TDE on ApsaraDB for RDS

To enable TDE on Alibaba Cloud:

  1. Go to the RDS Management Console, select the appropriate RDS instance.
  2. Under Security Control, TDE tab, you will be able to find the option to enable TDE.

Image title

How Does TDE Work?

TDE works as shown below.

Image title

This feature will allow the encryption of data while at rest. The encryption of data while in transit is still the responsibility of the user and is outside the purview of this document.

Encrypting Tables

Log in to the database and execute the following command to encrypt the table to be encrypted.

alter table  engine=innodb block_format=encrypted;

Decrypting Tables

If you want to decrypt the TDE encrypted table, execute the following command.

alter table  engine=innodb block_format=default;

Conclusion

To summarize, database encryption provides an important layer of security to your sensitive data. There are different ways to encrypt the data that are all very practical. But remember that even the best crypto library will not secure your data unless you are using a secure key management infrastructure.

Currently, only SQL Server 2008 R2 and MySQL 5.6 databases support TDE, and once TDE is activated, it cannot be deactivated.

Encryption uses keys produced and managed by the Key Management Service (KMS). RDS does not provide the keys and certificates needed for encryption. After activating TDE, if the user wants to restore the data to the local device, he must use RDS to decrypt the data first.

Further Reading

  1. ApsaraDB for RDS for MySQL page
  2. TDE Setup Documentation
MySQL Database Data (computing)

Published at DZone with permission of Leona Zhang. See the original article here.

Opinions expressed by DZone contributors are their own.

Related

  • SQL Commands: A Brief Guide
  • Non-blocking Database Migrations
  • Building an Enterprise CDC Solution
  • 5 Key Postgres Advantages Over MySQL

Comments

Partner Resources

X

ABOUT US

  • About DZone
  • Send feedback
  • Careers
  • Sitemap

ADVERTISE

  • Advertise with DZone

CONTRIBUTE ON DZONE

  • Article Submission Guidelines
  • Become a Contributor
  • Core Program
  • Visit the Writers' Zone

LEGAL

  • Terms of Service
  • Privacy Policy

CONTACT US

  • 3343 Perimeter Hill Drive
  • Suite 100
  • Nashville, TN 37211
  • support@dzone.com

Let's be friends: