This document presents benchmark results for online transactional processing (OLTP) workloads after column encryption is enabled in Data Security Center (DSC). Use these results to estimate the performance impact on your database before enabling column encryption in production.
The benchmarks cover the following databases, workloads, and concurrency levels:
Databases: RDS for MySQL 8.0, RDS for MySQL 5.7, PolarDB for MySQL 8.0.1 (Standard and Cluster Editions)
Workloads: read-only (
oltp_read_only) and read/write (oltp_read_write) — PolarDB uses read-onlyConcurrency: 64, 128, and 256 threads
Metrics: queries per second (QPS) and response time (RT) in milliseconds
Each result compares two scenarios:
Plaintext query: no encryption rules are set
Ciphertext query: all columns in the database are encrypted
Column encryption has no impact on the write performance of the database.
Test environment
All tests use the industry-standard SysBench tool to simulate database load at varying concurrency levels. The test dataset is identical across all database versions:
Data volume per table: 25,000 rows
Number of tables: 250
The instance configurations differ by database version and are described in each section below.
RDS for MySQL 8.0 High-availability Edition
Instance configuration
| Parameter | Value |
|---|---|
| Instance type | mysql.n2.xlarge.2c |
| Instance family | General-purpose |
| Instance series | High-availability series |
| Storage class | PL1 ESSD |
| Version | RDS for MySQL 8.0 20240229 |
Read-only results
| Threads | Plaintext QPS | Ciphertext QPS | Plaintext RT (ms) | Ciphertext RT (ms) |
|---|---|---|---|---|
| 64 | 20,957.01 | 20,451.69 | 48.85 | 50.06 |
| 128 | 40,395.00 | 40,523.26 | 50.68 | 50.52 |
| 256 | 67,328.31 | 53,119.03 | 60.80 | 77.07 |
Read/write results
| Threads | Plaintext QPS | Ciphertext QPS | Plaintext RT (ms) | Ciphertext RT (ms) |
|---|---|---|---|---|
| 64 | 20,201.55 | 19,942.42 | 63.35 | 64.17 |
| 128 | 40,133.36 | 40,343.33 | 63.76 | 63.43 |
| 256 | 62,039.77 | 46,675.26 | 82.46 | 109.59 |
RDS for MySQL 5.7 High-availability Edition
Instance configuration
| Parameter | Value |
|---|---|
| Instance type | mysql.n2.xlarge.2c |
| Instance family | General-purpose |
| Instance series | High-availability series |
| Storage class | PL1 ESSD |
| Version | RDS for MySQL 5.7 20240229 |
Read-only results
| Threads | Plaintext QPS | Ciphertext QPS | Plaintext RT (ms) | Ciphertext RT (ms) |
|---|---|---|---|---|
| 64 | 14,332.58 | 14,021.94 | 71.43 | 73.01 |
| 128 | 28,712.27 | 28,097.95 | 71.32 | 72.87 |
| 256 | 51,173.18 | 43,663.67 | 80.02 | 93.79 |
Read/write results
| Threads | Plaintext QPS | Ciphertext QPS | Plaintext RT (ms) | Ciphertext RT (ms) |
|---|---|---|---|---|
| 64 | 14,349.46 | 14,073.52 | 89.18 | 90.93 |
| 128 | 28,745.73 | 28,480.96 | 89.03 | 89.86 |
| 256 | 52,388.17 | 47,524.69 | 97.69 | 107.69 |
PolarDB for MySQL 8.0.1 Standard and Cluster Editions
Column encryption on PolarDB performs data encryption operations on the proxy. This increases CPU load on the proxy during read operations. If you use the column encryption feature, scale out the proxy as soon as possible.
The proxy is free of charge. The test used the maximum proxy specification supported by the Standard Edition instance (16 cores). For the best read performance after enabling column encryption, scale out the proxy to the maximum specification for your edition.
Standard Edition
Instance configuration
| Parameter | Value |
|---|---|
| Kernel instance type | polar.mysql.g2.xlarge.c |
| Storage class | PL1 ESSD |
| Database nodes | 1 primary node, 1 read-only node (8 cores, 16 GB) |
| Kernel version | 8.0.1.1.41 |
| Proxy version | 2.8.38 |
| Proxy configuration | 16 cores |
Read-only results
| Threads | Plaintext QPS | Ciphertext QPS | Plaintext RT (ms) | Ciphertext RT (ms) |
|---|---|---|---|---|
| 64 | 26,997.98 | 25,852.58 | 37.92 | 39.60 |
| 128 | 53,991.65 | 50,477.37 | 37.92 | 40.56 |
| 256 | 108,128.31 | 93,823.23 | 37.86 | 43.63 |
Cluster Edition
Instance configuration
| Parameter | Value |
|---|---|
| Storage class | PSL5 |
| Database nodes | 1 primary node, 1 read-only node (1–16 PolarDB Capacity Units (PCUs)) |
| Kernel version | 8.0.1.1.41 |
| Proxy version | 2.8.38 |
| Proxy configuration | 0.5–32 PCUs |
Read-only results
| Threads | Plaintext QPS | Ciphertext QPS | Plaintext RT (ms) | Ciphertext RT (ms) |
|---|---|---|---|---|
| 64 | 14,830.79 | 14,615.26 | 68.96 | 70.02 |
| 128 | 29,628.57 | 28,518.67 | 69.05 | 71.77 |
| 256 | 59,483.84 | 50,984.73 | 68.73 | 80.27 |
Performance impact summary
At low to moderate concurrency (64–128 threads), ciphertext QPS and RT are within 2–4% of plaintext across all tested databases, which is acceptable for most OLTP workloads. At high concurrency (256 threads), the gap widens — QPS drops by up to 25% on RDS and up to 13% on PolarDB Standard Edition — primarily because the decryption overhead on the proxy or database layer becomes the bottleneck.
Key takeaways:
Low and moderate concurrency: The performance difference between plaintext and ciphertext queries is negligible for most production workloads.
High concurrency on RDS: Plan for a QPS reduction of up to 25% and an RT increase of up to 33% at 256 threads.
PolarDB: Scale out the proxy to the maximum supported specification before enabling column encryption. The proxy is free of charge.