Lindorm supports Transparent Data Encryption (TDE). When TDE is enabled, Lindorm uses a key hierarchy to encrypt data files, ensuring that all data stored in the file system is ciphertext. You can enable TDE in the Lindorm console to encrypt your instance data.
Background
TDE protects data at rest by encrypting it at the database layer, preventing attackers from bypassing the database to read sensitive information directly from storage. OS users and other unknown users who attempt to read sensitive data from tablespace files, disks, or backups cannot access the plaintext data. When a client accesses data through the database, the system automatically decrypts the data in real time. This decryption is transparent to the client, which always receives plaintext data.
Prerequisites
-
The instance type is Lindorm.
-
The underlying storage is of 4.5.21 or later version.
Considerations
-
When you enable TDE, the underlying storage of the instance restarts. This process is seamless to your applications and does not cause data loss or service interruptions.
-
After you enable TDE, you cannot disable it. TDE encrypts the data for all engines in the instance.
-
TDE is incompatible with the full backup feature. Enabling TDE may cause full backup tasks to fail. Evaluate your business requirements before you enable this feature.
-
Enabling TDE typically introduces a performance overhead of less than 5%.
Procedure
The steps to enable TDE vary based on the deployment type of your instance.
Non-multi-zone high-availability edition
Log on to the Lindorm console.
In the upper-left corner of the page, select the region where the instance is deployed.
On the Instances page, click the ID of the target instance or click View Instance Details in the Actions column for the instance.
-
In the section, find the Underlying Storage row and click Enable TDE encryption in the Actions column.
ImportantIf the underlying storage information is not displayed, contact Lindorm technical support (DingTalk ID: s0s3eg3).
Multi-zone high-availability edition
Currently, only Lindorm V1 instances support enabling TDE.
Log on to the Lindorm console.
In the upper-left corner of the page, select the region where the instance is deployed.
On the Instances page, click the ID of the target instance or click View Instance Details in the Actions column for the instance.
-
In the left-side navigation pane, click Data Security.
-
Click the Storage Encryption TDE tab and turn on the switch.