Database Encryption Process

The database encryption system supports two encryption modes: the Application-Plugin mode and the Proxy mode. Although these two modes offer similar encryption effectiveness, they are suited for different scenarios; for specific details, please refer to the Application-plugin Pattern and the Proxy Pattern.

In a database encryption system, configuring data encryption involves the following steps:

1. Identify which data types should be encrypted—e.g., phone numbers or ID card numbers. This step is an offline process and does not require any action within the system.
2. Identify which tables and fields in your database require encryption. Refer to the Importing and ExportingI, which can help you quickly locate tables and fields containing sensitive data – for example, the Phone field in the Customer table.
   

   The sensitive data discovery tool is a supporting tool; it cannot guarantee 100% accuracy and requires manual verification.

3. Specify the encryption algorithm and encryption mode to be used. Refer to the Built-in Data Domain and Discovery Rules chapter. In accordance with national security requirements, the system must support the SM4 encryption algorithm.
4. Specify the key to be used for encryption—either locally or via Huawei KMS. For detailed operating steps, please refer to Key Management.
5. Configure the encryption algorithm and key for fields that require encryption.
6. Encrypt existing historical data. For convenience, the system provides three encryption methods for existing historical data to accommodate system configuration requirements across different scale levels: Encrypting a Single Field, Single-table Batch Encryption, and Multiple-table Batch Encryption.
7. The Plugin Mode requires downloading and deploying a plugin.
8. The Proxy Pattern does not require any plugin downloads; instead, the database connection for the business system should be configured to point to the proxy service.