Help Center/ Database Security Service/ User Guide/ Database Encryption/ Series 2/ Quick Start/ Scenario 4: Quick Start - Proxy Pattern/ Encryption of Existing Historical Data
Updated on 2026-09-24 GMT+08:00
View PDF
Share

Encryption of Existing Historical Data

Batch encrypt existing unencrypted historical plaintext data in the database to enable unified ciphertext storage for all legacy data. For newly added data, implement incremental encryption using either an Application Plugin or a Proxy. By combining these two approaches, all data is stored in ciphertext format, thereby eliminating the risk of data leakage associated with legacy plaintext data and ensuring the security and compliance of all business data.

In an encryption system, once the database has been configured for encryption, the content viewed by users when directly accessing the database will be encrypted text. In contrast, the encryption proxy service acts as a security barrier: it introduces a new port on top of the original server port for request forwarding. To enable normal data access, applications cannot connect directly to the database; instead, they must modify the database connection details to point to the proxy service. This process not only implements data encryption/decryption or data masking but also ensures that the data viewed and manipulated by users is always either plaintext or masked data. The data stored in the database remains encrypted at all times to safeguard security.

The core responsibility of this module is to configure the connection parameters between the real database service and the proxy service, ensuring the security and accuracy of the data during transmission.

Constraint Application

  • Special note regarding whether to enable SSL: To encrypt non-intrusive bypass traffic, the TLS encrypted channel cannot be used, which may pose security risks.
  • Encrypted proxy functionality; currently unsupported data operation methods:
    • The `SELECT` data type clause that includes the `temp` keyword is not currently supported.
    • `INSERT` is used for batch insertion of data with a self-referential structure; `INSERT` supports nested formatting.
    • Update: The data type supports nested formatting.
    • encrypted fields do not support size comparison operators (e.g.,>, <, ORDER BY, BETWEEN, etc.).
    • Function computations (e.g., AVG, MAX, MIN, SUM, and arithmetic expressions) are not supported.
    • View, trigger, and stored procedure operations are not supported; for equality comparisons ('=') following conditions such as 'WHERE', both fields on either side of the '=' operator must be encrypted, or neither field should be encrypted.
    • Encryption for table or field names containing wildcards is not supported for configuration.

Procedure

  1. When the field key configuration is in editable mode (as shown in Figure 1), click Save in the upper-middle corner to confirm the changes.

    Figure 1 Field key configuration – editable status

  2. Click Encrypt in the Operation column on the right side of the field to perform the encryption operation, as shown in Figure 2.

    Figure 2 Applying encryption

  3. After encryption is completed, you can connect to the database using a third-party tool (e.g., Navicat or DBeaver) to view the encrypted data, as shown in Figure 3.

    Figure 3 Viewing encrypted data

Parent Topic: Scenario 4: Quick Start - Proxy Pattern