Encrypting a Single Field

Prerequisite

Basic Encryption Information Preview has been completed.

Procedure

1. On the Field Encryption Configuration tab, select Edit; the page will then display in the following state.

   The Settings option below the key keyword is available only in the editing mode, as shown in Figure 1.

   Figure 1 Encryption configuration status
   

   Not all fields are followed by the Settings option; this is because not all field types support column-level content encryption. For example, data types such as DATETIME and DECIMAL, as shown in the figure above, do not support encryption.

2. At this point, click Set to configure the encryption algorithm and encryption key for the current field; as shown in Figure 2, this will open the Encryption Rule (Algorithm) Selection Window. The parameters for configuring encryption rules are listed in Table 1.
   Figure 2 Field encryption configuration
   

   Table 1 Encryption/decryption rule parameter documentation

   Parameter	Description
   Select Encryption Rule	Select the encryption algorithm and encryption mode used for the current field; in this system, this is referred to as the Encryption Rule. For instructions on how to configure encryption rules, please refer to the Encryption Rules.
   Select Encryption Key	Select the encryption key used for the current field. The encryption key is managed within the encryption rules. For instructions on how to configure an encryption key, please refer to the Encryption Rules.
   Encryption Position	Based on business requirements, select the portion of plaintext characters to be retained from the encrypted string. For example: ID card number: 130602199606071510. The first 6 digits are not encrypted; for example, "130602" is not encrypted.
   Source Length	This is an encrypted length simulation calculator. The length of the encrypted data varies depending on the algorithm used. Therefore, if no encryption rule (algorithm) is selected, the Calculate function cannot be executed. For example: Input: Source length – 20; click Calculate.
   Supports Fuzzy Query	When enabled, encrypted data supports fuzzy queries; however, the ciphertext length will occupy more bits.
   Reset	Remove all encryption rules and encryption keys.
   Confirm	This field is configured to encrypt data using the selected encryption rule and key.
   Cancel	Close the window without making any changes.

3. After clicking Confirm, return to the Encryption Policy Settings page to verify whether the encryption settings have been successfully applied.

   As shown in Figure 3, the red-labeled field has already been configured with an encryption algorithm and an encryption key.

   Figure 3 Applying encryption
   
   

   Source Length: Refers to the maximum length of data stored in this field or the length manually specified when configuring an encryption algorithm.

   Since data encryption increases the data length, it is also necessary to know the maximum length of the extended field; therefore, it is essential to determine this length.

4. Click Save. The Encrypt button changes from white to black, indicating it is now operable, as shown in Figure 4.
   Figure 4 Saved state
   

5. Single-field existing historical data encryption.

   Before deploying the encryption software, the database contains existing historical data to varying degrees; therefore, this existing historical data must be encrypted prior to deploying any plugins or proxies. The system provides an automated method for encrypting such existing historical data.

   Click Encrypt – the system will automatically begin encrypting the existing historical data.

   

   Existing historical data is encrypted; the system automatically performs three steps of operation:

   1. Create a backup column to store the original data that needs to be encrypted, thereby preventing any unexpected incidents.
   2. Since encryption increases the data length, the system automatically generates an SQL statement for field expansion and executes it.
   3. Encrypt existing historical data.

6. The encryption process is complex and time-consuming, requiring a significant amount of time. During the encryption process, you can click Details to view the encryption progress and service execution log, as shown in Figure 5.
   Figure 5 Encryption details
   
   • Stop Encryption/Decryption: When a task is in progress (either encrypting or decrypting), if you need to halt the operation, click Stop Encryption/Decryption to interrupt the current task. To resume encryption or decryption later, click Encrypt or Decrypt in the field operation column to continue the operation on that field.
   • Cache Metadata: This is a built-in security feature of the product that caches metadata from the Asset Database to prevent API spoofing.

7. After encryption is complete, the user can query the database using SQL tools to verify that the plaintext data has been encrypted; as shown in Figure 6, the NAME field has been encrypted using the encryption software.
   Figure 6 SQL tool for querying encrypted data
   

Execute Field Decryption

For existing historical data, after encryption, it may sometimes be necessary to decrypt the data.

When the data volume is large, decrypting existing historical data is also a time-consuming task.

1. For fields that have been successfully encrypted, click Decrypt to decrypt the data.
2. Once decryption is complete, you can view the database; all corresponding data has been decrypted into plaintext.

Associative Operation

• Generate extra columns: After encryption is performed, the system will create a column named "Original Field Name +_copy" in the table, which is used for data backup, auditing, and other related operations.
• Delete Backup Column: Before decrypting, the user must manually click Delete Backup Column to perform the deletion operation.
• Field Key Configuration: The encryption system currently supports encryption for mainstream string-type data; however, keys cannot be configured or encryption/decryption operations cannot be performed for other data types (e.g., date and numeric types).