Scenario 2: Transparent Encryption and Decryption Configuration and Operation Example

Overview

The data transparency encryption and decryption feature utilizes an advanced encryption system to seamlessly decrypt ciphertext data in the database, converting it into plaintext for user access and use. Simultaneously, this feature automatically encrypts user operation data from plaintext to ciphertext and securely stores it back in the database. Throughout the process, users hardly notice any changes, ensuring smooth and convenient operations.

This feature not only significantly enhances data security by preventing the leakage of sensitive information, but also markedly improves user experience by simplifying interaction processes. Users can enjoy secure data access services without performing complex encryption or decryption operations, achieving an optimal balance between data protection and ease of use.

Configuration Method

1. Ensure the business system operates normally, with stable network connectivity, sufficient disk space, and other essential conditions.
2. Follow the Download Plugin to deploy the plugin to the user's business system.
3. The encrypted gateway service has started normally and is accessible.
4. The encryption gateway has completed the configuration of user business system information (including network segments and user details).
5. Ensure that the data to be tested or used has been configured with an encryption policy and encrypted.

Test Effect

Here, a test interface is used to demonstrate the effect:

• First, display the actual data in the database (encrypted).
  Figure 1 Actual data in the database
  
• The query result comparison between the non-integrated plugin and the integrated plugin for the business system is as follows:
  Figure 2 Display of execution results for non-integrated plugins and applications
  
  Figure 3 After installing the plugin-display of the application's execution results
  

As can be seen, after integrating the plugin, the business system automatically decrypts the ciphertext into plaintext for user consumption.

Other Notes

1. In addition to integrating encryption plugins, you can also configure encryption proxy services and other features to achieve similar transparent encryption and decryption capabilities.
2. For detailed application user configuration, refer to the Application User.
3. For detailed application network segment configuration, refer to the Plugin Synchronization Management.
4. For the plugin download address, refer to the Download Plugin.

Apply Constraint

Data operation methods not supported (using MySQL as an example):

1. The query statement containing the temp keyword is not supported. For example:

   SELECT * FROM UDFTESTER.STudent_INFO TEMP WHERE TEMP.GENDER = 'Male'

2. Insert a self-loop batch data insertion for data types, for example:

   INSERT INTO SCHOOL.STudent_INFO (STudent_ID, NAME, GENDER, MAJOR) WITH RECURSIVE TEMP (LEVEL) AS (SELECT 1 UNION ALL SELECT LEVEL + 1 FROM TEMP WHERE LEVEL <10) SELECT CONCAT ('2024', LEVEL) AS STUDENT_ID, CONCAT ('student', LEVEL) AS NAME, CASE WHEN MOD (LEVEL, 2) = 0 THEN 'female' ELSE 'male' END AS GENDER, 'Computer Science and Technology' AS MAJOR FROM TEMP;

3. Insert a data type containing nested formatting, for example:

   INSERT INTO SCHOOL.STudent_INFO (STudent_ID, NAME, GENDER, MAJOR) SELECT CONCAT ('2024', LPAD(CASTSELECT COUNT(*) FROM SCHOOL.STudent_INFO + 1 AS CHAR), 4, '0'), 'Batch Import of Students', CASE WHEN SELECT COUNT(*) FROM SCHOOL.STudent_INFO%2 = 0 THEN 'Male' ELSE 'Female' END, 'Computer Science and Technology' FROM DUAL

4. Update-type update statements contain nested formatting, for example:

   UPDATE SCHOOL.STudent_INFO SET GENDER = 'Unknown' WHERE NAME IN (SELECT NAME FROM (SELECT NAME FROM SCHOOL.STudent_INFO WHERE NAME LIKE '%Snow%') t)

5. Encrypted fields do not support size comparisons such as greater than, less than, order by, or between.
6. Does not support operations involving calculation function types, such as AVG, MAX, MIN, SUM, and calculation expressions.
7. Operations on views, triggers, and stored procedures are not supported. For equality comparisons following conditions like 'where', both fields on either side of the equality sign must be encrypted or neither should be encrypted.
8. Encrypted table names and field names containing wildcards cannot be configured for encryption.