Help Center/ Database Security Service/ User Guide/ Database Encryption/ Series 2/ Database Encryption Introduction
Updated on 2026-08-04 GMT+08:00
View PDF
Share

Database Encryption Introduction

Database Encryption is a security protection product based on gateway proxy encryption technology, specifically designed to implement strategies such as encrypted storage and data masking for sensitive information.

In addition, the system features the following capabilities:

Transparent data encryption and decryption: The system supports transparent data encryption and decryption, meaning applications need not be aware of the encryption logic, the system automatically handles both encryption and decryption.

Data Anonymization: The system supports dynamic anonymization of sensitive data. Based on configured anonymization rules, it anonymizes plaintext data during display, ensuring data security during transmission and storage.

Key Management: The system supports multiple encryption algorithms, allowing flexible selection based on user requirements, and can integrate with external Key Management Services (KMS) to meet diverse security needs.

Through these features, database encryption, decryption, and data masking effectively protect sensitive information, meet compliance requirements, and provide robust security safeguards for the database.

The system serves as an agent encryption gateway deployed between the database and client applications. All access requests must pass through this gateway to achieve data encryption and access control functions. The system networking configuration is illustrated in Figure 1.

Figure 1 Network configuration method

Data Encryption

The system supports data encryption and integrity verification, meeting the evaluation requirements of national security protection standards such as the Equal Protection Standard and Sub-protection Standard, as well as the assessment criteria for ensuring data integrity and confidentiality in commercial cryptographic system applications and security evaluations.

  • Encryption algorithm: Supports AES and SM4 national cryptographic algorithms.
  • Integrity verification algorithm: Supports the SM3-HMAC algorithm.

Usage Scenario

  1. Data encryption, decryption, and anonymization systems are widely used in various sectors including finance, healthcare, e-commerce, government services, and enterprise internal data management. In these scenarios, the systems encrypt sensitive data during storage and transmission, ensuring it is stored in ciphertext format within databases. Additionally, they anonymize the data during external display, analysis, or sharing with third parties to prevent data breaches.
  2. Compliant with national regulatory requirements: The system supports multiple encryption algorithms and strictly adheres to laws and regulations such as the Cybersecurity Law, Data Security Law, and Personal Information Protection Law. For example, the Cybersecurity Law explicitly prohibits network operators from disclosing, altering, or destroying the personal information they collect, except when the information has been processed to the extent that it cannot identify specific individuals and cannot be restored. Through data encryption and desensitization technologies, the system effectively protects personal information and critical data, ensuring compliance in data processing activities.
  3. Support for legacy system migration: The system employs a transparent proxy approach, requiring minimal modifications to existing databases and applications. It integrates seamlessly into legacy systems while providing robust data security protection without necessitating extensive architectural restructuring.
  4. Through these features, the data encryption, decryption, and anonymization system not only effectively safeguards sensitive data but also meets the stringent data security and compliance requirements of various industries.

Function Introduction

This section introduces the primary functions of database encryption/decryption and data masking, along with the relevant chapters.

Feature

Description

Reference

Asset management

The data asset library helps you efficiently manage various data sources, ensuring data availability and security while establishing the foundation for downstream encryption and masking operations.

Asset Library

Project Management

Device status

You can monitor the status of devices, including servers, network devices, and storage devices. You can view real-time device metrics, uptime, and fault logs to detect exceptions early. This enables proactive maintenance and alarms, ensuring overall system performance and reliability.

Management Homepage

Device Information

System Status

Role management

This feature delivers flexible Role-Based Access Control (RBAC). Administrators can define custom roles mapped to specific business requirements and security policies. By assigning granular permissions for data access and functional operations to individual roles, the system enhances security and data confidentiality.

User Management

Key management

The system supports multiple cryptographic algorithms and provides centralized key management. You can easily create, store, update, and delete keys, while ensuring the security and availability of keys. The system can interconnect with the Key Management Service (KMS) to meet diverse key management requirements.

Encryption Rules

Key Management

Cryptographic Algorithms

Data discovery and sorting

This feature automatically scans and identifies sensitive data in the system, including Personally Identifiable Information (PII), financial data, and business secrets. The system uses predefined rules and algorithms to quickly identify the location and usage of sensitive data. By laying the groundwork for subsequent encryption and masking, this feature simplifies data management and enhances sensitive data protection.

Discovery and Sorting

Data domain management

Data is classified and segmented into different domains for management based on business requirements and security levels. By grouping data by type, importance, or application scenario, you can apply tailored security policies and granular access permissions to each domain, ensuring fine-grained data management and protection.

Discovery Rules

Dynamic masking

This feature masks sensitive data in real time during transmission, display, and sharing based on predefined policy rules. The masked output preserves the original format and characteristics of the data but cannot be reverse-engineered, effectively securing data privacy without impacting normal service operations.

Masking Policy Management

Masking Algorithms

Application management

The system provides application management capabilities to control which applications can invoke data encryption, decryption, and masking services. Through explicit authorization, only approved applications can access sensitive data, enforcing granular access controls to ensure strict compliance and data security.

Application Users

Plugin Synchronization Management

Log audit

The system maintains a comprehensive audit trail of user activities, data access events, and system operations. Through the log audit module, administrators can monitor system status in real time, track data usage and modifications, and rapidly detect abnormal behavior or security threats. This provides critical visibility for threat management and incident response.

Logs
Parent Topic: Series 2