Encryption Flow

Encrypting a column involves following phases:

Pre-encryption phase

In this phase, the system:

1. Adds an empty column, column_NEW to hold encrypted values to the base table.

2. Adds an identity column (if does not already exist) and fills unique value for each row in this column.

   Note

   This step could take several minutes depending on the number of rows in the table.

3. Adds an empty column, column_IV to hold initialization vectors to the base table, if you are applying IVs at the field level.

4. Creates views to select data from the table.

5. Creates triggers to insert plaintext and ciphertext into the table.

Encryption phase

In this phase, the system:

1. CipherTrust Manager or pdbctl utility converts column plaintext value to ciphertext.

2. Saves the encrypted values to the column_NEW column in the base table.

3. If the column-level IV is applied, then sets the initialization vectors to the column_IV column.

After the encrypted data is saved to the base table, the pdbctl utility creates the views and triggers that will automate future encryption and decryption operations. These views and triggers use stored procedures to interact with the CipherTrust Manager behind the scenes to perform cryptographic operations on the base table without explicit instructions from the database user. Authenticated applications outside the database can query and update the tables as before, without any modification.