Encryption Flow

Encrypting a column involves following phases:

Pre-encryption phase

During the preparation phase, the system:

• Adds an empty column (column_NEW) to hold encrypted values to the base table.

• Adds a column (ING_ROW_ID) and fills unique value for each row in this column using a Sequence.

Note

This step could take several minutes depending on the number of rows in the table.

• Adds an empty column (column_IV) to hold initialization vectors to the base table, if applying IVs at the field level.

• Creates views to select data from the table.

• Creates triggers to insert data into the table.

Encryption Phase

In this phase, the system:

• sends the column plaintext value to the CipherTrust Manager or pdbctl utility for encryption.

• saves the encrypted values to the column_NEW column in the base table.

• sets the initialization vectors to the column_IV column if the column-level IV is applied

After the encrypted data is returned to the base table, the pdbctl utility creates the views and triggers that will automate the future encryption and decryption operations. These views and triggers use stored procedures to interact with the CipherTrust Manager behind the scenes to perform cryptographic operations on the base table without explicit instructions from the database user. Authenticated applications outside the database can query and update the tables as before, without any modification. For more details, refer to Encrypt a column.

Online Data Migration

CDP allows online table migration, that is, there is no need to take the tables offline during the migration process. Records can be selected, inserted, updated, and deleted from the database tables while the migration is in progress. Also, views and triggers need not be created separately after the migration. The views and triggers are automatically created during the migration process. After the views and triggers are created, they can be deleted and recreated, if required.