Database Encryption

Encrypt databases when you must perform range searches over sensitive data columns, and when you lack the knowledge of the data model and cannot identify sensitive data columns.

• Create an Encrypted Database
  To create a fully encrypted database, use the create database command.
• Encrypt an Existing Database
  You can encrypt an unencrypted database using the alter database command.
• Encryption Status and Progress
  To obtain information on whether a database is encrypted or not, as well as how far along the encryption process has gone on a database being encrypted, use the sp_helpdb system procedure or the dbencryption_status built-in function.
• Performance Considerations
  When an existing database is being encrypted, it is still kept online. Take performance issues into consideration to mitigate the impact on user access to the database, as well as general SAP ASE response time.
• Suspend the Encryption Process
  To stop encrypting a database in the process of being encrypted, use the suspend encrypt option of the alter database command.
• Resume the Encryption Process
  To resume encrypting a database that had its encryption process interrupted or suspended, use the resume encryption option of the alter database command.
• Decrypt an Encrypted Database
  To decrypt a fully encrypted database, use the alter database command.
• Recover Fully Encrypted Databases
  If SAP ASE cannot retrieve the database encryption key during start-up because the master or dual master key is unavailable, SAP ASE ignores the encrypted database.
• Back Up (Dump) a Fully Encrypted Database
  Backing up a fully encrypted database is the same as for normal, unencrypted databases, since the encryption process is performed transparently.
• Back Up the Database Encryption Key
  To resume recoverability, you must back up the database encryption key, the master or dual master key, and the encrypted database.
• Restore (Load) Backups of Fully Encrypted Databases
  Restore a fully encrypted database as you would a normal, unencrypted database.
• Loading Behavior of Encrypted Databases
  Loading behavior differs, depending on the encryption status of both the target database and the database or transaction log being restored.
• Dropping a Database That is Being Encrypted
  When you execute the drop database command on a database that is being encrypted or decrypted, drop database terminates the encryption/decryption process, searches the sysattributes system table, cleans up all the progress information, and then drops the database.
• Mounting and Unmounting a Fully Encrypted Database
  You cannot mount a database that is being encrypted or decrypted; you also cannot mount an encrypted database.
• Archive Databases and Full Encryption
  Archive databases are read-only. The encryption syntax indicates that an archive database can load an encrypted database dump.