Full Database Encryption

SAP ASE version 16.0 introduces the ability to fully encrypt databases.

Earlier versions of SAP ASE allowed you to encrypt columns. With version 16.0, you can fully encrypt entire databases, providing protection for an entire database. When you fully encrypt a database, all of its data, indexes, and transaction logs become encrypted. This encryption is transparent, so that users can perform operations on tables, indexes, and so on, as usual, without noticing any differences.

SAP ASE encrypts data at the page level. Once your database is set up as encrypted, the encryption and decryption process is automatic. Data is encrypted just before the page is written into disk, and decrypted as soon as the data page is loaded into memory.

• Full Database Encryption Versus Encrypted Columns
  Encrypt entire databases, or only columns, depending on your needs.
• Creating the Database Encryption Key
  The database encryption key is a 256-bit symmetric key that is created in the master database and used to encrypt a database.
• Create an Encrypted Database
  To create a fully encrypted database, use the create database command.
• Encrypt an Existing Database
  In SAP ASE version 16.0, you can encrypt an unencrypted database using the alter database command.
• Encryption Status and Progress
  There are two ways to find out what the encryption status is on a database.
• Performance Considerations
  When an existing database is being encrypted, it is still kept online. Take performance issues into consideration to mitigate the impact on user access to the database, as well as general SAP ASE response time.
• Suspend the Encryption Process
  To stop encrypting a database in the process of being encrypted, use the the suspend encrypt option of the alter database command:
• Resume the Encryption Process
  To resume encrypting a database that had its encryption process interrupted or suspended, use the resume encryption option of the alter database command:
• Decrypt an Encrypted Database
  To decrypt a fully encrypted database, use the alter database command.
• Recover Fully Encrypted Databases
  If SAP ASE cannot retrieve the database encryption key during start-up because the master or dual master key is unavailable, SAP ASE ignores the encrypted database.
• Back Up (Dump) a Fully Encrypted Database
  Backing up a fully encrypted database is the same as normal, unencrypted databases, since the encryption process is performed transparently.
• Restore (Load) Backups of Fully Encrypted Databases
  Restore a fully encrypted database as you would a normal, unencrypted database.
• Dropping a Database That is Being Encrypted
  You can drop a database that is being encrypted or decrypted.
• Mounting and Unmounting a Fully Encrypted Database
  You cannot mount a database that is being encrypted or decrypted.
• Archive Databases and Full Encryption
  Archive databases are read-only. The encryption syntax indicates that an archive database can load an encrypted database dump.
• Full Database Encryption and System Changes
  There are system changes associated with the full database encryption feature of SAP ASE 16.0.