alter database for Full Database Encryption

Syntax

alter database database_name
{[encrypt with key_name | decrypt [with key_name]] [parallel degree_of_parallelism]
| resume [encryption | decryption [parallel degree_of_parallelism]]
| suspend [encryption | decryption]
}

Parameters

• database_name – is the name of the database you want to encrypt or decrypt.
• encrypt with key_name – instructs SAP ASE to fully encrypt the database.

  Specifically, the command retrieves the corresponding key ID from the sysencryptkeys system table in the master database and set the encrkeyid column in its related sysdatabases row.

  key_name is the database encryption key you used to encrypt the database. If you do specify a different key name, the command fails and SAP ASE displays an error message.

  SAP ASE fails to run alter database and displays an error message if the database is already:

  • Encrypted with another key.
  • Being encrypted.

  If you run this command on a partially encrypted database that is not currently being encrypted, SAP ASE treats the command as if you specified the resume encryption option, as long as the key name is the same as the previously specified key.
• decrypt [with key_name] – instructs SAP ASE to decrypt the database. When decrypting a database, [with key_name] is optional, as SAP ASE looks up the key ID in the sysdatabases system table. The command fails, however, if you specify key_name with a different key name than what was used to encrypt the database.
• resume decryption – instructs SAP ASE to resume the decryption process for the database in which an earlier decryption process was suspended. SAP ASE ignores this command if the database_name is already completely decrypted.
• parallel degree_of_parallelism – determines how many worker threads to initiate for the task.

  Create a thread for each database storage virtual device, as long as the number is equal to or fewer than "number of worker processes" configuration. The degree_of_parallelism number should be no larger than the number of database devices because additional worker threads do not improve encryption performance. If you do not specify degree_of_parallelism, SAP ASE internally defines the value based on the number of online engines, as well as how the database is distributed across various devices.

• resume encryption – resumes the encryption process from the page where encryption was previously suspended.
  The command fails if:

  • There is an encryption process already running in SAP ASE.
  • Encryption was never started on the database.
  • The encryption process already completed.

  You can use parallel degree_of_parallelism with resume encrypt. If you do not specify parallel degree_of_parallelism, SAP ASE determines the value based on how the database is distributed across various engines.

• suspend encryption – terminates all encryption worker threads that are encrypting data. SAP ASE records the progress of encryption so that resume encryption can restart encryption where the previous encryption process stopped. SAP ASE ignores this command if there is no encryption in progress.

Examples

• Example 1 – This example alters an existing database called existdb for encryption using an encryption key called dbkey:

  alter database existdb encrypt with dbkey

  The example does not specify the parallel degree, leaving it up to SAP ASE to determine how many worker threads should be initiated to encrypt existdb in parallel.
• Example 2 – This example suspends an encryption operation on a database called existdb:

  alter database existdb suspend encryption

• Example 3 – This example resumes a suspended encryption on a database called existdb:

  alter database existdb resume encryption

Usage