检测到您已登录华为云国际站账号，为了您更好的体验，建议您访问国际站服务网站 https://www.huaweicloud.com/intl/zh-cn
不再显示此消息
检测到您已登录华为云国际站账号，为了您更好的体验，建议您访问国际站服务网站 https://www.huaweicloud.com/intl/zh-cn
不再显示此消息
Upload encrypted data to the OBS bucket. The encryption SDKs encrypt the uploaded data plaintext using the obtained DEK and store the encrypted object ciphertext to OBS. Decryption principle Figure 3 Decryption principle Download the objects.
Table 1 Impact on encrypted disks after a custom key becomes unavailable Custom Key Status Impact on Encrypted Disks Restoration Method Disabled If an encrypted disk is then attached to an ECS, the disk can still be used, but normal read/write operations are not guaranteed permanently
Method 2: Create an encrypted image using an encrypted ECS. When you use an ECS to create a private image, if the system disk of the ECS is encrypted, the private image created using the ECS is also encrypted.
When creating an ECS, if you select an encrypted image, the system disk of the created ECS automatically has encryption enabled, with its encryption mode same as the image encryption mode. When creating an ECS, you can encrypt added data disks.
In the text box on the left, enter the data to be encrypted, as shown in Figure 1. Figure 1 Encrypting data Click Execute. The encrypted data is displayed in the Encryption/Decryption Result area. Use the current CMK to encrypt the data. To clear your input, click Clear.
In the text box on the left, enter the data to be encrypted, as shown in Figure 1. Figure 1 Encrypting data Click Execute. The encrypted data is displayed in the Encryption/Decryption Result area. Use the current CMK to encrypt the data. To clear your input, click Clear.
If you scale up a DB instance with disks encrypted, the expanded storage space will be encrypted using the original encryption key.
If you scale up a DB instance with disks encrypted, the expanded storage space will be encrypted using the original encryption key.
Then the application can store the encrypted data. In addition, the user application can call the KMS API to create CMKs. DEKs can be stored in ciphertext after being encrypted with the CMKs.
Advantages Secret encryption Secrets are encrypted by KMS before storage. Encryption keys are generated and protected by authenticated third-party HSM. When you retrieve secrets, they are transferred to local servers via TLS.
When you download encrypted objects, the encrypted data will be decrypted on the server and displayed in plaintext.
When you upload objects in encryption mode, data is encrypted at the server side and then securely stored on OBS in ciphertext. When you download encrypted objects, the data in ciphertext is decrypted at the server side and then provided to you in plaintext.
Each enterprise has its core sensitive data, which needs to be encrypted and protected from breach. Data Encryption Workshop (DEW) is a cloud data encryption service.
You can create a DEK in either of the following ways: If you call the create-datakey API, it returns the plaintext DEK and the ciphertext DEK encrypted using the specified CMK.
If it is encrypted, its backup data will be stored in encrypted mode.
Before deletion, confirm that the CMK's encrypted data has all been migrated. As soon as the CMK is deleted, you will not be able to decrypt data with it. Therefore, KMS offers a user-specified period of 7 to 1096 days for the deletion to finally take effect.
If you have permanently deleted your custom key, the data encrypted using it cannot be decrypted. Before the scheduled deletion date of the custom key, you can cancel the scheduled deletion. Parent topic: KMS Related
The backup file is encrypted and encoded and cannot be directly read.
In asymmetric encryption scenarios, if the encrypted plaintext contains invisible characters, the value is used as the decryption result.
Secret values are encrypted and stored in secret versions. A version can have multiple statuses. Versions without any statuses are regarded as deprecated versions and can be automatically deleted by CSMS. The initial version is marked by the SYSCURRENT status tag.
