PowerProtect Data Manager 19.19 Microsoft SQL Server User Guide
SQL Server transparent data encryption
Microsoft SQL transparent data encryption (TDE) is a feature that performs real-time I/O encryption and decryption of the data and log files.
The Microsoft application agent when installed with ItemPoint 8.6.1:
- Supports Microsoft SQL Server Transparent Data Encryption (TDE).
- Enables table-level recovery from encrypted SQL backups (Application Direct and Application Aware backups).
The Microsoft application agent supports TDE for:
- AES_128, AES_192, and AES_256 encryption algorithms.
- Application Direct, VM Direct, and Application Aware workflows.
The Microsoft application agent does not support:
- TDE for DES/RC/Triple_DES encryption types.
- Third-party transparent data encryption for SQL VDI.
TDE uses a database encryption key (DEK), which is stored in the database boot record for availability during recovery. Encryption of the database file is performed at the page level. The pages in an encrypted database are encrypted before they are written to disk and decrypted when read into memory. When using this feature, ensure that the certificate and private key are backed up with the encrypted data.
Microsoft SQL Server 2008 and later include the TDE database-level encryption feature. This feature provides protection for the entire database at rest, without affecting existing applications. The Microsoft application agent supports SQL data encryption at the cell level, at the full database level by using TDE, and at the file-level with encryption options provided by Microsoft.
NOTE:Cyber Recovery supports scanning encrypted SQL databases if the
following requirements are met:
- You are using SQL Server 2019 (15.x) or later.
- If you are using a SQL Server version between SQL Server 2016 (13.x)
and SQL Server 2019 (15.x), the MaxTransferSize setting must be larger
than 65536.
A setting larger than 65536 enables an optimized compression that takes an encrypted TDE encrypted database, first decrypts a page, then compresses it then encrypts it again. Cyber Recovery is only supported when the databases are TDE encrypted, and when the compression is done using optimized compression. If the MaxTransferSize setting is not specified, or less than 65536, compression is performed using direct compression, and Cyber Recovery does not support that use case.
The Microsoft SQL Server product documentation provides more information about TDE, enabling data encryption, protecting the encryption keys, and configuring SQL Server 2016 and SQL Server 2019 for TDE enabled databases and MaxTransferSize.
CAUTION:When enabling TDE, back up the certificate and the private key associated with the certificate. If the certificate becomes unavailable or if the database is restored on another server, backups of both the certificate and the private key must be available to open the database.
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\