TDE does not increase the size of the encrypted database.īenefits of using TDE include the following:

The pages in an encrypted database are encrypted before they are written to disk and decrypted when read into memory. This enables software developers to encrypt data by using AES and 3DES encryption algorithms without changing existing applications.Įncryption of the database file is performed at the page level. It provides the ability to comply with many laws, regulations, and guidelines established in various industries. TDE protects data at rest, meaning the data and log files. The DEK is a symmetric key secured by using a certificate stored in the master database of the server or an asymmetric key protected by an EKM module. The encryption uses a database encryption key (DEK), which is stored in the database boot record for availability during recovery. TDE performs real-time I/O encryption and decryption of the data and log files. To prevent unauthorized decryption, TDE stores the encryption keys in a security module external to the database. TDE encrypts sensitive data stored in data files. To protect these data files, SQL Server provides TDE. SQL Server uses authentication, authorization, and auditing mechanisms to secure data in the database but not in the operating system data files where data is stored. TDE helps protect data stored on media in the event that the storage media or data file is stolen. Encrypted data is transparently decrypted for a database user or application that has access to data.

Transparent Data Encryption (TDE) enables you to encrypt sensitive data, such as credit card numbers, stored in tables and FileGroups. This prevents anyone without the keys from using the data, but this kind of protection must be planned in advance. One solution is to encrypt the sensitive data in the database and protect the keys used to encrypt the data with a certificate.

However, in a scenario where the physical media (such as drives or backup tapes) are stolen, a malicious party can restore or attach the database and browse the data. You can take several precautions to help secure the database, such as designing a secure system, encrypting confidential assets, and building a firewall around the database servers.

Sql server backup master key