GBase 8a supports transparent storage encryption with the SM4 national cipher . You can encrypt at table level or column level . Enabling it on existing data requires a migration, and it adds a controlled CPU overhead to queries.

Encryption Granularity

Table‑level : encrypts all columns.

CREATE TABLE t1 ( a INT , b VARCHAR ( 10 )) ENCRYPT ;

Enter fullscreen mode

Exit fullscreen mode

Column‑level : encrypts only the sensitive columns you specify.

CREATE TABLE t2 ( a INT , b VARCHAR ( 10 ) ENCRYPT , c DATE );

Enter fullscreen mode

Exit fullscreen mode

Once set, the encryption attribute cannot be changed via ALTER TABLE . The algorithm is chosen with the _gbase_encrypt_new_mode parameter — 1 for AES (default) or 2 for SM4 — and cannot be switched after encrypted data exists.

Impact on Existing Data

You cannot encrypt an existing table in place. You must create a new table with the ENCRYPT keyword and migrate data with INSERT ... SELECT .…