The DMK is a symmetric key, just like you find with column-level encryption. In the TDE encryption hierarchy, the SMK sits below the DPAPI, and a DMK sits below the SMK. You can use the key to encrypt credentials, linked server passwords, and the database master keys (DMKs) residing in different databases.

SQL Server creates the SMK the first time the instance is started. In TDE encryption hierarchy the Windows Data Protection API (DPAPI) sits at the top of the hierarchy and is used to encrypt the service master key (SMK), a symmetric key that resides in the master database.

TDE requires planning but can be implemented without changing the database. The data in unencrypted data files can be read by restoring the files to another server. Without the original encryption certificate and master key, the data cannot be read when the drive is accessed or the physical media is stolen. Transparent Data Encryption (TDE) encrypts the data within the physical files of the database, the 'data at rest'. Encrypting data at rest can help prevent those with malicious intent from being able to read the data should they manage to access the files. TDE protects the physical media that hold the data associated with a user database, including the data and log files and any backups or snapshots. With the release of SQL Server 2008, Microsoft expanded the database engine’s security capabilities by adding Transparent Data Encryption (TDE), a built-in feature for encrypting data at rest.

13130 views 0 minutes to read Contributors Introduction

Download sql backup master key to file