用戶端加密與 BigQuery 靜態資料加密無關。如果您選擇使用用戶端加密技術，則必須負責管理用戶端金鑰和密碼編譯作業。您必須先將資料加密，再將資料寫入 BigQuery。在這種情況下，您的資料會被加密兩次，第一次是使用您的金鑰，第二次是使用 Google 金鑰。相同道理，從 BigQuery 讀取的資料會經過兩次解密，第一次是使用 Google 金鑰，第二次是使用您的金鑰。
傳輸中的資料
為了確保您的資料在網際網路上傳輸讀寫作業時能安全無虞， Google Cloud 會使用傳輸層安全標準 (TLS)。詳情請參閱 Google Cloud中的傳輸加密一文。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-08 (世界標準時間)。"],[[["BigQuery automatically encrypts customer data at rest using Google default encryption, which employs robust key management systems and the Advanced Encryption Standard (AES)."],["Customers can opt for customer-managed encryption keys (CMEKs) via Cloud KMS to gain more control over key protection, location, rotation, and access permissions."],["Cloud KMS Autokey simplifies CMEK management by automatically generating key rings and keys during resource creation in BigQuery, and handles the creation of the necessary service agents."],["For encrypting individual values within a table, BigQuery supports Authenticated Encryption with Associated Data (AEAD) encryption functions, allowing for different keys per customer."],["Client-side encryption can be implemented, providing a second layer of encryption before data is written to BigQuery, but users are fully responsible for the management of client-side keys and cryptographic operations."]]],[]]
