I will try it , thanks to Ben Spead.

thanks Eduard。  It is not necessary to mark whold DB as RO, only want to mark partial CLS as RO。 I found this feature，so is there any options about CLS for mark it as RO。

I tried your method yet。Before base64 encryption, the string is encrypted by AES. If the string is encrypted by intercepting the string, if the Chinese character is encountered, the AES encryption string of one Chinese character will be probably intercepted into two strings, and the encrypted data will have problems。