MySQL 表空间加密插件 Keyring

点击上方"蓝字"

关注我们，享更多干货！

# 前言

MySQL支持对InnoDB单表空间、通用表空间、系统表空间和Redo、Undo文件进行静态加密。从8.0.16开始支持对Schema和通用表空间设置加密默认值，这就允许对在这些Schema和表空间中的表是否加密进行统一控制；静态加密功能依赖于Keyring组件或插件，MySQL社区版提供的Keyring file插件会将Keyring数据存储在服务器主机的本地文件系统中。

01 安装

mkdir /usr/local/mysql/keyring
chown -R mysql.mysql keyring

• 配置文件中增加 
  

[mysqld]early-plugin-load=keyring_file.sokeyring_file_data=/usr/local/mysql/keyring/keyring

• 重启数据库

mysql> select * from information_Schema.plugins where plugin_name like '%keyring%'\G
*************************** 1. row ***************************
           PLUGIN_NAME: keyring_file        
           PLUGIN_VERSION: 1.0         
           PLUGIN_STATUS: ACTIVE           
           PLUGIN_TYPE: KEYRING
   PLUGIN_TYPE_VERSION: 1.1
        PLUGIN_LIBRARY: keyring_file.so
PLUGIN_LIBRARY_VERSION: 1.10
         PLUGIN_AUTHOR: Oracle Corporation
    PLUGIN_DESCRIPTION: store/fetch authentication data to/from a flat file
        PLUGIN_LICENSE: GPL
           LOAD_OPTION: ON
           
mysql> show global variables like '%keyring%';
+--------------------+----------------------------------+
| Variable_name      | Value                            |
+--------------------+----------------------------------+
| keyring_file_data  | /usr/local/mysql/keyring/keyring |
| keyring_operations | ON                               |
+--------------------+----------------------------------+
2 rows in set (0.02 sec)

02 加密操作

mysql> alter table t7 encryption='Y';  Query OK, 2 rows affected (0.10 sec)
Records: 2  Duplicates: 0  Warnings: 0


mysql> alter table t2 encryption='Y'; 
Query OK, 1 row affected (0.11 sec)
Records: 1  Duplicates: 0  Warnings: 0




mysql> alter  database test DEFAULT ENCRYPTION = 'Y';
Query OK, 1 row affected (0.03 sec)




mysql> ALTER TABLESPACE mysql ENCRYPTION = 'Y';   
Query OK, 0 rows affected (2.80 sec)