blocks|key|4025220|text|如果您在存储敏感信息，那么在网络上使用enable+SSL也更好。还要考虑敏感数据库计算机的网络分离(vlan)和其他标准安全实践。密钥存储很重要(共享的aes密钥挂在哪里，肯定不在Key服务器上！)考虑对索引/查询的影响，因为搜索或连接表数据将不再像以前那么简单。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|4025221|entityMap|0|LINK|mutability|MUTABLE|url|http://dev.mysql.com/doc/refman/5.0/en/ssl-basics.html^0|J|A|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Along with AES_ENCRYPT for the fields, if you are storing sensitive information, better <a href="http://dev.mysql.com/doc/refman/5.0/en/ssl-basics.html" rel="nofollow noreferrer">enable SSL</a> over the wire too. Also consider network separation (vlan) of the sensitive database machines and other standard security practices. Key storage is important (where is that shared aes key hanging out, surely not on the webserver(s)!) and consider the impact on indexes/queries since searching or joining table data will not be as simple as it once was.

blocks|key|1573948|text|实际上(至少)有两种方法。您可以加密表中存储的数据(使用EAS/DES函数，例如http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html)|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1573949|或者，您可以使用加密硬盘分区来存储数据文件夹(例如，使用TrueCrypt)|1573950|entityMap|0|LINK|mutability|MUTABLE|url|http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html^0|14|1S|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

There are (at least) two approaches actually. You can encrypt data stored in your tables (using EAS/DES functions for example <a href="http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html" rel="nofollow noreferrer">http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html</a>)

Or you can use encrypted hard disk partition to store your data folders (for example with TrueCrypt)

blocks|key|827665|text|在字段级别加密数据库的价值是什么？这是您真正想要的，还是在操作系统或SAN级别加密就足够了？您是计划将密钥翻转，还是永久保留相同的加密密钥？加密是否会破坏表索引、引用或字段类型？您将如何在数据库集群之间共享加密密钥？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|827666|我之所以提出这些观点，是因为数据库加密通常是管理层想要的东西，但没有人能真正解释它的增值或它将如何实现……|827667|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

What's the value of encrypting the database at the field level? Is this what you really want, or will it be sufficient to encrypt at the OS or SAN level? Do you plan to roll-over the keys, or just keep the same encryption key for eternity? Will encryption break table indexes, references or field types? How will you share the encryption key across a database cluster? 

I'm only raising these points because database encryption is usually something management wants, but no-one really can explain the value-add or how it will be implemented...

blocks|key|1570273|text|想一想你想通过加密来实现什么？不幸的是，没有简单安全的解决方案。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1570274|请记住，可以从您的代码中获取用于加密的密钥。因此，从黑客的角度来看，绕过加密是相当容易的。你需要考虑你的架构和基础设施。|1570275|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Think what you try to achieve with the encryption? There's no simple secure solution unfortunately.

Remember that the key you are using for encryption can be fetched from your code. So from hacker perspective, getting around that encryption is quite easy. You need to think your architecture and infra as well.

blocks|key|827686|text|首先，只有数据加密不是解决问题的办法。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|827687|你应该知道并控制“谁可以访问和访问数据”。|827688|虽然数据本身是加密的，但攻击者可以获得加密的数据。为了防止这种情况，您应该控制访问特权或权限。此外，您还应该知道谁访问了加密数据。因为在这些日子里，数据不仅可以被外部用户窃取，也可以被内部用户窃取。|827689|您应该对数据进行加密，控制权限，并对访问人员进行审计。|827690|在那些日子里，这三(3)项技术已经以每种方式得到了发展。大多数公司都购买了每种解决方案。|827691|但对于个人用户来说，很难购买它并自行构建这些环境。此外，MySQL的加密功能不提供这些功能。|827692|我想让您回顾一下提供这三(3)个函数的。|827693|根据我的经验，它可以提供一定的安全性。(我是SME的CISO。)|827694|entityMap^0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|V|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|W|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|X|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|Y|8|@]|9|@]|A|$]]|$1|P|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|Q|$]]

First of all, only data encryption is not the answer.

You should know and control "Who can access and accessed data".

Although you encrypt data itself, attacker can get the encrypted data. To prevent it, you should control the access privilege or authority. Also, you should know who accessed encrypted data. Because in these days, data can be stolen by not only external users, but also internal users.

You should encrypt data, control privilege and audit who accessed.

In those days, those three(3) technology have been developed in each way. Most companies have bought each solutions.

But for personal user, it is hard to buy it and build those environment itself.
In addition, MySQL's Encryption Function doesn't provide those functions.

I would you like to review this <a href="http://www.mydiamo.com" rel="nofollow">link</a> that provides those three(3) functions.

In my experience, it can provide certain security.(I'm CISO of SME.)

I'm looking for guidance on encrypting fields (and/or tables if possible) for MySQL. I will settle for a decent tutorial but I'd really like specific tips on managing the transition from an unencrypted schema to one utilizing encrypted fields. Thanks!

Best Practices for MySQL Encryption?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我正在寻找MySQL的加密域(和/或表，如果可能)的指导。我将满足于一个像样的教程，但我真的想要管理从未加密的模式到使用加密域的模式的转换的具体技巧。谢谢!

问MySQL加密的最佳实践？
EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问MySQL加密的最佳实践？EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问MySQL加密的最佳实践？
EN