MySQL 加密的最佳实践？
我正在寻找有关加密 MySQL 字段（和/或表，如果可能）的指南。我会满足于一个像样的教程，但我真的很想要有关管理从未加密模式到利用加密字段的转换的具体技巧。谢谢！
I'm looking for guidance on encrypting fields (and/or tables if possible) for MySQL. I will settle for a decent tutorial but I'd really like specific tips on managing the transition from an unencrypted schema to one utilizing encrypted fields. Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
除了字段的 AES_ENCRYPT 之外，如果您要存储敏感信息，最好使用 也通过网络启用 SSL。还要考虑敏感数据库计算机的网络隔离 (vlan) 和其他标准安全实践。密钥存储很重要（共享 aes 密钥在哪里，肯定不是在网络服务器上！）并考虑对索引/查询的影响，因为搜索或连接表数据将不再像以前那么简单。
Along with AES_ENCRYPT for the fields, if you are storing sensitive information, better enable SSL over the wire too. Also consider network separation (vlan) of the sensitive database machines and other standard security practices. Key storage is important (where is that shared aes key hanging out, surely not on the webserver(s)!) and consider the impact on indexes/queries since searching or joining table data will not be as simple as it once was.
实际上有（至少）两种方法。您可以加密存储在表中的数据（使用 EAS/DES 函数，例如 http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html）
或者您可以使用加密的硬盘分区来存储您的数据文件夹（例如使用TrueCrypt）
There are (at least) two approaches actually. You can encrypt data stored in your tables (using EAS/DES functions for example http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html)
Or you can use encrypted hard disk partition to store your data folders (for example with TrueCrypt)
在字段级别加密数据库有什么价值？这是您真正想要的，还是在操作系统或 SAN 级别进行加密就足够了？您打算滚动更新密钥，还是永远保留相同的加密密钥？加密会破坏表索引、引用或字段类型吗？您将如何在数据库集群中共享加密密钥？
我只是提出这些观点，因为数据库加密通常是管理层想要的东西，但没有人真正能够解释增值或如何实施......
What's the value of encrypting the database at the field level? Is this what you really want, or will it be sufficient to encrypt at the OS or SAN level? Do you plan to roll-over the keys, or just keep the same encryption key for eternity? Will encryption break table indexes, references or field types? How will you share the encryption key across a database cluster?
I'm only raising these points because database encryption is usually something management wants, but no-one really can explain the value-add or how it will be implemented...
想想你试图通过加密实现什么目的？不幸的是，没有简单的安全解决方案。
请记住，您用于加密的密钥可以从您的代码中获取。因此，从黑客的角度来看，绕过加密非常容易。您还需要考虑您的架构和基础设施。
Think what you try to achieve with the encryption? There's no simple secure solution unfortunately.
Remember that the key you are using for encryption can be fetched from your code. So from hacker perspective, getting around that encryption is quite easy. You need to think your architecture and infra as well.
首先，仅仅数据加密并不是答案。
您应该了解并控制“谁可以访问和访问数据”。
尽管您对数据本身进行了加密，但攻击者仍然可以获取加密后的数据。为了防止这种情况发生，您应该控制访问权限或权限。此外，您应该知道谁访问了加密数据。因为如今，数据不仅可能被外部用户窃取，也可能被内部用户窃取。
您应该加密数据、控制权限并审核访问者。
在那些日子里，这三（3）种技术已经以各自的方式发展起来。大多数公司都购买了每种解决方案。
但对于个人用户来说，很难购买并自行构建这些环境。
另外，MySQL的加密功能不提供这些功能。
我希望您查看一下提供这三 (3) 种功能的链接。
根据我的经验，它可以提供一定的安全性。（我是中小企业的CISO。）
First of all, only data encryption is not the answer.
You should know and control "Who can access and accessed data".
Although you encrypt data itself, attacker can get the encrypted data. To prevent it, you should control the access privilege or authority. Also, you should know who accessed encrypted data. Because in these days, data can be stolen by not only external users, but also internal users.
You should encrypt data, control privilege and audit who accessed.
In those days, those three(3) technology have been developed in each way. Most companies have bought each solutions.
But for personal user, it is hard to buy it and build those environment itself.
In addition, MySQL's Encryption Function doesn't provide those functions.
I would you like to review this link that provides those three(3) functions.
In my experience, it can provide certain security.(I'm CISO of SME.)