Mysql默认AES加密数据库中的所有表

Question

I need to hide data from user access in mysql. Even if user knows the password he may need a key to decrypt the data. is it possible?

In mysql there is AES_ENCRYPT option to encrypt data when insert, Is there any option to give default encryption for all table columns in a database?

Answer 1

you probably need to do this in your application and not in mysql directly. store the data encrypted but decrypt/encrypt in your application level code

Answer 2

What's the point of allowing a user to connect if they don't have the key to decrypt, and all tables are encrypted? You need to edit your question to describe your use case in more detail.

Controlling access per user is more flexible. Suppose you use encryption, and one day you want to disable access for one particular user. You'd have to change the key, and that means you must re-encrypt all the data with the new key, and then notify all other users of the updated key. That's very inconvenient.

Whereas if you just use their login or their GRANT privileges to control access, you can disable any single user's account and/or use REVOKE to change their privileges. All other users would continue to have the access they did before. That's much easier.

Besides, MySQL has no global "encrypt all tables" option. It doesn't even have an option to encrypt all data inserted into a given table.

MySQL has some encryption functions like AES_ENCRYPT() but it's handled at the level of individual SQL expressions:

INSERT INTO MyTable 
SET someColumn = AES_ENCRYPT('Something sensitive', 'thePassword');

You would have to do this every time you insert or update a row.

Then decrypt similarly every time you SELECT:

SELECT AES_DECRYPT(someColumn, 'thePassword') FROM MyTable...

Someone above mentioned MariaDB encryption. This doesn't do what you want. It means the tablespace file on disk is encrypted, but still the MariaDB server automatically decrypts it for anyone who connects to the server. So it's no better than SQL access privileges. It also fails to encrypt query logs or error logs or binary logs.