一、系统环境

操作系统：Ubuntu 24.04
数据库:8.4.4-commercial for Linux on x86_64 (MySQL Enterprise Server - Commercial)

二、安装TDE组件

前提：检查组件文件是否存在

ls /usr/lib/mysql/plugin/component_keyring_encrypted_file.so

1.配置全局清单文件

在basedir目录中创建全局清单文件，设置为只读权限，目的是告诉服务器要加载哪个密钥环组件

vim /usr/sbin/mysqld.my# 内容如下 {"read_local_manifest": false,"components": "file://component_keyring_encrypted_file"
}

2.配置全局配置文件

在plugin_dir目录创建一个全局配置文件，设置为只读权限

vim /usr/lib/mysql/plugin/component_keyring_encrypted_file.cnf# 内容如下{"read_local_config": false,"path": "/var/lib/mysql-keyring/component_keyring_encrypted_file","password": "AFJQvNQo8GM1!","read_only": false
}

3.创建密钥环文件

# 创建密钥环文件 确保密钥文件目录权限严格touch /var/lib/mysql-keyring/component_keyring_encrypted_file
chown mysql:mysql /var/lib/mysql-keyring/component_keyring_encrypted_file
chmod 700 /var/lib/mysql-keyring/component_keyring_encrypted_file

4.修改apparmor配置

修改apparmor  用于将配置文件加载到内核中  否则系统不会自动加载清单文件，查询会返回"Empty set"

vim /etc/apparmor.d/usr.sbin.mysqld# 添加下面内容到最后面# Allow keyring manifest read file/usr/sbin/mysqld.my r,

完成后重启apparmor

systemctl reload apparmor.service

5.修改配置文件

修改my,cnf添加默认表加密的配置参数

vim /etc/mysql/mysql.conf.d/mysqld.cnf# 添加下面的内容# table_encryption
default_table_encryption = ON

6.重启数据库

重启数据库后TDE组件和参数会马上生效

7.检查TDE状态

验证组件Component_status，查询keyring_component_status

# 查看组件安装情况 Component_statusSELECT * FROM performance_schema.keyring_component_status;
+---------------------+---------------------------------------------------------+
| STATUS_KEY          | STATUS_VALUE                                            |
+---------------------+---------------------------------------------------------+
| Component_name      | component_keyring_encrypted_file                        |
| Author              | Oracle Corporation                                      |
| License             | PROPRIETARY                                             |
| Implementation_name | component_keyring_encrypted_file                        |
| Version             | 1.0                                                     |
| Component_status    | Active                                                  |
| Data_file           | /var/lib/mysql-keyring/component_keyring_encrypted_file |
| Read_only           | No                                                      |
+---------------------+---------------------------------------------------------+
8 rows in set (0.00 sec)

三、表加密和解密

1.表加密和解密

1.对于已经创建好的表，通过执行SQL可以进行表进行加密和解密

-- 表加密ALTER TABLE database.tablename ENCRYPTION='Y';-- 表解密ALTER TABLE database.tablename ENCRYPTION='N';

2.批量生成未加密表执行加密的SQL语句

-- 生成非业务的表的加密脚本SELECT TABLE_SCHEMA, TABLE_NAME, CREATE_OPTIONS, CONCAT("ALTER TABLE `",TABLE_SCHEMA,"`.`",table_name,"` ENCRYPTION='Y';") AS enable_tde FROM INFORMATION_SCHEMA.TABLES 
WHERE TABLE_SCHEMA NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys') AND CREATE_OPTIONS NOT LIKE '%ENCRYPTION%' ORDER BY TABLE_SCHEMA;

3.查看已经加密的表

-- 查看加密的表SELECT TABLE_SCHEMA, TABLE_NAME, CREATE_OPTIONS FROM INFORMATION_SCHEMA.TABLES WHERE CREATE_OPTIONS LIKE '%ENCRYPTION%';