是的。InnoDB 静态数据加密旨在在数据库内部透明地应用加密，而不会影响现有应用程序。返回加密格式的数据将会破坏大多数现有应用程序。InnoDB 静态数据加密提供了加密的好处，同时避免了传统数据库加密解决方案所带来的开销，这些传统方案通常需要对应用程序、数据库触发器和视图进行昂贵且大量的更改。Yes. InnoDB data-at-rest encryption is designed to transparently apply encryption within the database without impacting existing applications. Returning data in encrypted format would break most existing applications. InnoDB data-at-rest encryption provides the benefit of encryption without the overhead associated with traditional database encryption solutions, which would typically require expensive and substantial changes to applications, database triggers, and views.

没有额外的存储开销。根据内部基准测试，性能开销仅为个位数百分比的差异。There is no additional storage overhead. According to internal benchmarks, performance overhead amounts to a single digit percentage difference.

InnoDB静态数据加密支持高级加密标准（AES256）块加密算法。它使用电子代码本（ECB）块加密模式进行表空间密钥加密，使用密码块链接（CBC）块加密模式进行数据加密。InnoDB data-at-rest encryption supports the Advanced Encryption Standard (AES256) block-based encryption algorithm. It uses Electronic Codebook (ECB) block encryption mode for tablespace key encryption and Cipher Block Chaining (CBC) block encryption mode for data encryption.

不可以，无法使用其他加密算法。提供的加密算法被广泛接受。No, it is not possible to use other encryption algorithms. The provided encryption algorithm is broadly accepted.

InnoDB静态数据加密支持所有索引的透明加密。InnoDB data-at-rest encryption supports all indexes transparently.

InnoDB 数据静态加密支持所有受支持的数据类型。数据长度没有限制。InnoDB data-at-rest encryption supports all supported data types. There is no data length limitation.

通过 InnoDB 数据静态加密功能加密的数据在从表空间文件中读取时会被解密。因此，如果数据在网络上传输，它是以明文形式存在的。但是，网络上的数据可以使用 MySQL 网络加密进行加密，该加密使用 SSL/TLS 加密数据库来回传输的数据。Data encrypted by the InnoDB data-at-rest feature is decrypted when it is read from the tablespace file. Thus, if the data is on the network, it is in cleartext form. However, data on the network can be encrypted using MySQL network encryption, which encrypts data traveling to and from a database using SSL/TLS.

使用 InnoDB 数据静态加密时，内存中的数据是解密的，这提供了完全的透明性。With InnoDB data-at-rest encryption, in-memory data is decrypted, which provides complete transparency.

遵守 PCI-DSS 标准要求信用卡号码（主要账户号码，或“PAN”）以加密形式存储。违规通知法律（例如，加州 SB 1386、加州 AB 1950 以及美国其他 43 个州的类似法律）要求加密名字、姓氏、驾驶执照号码和其他个人身份信息（PII）数据。2008 年初，加州 AB 1298 将医疗和健康保险信息添加到 PII 数据中。此外，特定行业的隐私和安全标准可能要求对某些资产进行加密。例如，药物研究结果、油田勘探结果、金融合同或执法线人的个人数据等资产可能需要加密。在医疗行业，患者数据、健康记录和 X 光影像的隐私至关重要。Compliance with the PCI-DSS standard requires that credit card numbers (Primary Account Number, or 'PAN') be stored in encrypted form. Breach Notification Laws (for example, CA SB 1386, CA AB 1950, and similar laws in 43+ more US states) require encryption of first name, last name, driver license number, and other PII data. In early 2008, CA AB 1298 added medical and health insurance information to PII data. Additionally, industry specific privacy and security standards may require encryption of certain assets. For example, assets such as pharmaceutical research results, oil field exploration results, financial contracts, or personal data of law enforcement informants may require encryption. In the health care industry, the privacy of patient data, health records and X-ray images is of the highest importance.

MySQL 中有对称和非对称加密 API，可用于手动加密数据库中的数据。然而，应用程序必须管理加密密钥，并通过调用 API 函数执行必要的加密和解密操作。InnoDB 静态数据加密无需对应用程序进行更改，对最终用户是透明的，并提供自动化、内置的密钥管理。There are symmetric and asymmetric encryption APIs in MySQL that can be used to manually encrypt data within the database. However, the application must manage encryption keys and perform required encryption and decryption operations by calling API functions. InnoDB data-at-rest encryption requires no application changes, is transparent to end users, and provides automated, built-in key management.

是的。加密的每表表空间支持此功能。有关更多信息，请参见 导出加密表空间。Yes. It is supported for encrypted file-per-table tablespaces. For more information, see Exporting Encrypted Tablespaces.

使用 InnoDB 静态数据加密的用户可以充分利用压缩功能，因为压缩是在数据块加密之前应用的。Customers using InnoDB data-at-rest encryption receive the full benefit of compression because compression is applied before data blocks are encrypted.

可以。由于这些工具创建的是逻辑备份，从加密表中导出的数据不会被加密。Yes. Because these utilities create logical backups, the data dumped from encrypted tables is not encrypted.

InnoDB 静态数据加密使用两级密钥机制。当使用静态数据加密时，单个表空间密钥会存储在底层表空间数据文件的头部。表空间密钥使用主加密密钥加密。主加密密钥在启用表空间加密时生成，并存储在数据库之外。主加密密钥可以通过 ALTER INSTANCE ROTATE INNODB MASTER KEY 语句进行轮换，该语句生成新的主加密密钥、存储该密钥并将其投入使用。InnoDB data-at-rest encryption uses a two tier key mechanism. When data-at-rest encryption is used, individual tablespace keys are stored in the header of the underlying tablespace data file. Tablespace keys are encrypted using the master encryption key. The master encryption key is generated when tablespace encryption is enabled, and is stored outside the database. The master encryption key is rotated using the ALTER INSTANCE ROTATE INNODB MASTER KEY statement, which generates a new master encryption key, stores the key, and rotates the key into use.

将数据从一个表空间传输到另一个表空间不是必需的。要加密 InnoDB 单表表空间中的数据，请运行 ALTER TABLE tbl_name ENCRYPTION = 'Y'。要加密通用表空间或 mysql 表空间，请运行 ALTER TABLESPACE tablespace_name ENCRYPTION = 'Y'。MySQL 8.0.13 引入了对通用表空间的加密支持。MySQL 8.0.16 开始支持 mysql 系统表空间的加密。Transferring data from one tablespace to another is not required. To encrypt data in an InnoDB file-per-table tablespace, run ALTER TABLE tbl_name ENCRYPTION = 'Y'. To encrypt a general tablespace or the mysql tablespace, run ALTER TABLESPACE tablespace_name ENCRYPTION = 'Y'. Encryption support for general tablespaces was introduced in MySQL 8.0.13. Encryption support for the mysql system tablespace is available as of MySQL 8.0.16.