InnoDB 使用两级加密密钥架构，包括主加密密钥和表空间密钥。当表空间被加密时，表空间密钥会被加密并存储在表空间头中。当应用程序或经过认证的用户想要访问加密的表空间数据时，InnoDB 使用主加密密钥来解密表空间密钥。表空间密钥的解密版本不会改变，但主加密密钥可以根据需要更改。这一操作被称为 主密钥轮换。InnoDB uses a two tier encryption key architecture, consisting of a master encryption key and tablespace keys. When a tablespace is encrypted, a tablespace key is encrypted and stored in the tablespace header. When an application or authenticated user wants to access encrypted tablespace data, InnoDB uses a master encryption key to decrypt the tablespace key. The decrypted version of a tablespace key never changes, but the master encryption key can be changed as required. This action is referred to as master key rotation.

静态数据加密功能依赖于 keyring 组件或插件来管理主加密密钥。The data-at-rest encryption feature relies on a keyring component or plugin for master encryption key management.

所有 MySQL 版本都提供了一个 component_keyring_file 组件，该组件将 keyring 数据存储在服务器主机本地的文件中。All MySQL editions provide a component_keyring_file component, which stores keyring data in a file local to the server host.

MySQL 企业版提供了额外的密钥环组件和插件：MySQL Enterprise Edition offers additional keyring components and plugins:

一个安全且稳健的加密密钥管理解决方案对于安全性以及遵守各种安全标准至关重要。当数据静态加密功能使用集中式密钥管理解决方案时，该功能称为“MySQL 企业透明数据加密 (TDE)”。A secure and robust encryption key management solution is critical for security and for compliance with various security standards. When the data-at-rest encryption feature uses a centralized key management solution, the feature is referred to as “MySQL Enterprise Transparent Data Encryption (TDE)”.

数据静态加密功能支持高级加密标准 (AES) 块加密算法。它对表空间密钥加密使用电子密码本 (ECB) 块加密模式，对数据加密使用密码块链接 (CBC) 块加密模式。The data-at-rest encryption feature supports the Advanced Encryption Standard (AES) block-based encryption algorithm. It uses Electronic Codebook (ECB) block encryption mode for tablespace key encryption and Cipher Block Chaining (CBC) block encryption mode for data encryption.

有关数据静态加密功能的常见问题，请参阅 A.17 节，“MySQL 8.4 常见问题：InnoDB 数据静态加密”。For frequently asked questions about the data-at-rest encryption feature, see Section A.17, “MySQL 8.4 FAQ: InnoDB Data-at-Rest Encryption”.

default_table_encryption 系统变量定义了模式和通用表空间的默认加密设置。CREATE TABLESPACE 和 CREATE SCHEMA 操作在未明确指定 ENCRYPTION 子句时，会应用 default_table_encryption 设置。default_table_encryption system variable defines the default encryption setting for schemas and general tablespaces. CREATE TABLESPACE and CREATE SCHEMA operations apply the default_table_encryption setting when an ENCRYPTION clause is not specified explicitly.

ALTER SCHEMA 和 ALTER TABLESPACE 操作不适用 default_table_encryption 设置。必须显式指定 ENCRYPTION 子句才能修改现有模式或通用表空间的加密。ALTER SCHEMA and ALTER TABLESPACE operations do not apply the default_table_encryption setting. An ENCRYPTION clause must be specified explicitly to alter the encryption of an existing schema or general tablespace.

default_table_encryption 变量可以为单个客户端连接设置，也可以通过 SET 语法全局设置。例如，下面的语句在全局启用默认模式和表空间加密：The default_table_encryption variable can be set for an individual client connection or globally using SET syntax. For example, the following statement enables default schema and tablespace encryption globally:

mysql> SET GLOBAL default_table_encryption=ON;

模式的默认加密设置也可以在创建或修改模式时使用 DEFAULT ENCRYPTION 子句定义，如下例所示：The default encryption setting for a schema can also be defined using the DEFAULT ENCRYPTION clause when creating or altering a schema, as in this example:

mysql> CREATE SCHEMA test DEFAULT ENCRYPTION = 'Y';

如果在创建 schema 时未指定 DEFAULT ENCRYPTION 子句，则会应用 default_table_encryption 设置。必须指定 DEFAULT ENCRYPTION 子句才能更改现有 schema 的默认加密。否则，schema 将保留其当前的加密设置。If the DEFAULT ENCRYPTION clause is not specified when creating a schema, the default_table_encryption setting is applied. The DEFAULT ENCRYPTION clause must be specified to alter the default encryption of an existing schema. Otherwise, the schema retains its current encryption setting.

默认情况下，表会继承其创建所在 schema 或通用表空间的加密设置。例如，在启用加密的 schema 中创建的表默认是加密的。此行为使 DBA 能够通过定义和强制执行 schema 和通用表空间的加密默认值来控制表的加密使用。By default, a table inherits the encryption setting of the schema or general tablespace it is created in. For example, a table created in an encryption-enabled schema is encrypted by default. This behavior enables a DBA to control table encryption usage by defining and enforcing schema and general tablespace encryption defaults.

通过启用 table_encryption_privilege_check 系统变量来强制执行加密默认值。当启用了 table_encryption_privilege_check 时，在创建或更改具有与 default_table_encryption 不同加密设置的模式或通用表空间，或者创建或更改与默认模式加密不同的表时，会进行权限检查。当 table_encryption_privilege_check 被禁用（默认设置）时，不会进行权限检查，并且前述操作允许在有警告的情况下继续进行。Encryption defaults are enforced by enabling the table_encryption_privilege_check system variable. When table_encryption_privilege_check is enabled, a privilege check occurs when creating or altering a schema or general tablespace with an encryption setting that differs from the default_table_encryption setting, or when creating or altering a table with an encryption setting that differs from the default schema encryption. When table_encryption_privilege_check is disabled (the default), the privilege check does not occur and the previously mentioned operations are permitted to proceed with a warning.

TABLE_ENCRYPTION_ADMIN 权限在启用 table_encryption_privilege_check 时，允许覆盖默认加密设置。DBA 可以授予此权限，使用户在创建或修改模式或通用表空间时偏离 default_table_encryption 设置，或者在创建或修改表时偏离默认模式加密。此权限不允许在创建或修改表时偏离通用表空间的加密。表的加密设置必须与其所在通用表空间的加密设置相同。The TABLE_ENCRYPTION_ADMIN privilege is required to override default encryption settings when table_encryption_privilege_check is enabled. A DBA can grant this privilege to enable a user to deviate from the default_table_encryption setting when creating or altering a schema or general tablespace, or to deviate from the default schema encryption when creating or altering a table. This privilege does not permit deviating from the encryption of a general tablespace when creating or altering a table. A table must have the same encryption setting as the general tablespace it resides in.

按表文件表空间继承创建该表的模式的默认加密，除非在 CREATE TABLE 语句中明确指定了 ENCRYPTION 子句。A file-per-table tablespace inherits the default encryption of the schema in which the table is created unless an ENCRYPTION clause is specified explicitly in the CREATE TABLE statement.

mysql> CREATE TABLE t1 (c1 INT) ENCRYPTION = 'Y';

要更改现有按表文件表空间的加密，必须指定 ENCRYPTION 子句。To alter the encryption of an existing file-per-table tablespace, an ENCRYPTION clause must be specified.

mysql> ALTER TABLE t1 ENCRYPTION = 'Y';

table_encryption_privilege_check 已启用，指定一个与默认模式加密不同的 ENCRYPTION 子句需要 TABLE_ENCRYPTION_ADMIN 权限。请参见 为模式和通用表空间定义加密默认值。table_encryption_privilege_check is enabled, specifying an ENCRYPTION clause with a setting that differs from the default schema encryption requires the TABLE_ENCRYPTION_ADMIN privilege. See Defining an Encryption Default for Schemas and General Tablespaces.

default_table_encryption 变量决定了新创建的一般表空间的加密方式，除非在 ENCRYPTION 语句中显式指定了 CREATE TABLESPACE 子句。The default_table_encryption variable determines the encryption of a newly created general tablespace unless an ENCRYPTION clause is specified explicitly in the CREATE TABLESPACE statement.

mysql> CREATE TABLESPACE `ts1` ADD DATAFILE 'ts1.ibd' ENCRYPTION = 'Y' Engine=InnoDB;

要更改现有一般表空间的加密方式，必须指定 ENCRYPTION 子句。To alter the encryption of an existing general tablespace, an ENCRYPTION clause must be specified.

mysql> ALTER TABLESPACE ts1 ENCRYPTION = 'Y';

如果启用了 table_encryption_privilege_check，指定与 default_table_encryption 设置不同的 ENCRYPTION 子句，则需要 TABLE_ENCRYPTION_ADMIN 权限。请参阅 为模式和通用表空间定义加密默认值。If table_encryption_privilege_check is enabled, specifying an ENCRYPTION clause with a setting that differs from the default_table_encryption setting requires the TABLE_ENCRYPTION_ADMIN privilege. See Defining an Encryption Default for Schemas and General Tablespaces.

在 MySQL 8.4 中，InnoDB 会自动加密属于加密表空间的双写文件页面。无需执行任何操作。双写文件页面使用关联表空间的加密密钥进行加密。写入表空间数据文件的同一加密页面也会写入双写文件。属于未加密表空间的双写文件页面保持未加密状态。In MySQL 8.4, InnoDB automatically encrypts doublewrite file pages that belong to encrypted tablespaces. No action is required. Doublewrite file pages are encrypted using the encryption key of the associated tablespace. The same encrypted page written to a tablespace data file is also written to a doublewrite file. Doublewrite file pages that belong to an unencrypted tablespace remain unencrypted.

在恢复期间，加密的双写文件页面会被解密并检查是否损坏。During recovery, encrypted doublewrite file pages are unencrypted and checked for corruption.

mysql 系统表空间包含 mysql 系统数据库和 MySQL 数据字典表。默认情况下，它是未加密的。要为 mysql 系统表空间启用加密，请在 ALTER TABLESPACE 语句中指定表空间名称和 ENCRYPTION 选项。The mysql system tablespace contains the mysql system database and MySQL data dictionary tables. It is unencrypted by default. To enable encryption for the mysql system tablespace, specify the tablespace name and the ENCRYPTION option in an ALTER TABLESPACE statement.

mysql> ALTER TABLESPACE mysql ENCRYPTION = 'Y';

要禁用 mysql 系统表空间的加密，请使用 ALTER TABLESPACE 语句设置 ENCRYPTION = 'N'。To disable encryption for the mysql system tablespace, set ENCRYPTION = 'N' using an ALTER TABLESPACE statement.

mysql> ALTER TABLESPACE mysql ENCRYPTION = 'N';

启用或禁用 mysql 系统表空间的加密，需要在实例中的所有表上拥有 CREATE TABLESPACE 权限（CREATE TABLESPACE on *.*)。Enabling or disabling encryption for the mysql system tablespace requires the CREATE TABLESPACE privilege on all tables in the instance (CREATE TABLESPACE on *.*).

重做日志数据加密通过使用 innodb_redo_log_encrypt 配置选项来启用。默认情况下，重做日志加密是禁用的。Redo log data encryption is enabled using the innodb_redo_log_encrypt configuration option. Redo log encryption is disabled by default.

与表空间数据一样，当重做日志数据写入磁盘时会进行加密，而当重做日志数据从磁盘读取时会进行解密。一旦重做日志数据读取到内存中，它就是未加密的形式。重做日志数据使用表空间加密密钥进行加密和解密。As with tablespace data, redo log data encryption occurs when redo log data is written to disk, and decryption occurs when redo log data is read from disk. Once redo log data is read into memory, it is in unencrypted form. Redo log data is encrypted and decrypted using the tablespace encryption key.

当innodb_redo_log_encrypt启用时，磁盘上存在的未加密重做日志页仍保持未加密状态，而新的重做日志页会以加密形式写入磁盘。同样，当innodb_redo_log_encrypt禁用时，磁盘上存在的已加密重做日志页仍保持加密状态，而新的重做日志页会以未加密形式写入磁盘。When innodb_redo_log_encrypt is enabled, unencrypted redo log pages that are present on disk remain unencrypted, and new redo log pages are written to disk in encrypted form. Likewise, when innodb_redo_log_encrypt is disabled, encrypted redo log pages that are present on disk remain encrypted, and new redo log pages are written to disk in unencrypted form.

重做日志加密元数据，包括表空间加密密钥，存储在重做日志文件头部的最近检查点 LSN 中。如果包含加密元数据的重做日志文件被删除，重做日志加密将被禁用。Redo log encryption metadata, including the tablespace encryption key, is stored in the header of the redo log file with the most recent checkpoint LSN. If the redo log file with the encryption metadata is removed, redo log encryption is disabled.

一旦启用重做日志加密，如果没有 keyring 组件或插件或没有加密密钥，正常重启是不可行的，因为 InnoDB 必须能够在启动期间扫描重做页，而如果重做日志页被加密，这是不可能的。没有 keyring 组件或插件或加密密钥，只能进行不使用重做日志的强制启动（SRV_FORCE_NO_LOG_REDO）。参见 第 17.20.3 节，“强制 InnoDB 恢复”。Once redo log encryption is enabled, a normal restart without the keyring component or plugin or without the encryption key is not possible, as InnoDB must be able to scan redo pages during startup, which is not possible if redo log pages are encrypted. Without the keyring component or plugin or the encryption key, only a forced startup without the redo logs (SRV_FORCE_NO_LOG_REDO) is possible. See Section 17.20.3, “Forcing InnoDB Recovery”.

使用 innodb_undo_log_encrypt 配置选项启用回滚日志数据加密。回滚日志加密适用于位于 回滚表空间 的回滚日志。参见 第 17.6.3.4 节，“回滚表空间”。回滚日志数据加密默认是禁用的。Undo log data encryption is enabled using the innodb_undo_log_encrypt configuration option. Undo log encryption applies to undo logs that reside in undo tablespaces. See Section 17.6.3.4, “Undo Tablespaces”. Undo log data encryption is disabled by default.

与表空间数据一样，回滚日志数据在写入磁盘时进行加密，读取磁盘数据时进行解密。一旦回滚日志数据被读取到内存中，它就是未加密的形式。回滚日志数据使用表空间加密密钥进行加密和解密。As with tablespace data, undo log data encryption occurs when undo log data is written to disk, and decryption occurs when undo log data is read from disk. Once undo log data is read into memory, it is in unencrypted form. Undo log data is encrypted and decrypted using the tablespace encryption key.

当启用 innodb_undo_log_encrypt 时，磁盘上已存在的未加密撤销日志页将保持未加密状态，而新的撤销日志页将以加密形式写入磁盘。同样，当禁用 innodb_undo_log_encrypt 时，磁盘上已存在的已加密撤销日志页保持加密状态，而新的撤销日志页将以未加密形式写入磁盘。When innodb_undo_log_encrypt is enabled, unencrypted undo log pages that are present on disk remain unencrypted, and new undo log pages are written to disk in encrypted form. Likewise, when innodb_undo_log_encrypt is disabled, encrypted undo log pages that are present on disk remain encrypted, and new undo log pages are written to disk in unencrypted form.

撤销日志加密元数据，包括表空间加密密钥，存储在撤销日志文件的头部。Undo log encryption metadata, including the tablespace encryption key, is stored in the header of the undo log file.

主加密密钥应定期轮换，并且每当怀疑密钥已被泄露时也应进行轮换。The master encryption key should be rotated periodically and whenever you suspect that the key has been compromised.

主密钥轮换是一个原子级别的实例操作。每次主加密密钥轮换时，MySQL 实例中的所有表空间密钥都会被重新加密，并保存回各自的表空间头中。作为原子操作，一旦启动轮换操作，所有表空间密钥的重新加密必须成功。如果因服务器故障中断了主密钥轮换，InnoDB 会在服务器重新启动时将操作向前完成。更多信息，请参见 加密与恢复。Master key rotation is an atomic, instance-level operation. Each time the master encryption key is rotated, all tablespace keys in the MySQL instance are re-encrypted and saved back to their respective tablespace headers. As an atomic operation, re-encryption must succeed for all tablespace keys once a rotation operation is initiated. If master key rotation is interrupted by a server failure, InnoDB rolls the operation forward on server restart. For more information, see Encryption and Recovery.

轮换主加密密钥仅会更改主加密密钥并重新加密表空间密钥。它不会解密或重新加密相关的表空间数据。Rotating the master encryption key only changes the master encryption key and re-encrypts tablespace keys. It does not decrypt or re-encrypt associated tablespace data.

旋转主加密密钥需要ENCRYPTION_KEY_ADMIN权限（或已弃用的SUPER权限）。Rotating the master encryption key requires the ENCRYPTION_KEY_ADMIN privilege (or the deprecated SUPER privilege).

要旋转主加密密钥，请运行：To rotate the master encryption key, run:

mysql> ALTER INSTANCE ROTATE INNODB MASTER KEY;

ALTER INSTANCE ROTATE INNODB MASTER KEY 支持并发 DML。然而，它不能与表空间加密操作同时运行，并且会采取锁以防止并发执行可能引发的冲突。如果 ALTER INSTANCE ROTATE INNODB MASTER KEY 操作正在进行，必须在表空间加密操作进行之前完成，反之亦然。ALTER INSTANCE ROTATE INNODB MASTER KEY supports concurrent DML. However, it cannot be run concurrently with tablespace encryption operations, and locks are taken to prevent conflicts that could arise from concurrent execution. If an ALTER INSTANCE ROTATE INNODB MASTER KEY operation is running, it must finish before a tablespace encryption operation can proceed, and vice versa.

如果在加密操作期间发生服务器故障，当服务器重新启动时，该操作会向前继续。对于通用表空间，加密操作会从上次处理的页开始，在后台线程中恢复。If a server failure occurs during an encryption operation, the operation is rolled forward when the server is restarted. For general tablespaces, the encryption operation is resumed in a background thread from the last processed page.

如果在主密钥轮换期间发生服务器故障，InnoDB 会在服务器重启时继续操作。If a server failure occurs during master key rotation, InnoDB continues the operation on server restart.

密钥环组件或插件必须在存储引擎初始化之前加载，以便在 InnoDB 初始化和恢复活动访问表空间数据之前，从表空间头中检索解密表空间数据页所需的信息。（参见 加密前提条件。）The keyring component or plugin must be loaded prior to storage engine initialization so that the information necessary to decrypt tablespace data pages can be retrieved from tablespace headers before InnoDB initialization and recovery activities access tablespace data. (See Encryption Prerequisites.)

当InnoDB初始化和恢复开始时，主密钥轮换操作会恢复。由于服务器故障，某些表空间密钥可能已经使用新的主加密密钥进行加密。InnoDB从每个表空间头读取加密数据，如果表明表空间密钥是使用旧的主加密密钥加密的，InnoDB会从密钥环中检索旧密钥，并使用它解密表空间密钥。然后，InnoDB使用新的主加密密钥重新加密表空间密钥，并将重新加密的表空间密钥保存回表空间头。When InnoDB initialization and recovery begin, the master key rotation operation resumes. Due to the server failure, some tablespace keys may already be encrypted using the new master encryption key. InnoDB reads the encryption data from each tablespace header, and if the data indicates that the tablespace key is encrypted using the old master encryption key, InnoDB retrieves the old key from the keyring and uses it to decrypt the tablespace key. InnoDB then re-encrypts the tablespace key using the new master encryption key and saves the re-encrypted tablespace key back to the tablespace header.

表空间导出仅支持每表单独文件的表空间。Tablespace export is only supported for file-per-table tablespaces.

当导出一个加密的表空间时，InnoDB 会生成一个用于加密表空间密钥的 传输密钥。加密的表空间密钥和传输密钥会存储在一个 tablespace_name.cfp 文件中。执行导入操作时，需要此文件以及加密的表空间文件。在导入过程中，InnoDB 使用传输密钥来解密 tablespace_name.cfp 文件中的表空间密钥。有关相关信息，请参阅 第 17.6.1.3 节，“导入 InnoDB 表”。When an encrypted tablespace is exported, InnoDB generates a transfer key that is used to encrypt the tablespace key. The encrypted tablespace key and transfer key are stored in a tablespace_name.cfp file. This file together with the encrypted tablespace file is required to perform an import operation. On import, InnoDB uses the transfer key to decrypt the tablespace key in the tablespace_name.cfp file. For related information, see Section 17.6.1.3, “Importing InnoDB Tables”.

信息模式 INNODB_TABLESPACES 表包括一个 ENCRYPTION 列，可用于识别加密的表空间。The Information Schema INNODB_TABLESPACES table includes an ENCRYPTION column that can be used to identify encrypted tablespaces.

mysql> SELECT SPACE, NAME, SPACE_TYPE, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES
       WHERE ENCRYPTION='Y'\G
*************************** 1. row ***************************
     SPACE: 4294967294
      NAME: mysql
SPACE_TYPE: General
ENCRYPTION: Y
*************************** 2. row ***************************
     SPACE: 2
      NAME: test/t1
SPACE_TYPE: Single
ENCRYPTION: Y
*************************** 3. row ***************************
     SPACE: 3
      NAME: ts1
SPACE_TYPE: General
ENCRYPTION: Y

当在 CREATE TABLE 或 ALTER TABLE 语句中指定 ENCRYPTION 选项时，它会被记录在 INFORMATION_SCHEMA.TABLES 的 CREATE_OPTIONS 列中。可以查询此列以识别位于加密的按表存储空间中的表。When the ENCRYPTION option is specified in a CREATE TABLE or ALTER TABLE statement, it is recorded in the CREATE_OPTIONS column of INFORMATION_SCHEMA.TABLES. This column can be queried to identify tables that reside in encrypted file-per-table tablespaces.

mysql> SELECT TABLE_SCHEMA, TABLE_NAME, CREATE_OPTIONS FROM INFORMATION_SCHEMA.TABLES
       WHERE CREATE_OPTIONS LIKE '%ENCRYPTION%';
+--------------+------------+----------------+
| TABLE_SCHEMA | TABLE_NAME | CREATE_OPTIONS |
+--------------+------------+----------------+
| test         | t1         | ENCRYPTION="Y" |
+--------------+------------+----------------+

查询信息模式 INNODB_TABLESPACES 表，以检索与特定模式和表相关的表空间信息。Query the Information Schema INNODB_TABLESPACES table to retrieve information about the tablespace associated with a particular schema and table.

mysql> SELECT SPACE, NAME, SPACE_TYPE FROM INFORMATION_SCHEMA.INNODB_TABLESPACES WHERE NAME='test/t1';
+-------+---------+------------+
| SPACE | NAME    | SPACE_TYPE |
+-------+---------+------------+
|     3 | test/t1 | Single     |
+-------+---------+------------+

你可以通过查询信息模式 SCHEMATA 表来识别已启用加密的模式。You can identify encryption-enabled schemas by querying the Information Schema SCHEMATA table.

mysql> SELECT SCHEMA_NAME, DEFAULT_ENCRYPTION FROM INFORMATION_SCHEMA.SCHEMATA
       WHERE DEFAULT_ENCRYPTION='YES';
+-------------+--------------------+
| SCHEMA_NAME | DEFAULT_ENCRYPTION |
+-------------+--------------------+
| test        | YES                |
+-------------+--------------------+

SHOW CREATE SCHEMA 也显示了 DEFAULT ENCRYPTION 子句。SHOW CREATE SCHEMA also shows the DEFAULT ENCRYPTION clause.

您可以使用 性能模式 监控通用表空间和 mysql 系统表空间的加密进度。You can monitor general tablespace and mysql system tablespace encryption progress using Performance Schema.

stage/innodb/alter tablespace (encryption) 阶段事件工具提供通用表空间加密操作的 WORK_ESTIMATED 和 WORK_COMPLETED 信息。The stage/innodb/alter tablespace (encryption) stage event instrument reports WORK_ESTIMATED and WORK_COMPLETED information for general tablespace encryption operations.

以下示例演示如何启用 stage/innodb/alter tablespace (encryption) 阶段事件工具及相关消费者表，以监控通用表空间或 mysql 系统表空间的加密进度。有关 Performance Schema 阶段事件工具及相关消费者的信息，请参阅 第 29.12.5 节，“Performance Schema 阶段事件表”。The following example demonstrates how to enable the stage/innodb/alter tablespace (encryption) stage event instrument and related consumer tables to monitor general tablespace or mysql system tablespace encryption progress. For information about Performance Schema stage event instruments and related consumers, see Section 29.12.5, “Performance Schema Stage Event Tables”.