MySQL :: MySQL 8.4 参考手册 :: 8.4.4 MySQL 密钥环

MySQL 8.4 参考手册 · 中文镜像

正文为中文，英文原文默认隐藏。点击任意中文段落即可展开 / 收起对应英文原文。

译文由机器翻译生成，仅供理解参考；有疑问请以官方英文原文为准。

MySQL 8.4 参考手册 / 8 安全 / 8.4 安全组件和插件 / 8.4.4 MySQL 密钥环

中文点击中文段落可显示 / 隐藏英文原文本页译文覆盖 100%

8.4.4 MySQL 密钥环8.4.4 The MySQL Keyring

MySQL 服务器支持一个密钥环，它使内部服务器组件和插件能够安全地存储敏感信息以便日后检索。该实现包括以下几个元素：MySQL Server supports a keyring that enables internal server components and plugins to securely store sensitive information for later retrieval. The implementation comprises these elements:

管理后端存储或与存储后端通信的钥匙串组件和插件。使用钥匙串涉及从可用的组件和插件中安装一个。钥匙串组件和插件都管理钥匙串数据，但配置方式不同，且可能存在操作上的差异（参见第 8.4.4.1 节，“钥匙串组件与钥匙串插件”）。Keyring components and plugins that manage a backing store or communicate with a storage back end. Keyring use involves installing one from among the available components and plugins. Keyring components and plugins both manage keyring data but are configured differently and may have operational differences (see Section 8.4.4.1, “Keyring Components Versus Keyring Plugins”).
这些钥匙扣组件有售：These keyring components are available:
- component_keyring_file：将密钥环数据存储在服务器主机本地的文件中。适用于 MySQL 社区版和 MySQL 企业版。请参阅第 8.4.4.4 节，“使用 component_keyring_file 文件型密钥环组件”。component_keyring_file: Stores keyring data in a file local to the server host. Available in MySQL Community Edition and MySQL Enterprise Edition distributions. See Section 8.4.4.4, “Using the component_keyring_file File-Based Keyring Component”.
- component_keyring_encrypted_file：将密钥环数据存储在服务器主机本地的加密、密码保护文件中。适用于 MySQL 企业版。请参阅第 8.4.4.5 节，“使用 component_keyring_encrypted_file 加密文件型密钥环组件”。component_keyring_encrypted_file: Stores keyring data in an encrypted, password-protected file local to the server host. Available in MySQL Enterprise Edition distributions. See Section 8.4.4.5, “Using the component_keyring_encrypted_file Encrypted File-Based Keyring Component”.
- component_keyring_oci：在 Oracle 云基础设施 Vault 中存储密钥环数据。适用于 MySQL 企业版发行版。请参阅第 8.4.4.9 节，“使用 Oracle 云基础设施 Vault 密钥环组件”。component_keyring_oci: Stores keyring data in the Oracle Cloud Infrastructure Vault. Available in MySQL Enterprise Edition distributions. See Section 8.4.4.9, “Using the Oracle Cloud Infrastructure Vault Keyring Component”.
这些钥匙扣插件可用：These keyring plugins are available:
- keyring_okv：一个 KMIP 1.1 插件，用于与兼容 KMIP 的后端密钥环存储产品（如 Oracle Key Vault 和 Gemalto SafeNet KeySecure Appliance）一起使用。在 MySQL 企业版发行版中可用。参见第 8.4.4.6 节，“使用 keyring_okv KMIP 插件”。keyring_okv: A KMIP 1.1 plugin for use with KMIP-compatible back end keyring storage products such as Oracle Key Vault and Gemalto SafeNet KeySecure Appliance. Available in MySQL Enterprise Edition distributions. See Section 8.4.4.6, “Using the keyring_okv KMIP Plugin”.
- keyring_aws：与亚马逊网络服务密钥管理服务 (AWS KMS) 通信以进行密钥生成，并使用本地文件进行密钥存储。在 MySQL 企业版发行版中可用。参见第 8.4.4.7 节，“使用 keyring_aws 亚马逊网络服务密钥插件”。keyring_aws: Communicates with the Amazon Web Services Key Management Service for key generation and uses a local file for key storage. Available in MySQL Enterprise Edition distributions. See Section 8.4.4.7, “Using the keyring_aws Amazon Web Services Keyring Plugin”.
- keyring_hashicorp：与 HashiCorp Vault 通信以进行后端存储。可在 MySQL 企业版发行版中使用。详见第 8.4.4.8 节，“使用 HashiCorp Vault 密钥环插件”。keyring_hashicorp: Communicates with HashiCorp Vault for back end storage. Available in MySQL Enterprise Edition distributions. See Section 8.4.4.8, “Using the HashiCorp Vault Keyring Plugin”.
用于钥匙串密钥管理的钥匙串服务接口。此服务可在两个级别访问：A keyring service interface for keyring key management. This service is accessible at two levels:
- SQL 接口：在 SQL 语句中，调用第 8.4.4.12 节，“通用密钥环密钥管理函数”中描述的函数。SQL interface: In SQL statements, call the functions described in Section 8.4.4.12, “General-Purpose Keyring Key-Management Functions”.
- C 接口：在 C 语言代码中，调用第 7.6.9.2 节，“密钥环服务”中描述的密钥环服务函数。C interface: In C-language code, call the keyring service functions described in Section 7.6.9.2, “The Keyring Service”.
关键元数据访问：Key metadata access:
- Performance Schema keyring_keys 表展示了密钥环中密钥的元数据。密钥元数据包括密钥 ID、密钥所有者以及后端密钥 ID。keyring_keys 表不会展示任何敏感的密钥环数据，例如密钥内容。请参见第 29.12.18.2 节，“keyring_keys 表”。The Performance Schema keyring_keys table exposes metadata for keys in the keyring. Key metadata includes key IDs, key owners, and backend key IDs. The keyring_keys table does not expose any sensitive keyring data such as key contents. See Section 29.12.18.2, “The keyring_keys table”.
- 性能模式 keyring_component_status 表提供正在使用的密钥环组件的状态信息（如果已安装）。请参阅第 29.12.18.1 节，“keyring_component_status 表”。The Performance Schema keyring_component_status table provides status information about the keyring component in use, if one is installed. See Section 29.12.18.1, “The keyring_component_status Table”.
密钥迁移功能。MySQL 支持在密钥存储之间迁移密钥，使 DBA 能够将 MySQL 安装从一个密钥存储切换到另一个密钥存储。请参阅第 8.4.4.11 节，“在密钥环密钥存储之间迁移密钥”。A key migration capability. MySQL supports migration of keys between keystores, enabling DBAs to switch a MySQL installation from one keystore to another. See Section 8.4.4.11, “Migrating Keys Between Keyring Keystores”.
密钥环插件的实现已修订为使用组件基础设施。这是通过使用内置插件 daemon_keyring_proxy_plugin 实现的，该插件充当插件与组件服务 API 之间的桥梁。请参见第 7.6.8 节，“密钥环代理桥插件”。The implementation of keyring plugins is revised to use the component infrastructure. This is facilitated using the built-in plugin named daemon_keyring_proxy_plugin that acts as a bridge between the plugin and component service APIs. See Section 7.6.8, “The Keyring Proxy Bridge Plugin”.

Warning

对于加密密钥管理，component_keyring_file 和 component_keyring_encrypted_file 组件并非用于满足监管合规要求。像 PCI、FIPS 等安全标准要求使用密钥管理系统在密钥库或硬件安全模块 (HSM) 中保护、管理和维护加密密钥的安全性。For encryption key management, the component_keyring_file and component_keyring_encrypted_file components are not intended as a regulatory compliance solution. Security standards such as PCI, FIPS, and others require use of key management systems to secure, manage, and protect encryption keys in key vaults or hardware security modules (HSMs).

在 MySQL 中，keyring 服务的使用者包括：Within MySQL, keyring service consumers include:

InnoDB 存储引擎使用 keyring 来存储表空间加密的密钥。请参阅第 17.13 节，“InnoDB 数据静态加密”。The InnoDB storage engine uses the keyring to store its key for tablespace encryption. See Section 17.13, “InnoDB Data-at-Rest Encryption”.
MySQL 企业审计使用 keyring 来存储审计日志文件的加密密码。请参阅加密审计日志文件。MySQL Enterprise Audit uses the keyring to store the audit log file encryption password. See Encrypting Audit Log Files.
二进制日志和中继日志管理支持基于 keyring 的日志文件加密。启用日志文件加密后，keyring 存储用于加密二进制日志文件和中继日志文件密码的密钥。请参阅第 19.3.2 节，“加密二进制日志文件和中继日志文件”。Binary log and relay log management supports keyring-based encryption of log files. With log file encryption activated, the keyring stores the keys used to encrypt passwords for the binary log files and relay log files. See Section 19.3.2, “Encrypting Binary Log Files and Relay Log Files”.
用于解密文件密钥（该文件密钥用于解密敏感系统变量的持久化值）的主密钥存储在密钥环中。必须在 MySQL 服务器实例上启用密钥环组件，以支持持久化系统变量值的安全存储，而不是使用密钥环插件，因为它们不支持此功能。请参见持久化敏感系统变量。The master key to decrypt the file key that decrypts the persisted values of sensitive system variables is stored in the keyring. A keyring component must be enabled on the MySQL Server instance to support secure storage for persisted system variable values, rather than a keyring plugin, which do not support the function. See Persisting Sensitive System Variables.

有关一般钥匙串安装说明，请参见第 8.4.4.2 节，“钥匙串组件安装”，以及第 8.4.4.3 节，“钥匙串插件安装”。有关特定钥匙串组件或插件的安装和配置信息，请参见描述该组件或插件的章节。For general keyring installation instructions, see Section 8.4.4.2, “Keyring Component Installation”, and Section 8.4.4.3, “Keyring Plugin Installation”. For installation and configuration information specific to a given keyring component or plugin, see the section describing it.

有关使用钥匙串功能的信息，请参见第 8.4.4.12 节，“通用钥匙串密钥管理功能”。For information about using the keyring functions, see Section 8.4.4.12, “General-Purpose Keyring Key-Management Functions”.

钥匙圈组件、插件和函数访问提供钥匙圈接口的钥匙圈服务。有关如何访问此服务和编写钥匙圈插件的信息，请参阅第 7.6.9.2 节，“钥匙圈服务”，以及编写钥匙圈插件。Keyring components, plugins, and functions access a keyring service that provides the interface to the keyring. For information about accessing this service and writing keyring plugins, see Section 7.6.9.2, “The Keyring Service”, and Writing Keyring Plugins.

首页上一级下一节