MySQL 二进制日志文件和中继日志文件可以加密，这有助于保护这些文件及其中可能包含的敏感数据，防止被外部攻击者滥用，同时也防止存储这些文件的操作系统用户未经授权查看。文件使用的加密算法为 AES（高级加密标准）密码算法，该算法内置于 MySQL 服务器中，无法进行配置。MySQL binary log files and relay log files can be encrypted, helping to protect these files and the potentially sensitive data contained in them from being misused by outside attackers, and also from unauthorized viewing by users of the operating system where they are stored. The encryption algorithm used for the files, the AES (Advanced Encryption Standard) cipher algorithm, is built in to MySQL Server and cannot be configured.

您可以通过将 binlog_encryption 系统变量设置为 ON 来在 MySQL 服务器上启用此加密。默认值为 OFF。此系统变量用于为二进制日志文件和中继日志文件启用加密。启用加密不需要在服务器上启用二进制日志，因此您可以在没有二进制日志的副本上加密中继日志文件。要使用加密，必须安装和配置 keyring 组件或插件，以为 MySQL 服务器的 keyring 服务提供密钥。有关操作说明，请参见 第 8.4.4 节，“MySQL Keyring”。任何受支持的 keyring 组件或插件都可以用于存储二进制日志加密密钥。You enable this encryption on a MySQL server by setting the binlog_encryption system variable to ON. OFF is the default. The system variable sets encryption on for binary log files and relay log files. Binary logging does not need to be enabled on the server to enable encryption, so you can encrypt the relay log files on a replica that has no binary log. To use encryption, a keyring component or plugin must be installed and configured to supply MySQL Server's keyring service. For instructions to do this, see Section 8.4.4, “The MySQL Keyring”. Any supported keyring component or plugin can be used to store binary log encryption keys.

当你首次启用加密启动服务器时，在初始化二进制日志和中继日志之前，会生成一个新的二进制日志加密密钥。该密钥用于加密每个二进制日志文件（如果服务器启用了二进制日志）和中继日志文件（如果服务器有复制通道）的文件密码，并且从文件密码生成的进一步密钥用于加密文件中的数据。当前服务器上使用的二进制日志加密密钥称为二进制日志主密钥。两级加密密钥架构意味着二进制日志主密钥可以按需要进行轮换（替换为新的主密钥），并且只需要使用新主密钥重新加密每个文件的文件密码，而不需要重新加密整个文件。中继日志文件针对所有通道进行加密，包括在启用加密后创建的新通道。二进制日志索引文件和中继日志索引文件永远不会被加密。When you first start the server with encryption enabled, a new binary log encryption key is generated before the binary log and relay logs are initialized. This key is used to encrypt a file password for each binary log file (if the server has binary logging enabled) and relay log file (if the server has replication channels), and further keys generated from the file passwords are used to encrypt the data in the files. The binary log encryption key that is currently in use on the server is called the binary log master key. The two tier encryption key architecture means that the binary log master key can be rotated (replaced by a new master key) as required, and only the file password for each file needs to be re-encrypted with the new master key, not the whole file. Relay log files are encrypted for all channels, including new channels that are created after encryption is activated. The binary log index file and relay log index file are never encrypted.

如果在服务器运行时启用加密，则此时会生成一个新的二进制日志加密密钥。例外情况是，如果服务器之前已启用加密然后被禁用，则会再次使用之前使用的二进制日志加密密钥。二进制日志文件和中继日志文件会立即轮转，新文件以及所有后续的二进制日志文件和中继日志文件的文件密码都将使用此二进制日志加密密钥进行加密。服务器上仍存在的现有二进制日志文件和中继日志文件不会被加密，但如果不再需要，您可以清除它们。If you activate encryption while the server is running, a new binary log encryption key is generated at that time. The exception is if encryption was active previously on the server and was then disabled, in which case the binary log encryption key that was in use before is used again. The binary log file and relay log files are rotated immediately, and file passwords for the new files and all subsequent binary log files and relay log files are encrypted using this binary log encryption key. Existing binary log files and relay log files still present on the server are not encrypted, but you can purge them if they are no longer needed.

如果通过将 binlog_encryption 系统变量更改为 OFF 来停用加密，二进制日志文件和中继日志文件将立即轮换，且之后的所有日志记录将不加密。先前加密的文件不会自动解密，但服务器仍然能够读取它们。在服务器运行时，启用或停用加密需要 BINLOG_ENCRYPTION_ADMIN 权限。If you deactivate encryption by changing the binlog_encryption system variable to OFF, the binary log file and relay log files are rotated immediately and all subsequent logging is unencrypted. Previously encrypted files are not automatically decrypted, but the server is still able to read them. The BINLOG_ENCRYPTION_ADMIN privilege is required to activate or deactivate encryption while the server is running.

通过检查文件头开头的魔数，可以区分加密和未加密的二进制日志文件。加密日志文件的魔数为 0xFD62696E，与未加密日志文件的魔数 0xFE62696E 不同。SHOW BINARY LOGS 语句可以显示每个二进制日志文件是加密的还是未加密的。Encrypted and unencrypted binary log files can be distinguished using the magic number at the start of the file header for encrypted log files (0xFD62696E), which differs from that used for unencrypted log files (0xFE62696E). The SHOW BINARY LOGS statement shows whether each binary log file is encrypted or unencrypted.

当二进制日志文件被加密后，mysqlbinlog 不能直接读取它们，但可以使用 --read-from-remote-server 选项从服务器读取它们。如果你使用 mysqlbinlog 备份加密的二进制日志文件，请注意，使用 mysqlbinlog 生成的文件副本是以未加密格式存储的。When binary log files have been encrypted, mysqlbinlog cannot read them directly, but can read them from the server using the --read-from-remote-server option. If you back up encrypted binary log files using mysqlbinlog, note that the copies of the files that are generated using mysqlbinlog are stored in an unencrypted format.

二进制日志加密可以与二进制日志事务压缩结合使用。有关二进制日志事务压缩的更多信息，请参见第 7.4.4.5 节，“二进制日志事务压缩”。Binary log encryption can be combined with binary log transaction compression. For more information on binary log transaction compression, see Section 7.4.4.5, “Binary Log Transaction Compression”.