Data At Rest Encryption (DARE) is the encryption of the data that is stored in the databases and is not moving through networks. With DARE, data at rest including offline backups are protected.
MySQL supports encryption for data in transit (when it is being transmitted over a network) using SSL/TLS encryption. However, for data at rest (when it is stored on disk), MySQL does not provide built-in encryption features.
To encrypt data at rest in MySQL, you can use third-party encryption solutions such as file-system-level encryption, disk-level encryption, or application-level encryption. Here are some options you can consider:
Filesystem-level encryption: You can use a file-system-level encryption tool such as VeraCrypt, BitLocker, or LUKS to encrypt the file system where your MySQL data is stored.
Disk-level encryption: You can use a disk-level encryption tool such as dm-crypt or BitLocker to encrypt the entire disk where your MySQL data is stored.
Application-level encryption: You can implement your own encryption solution at the application level by encrypting the data before it is written to the database and decrypting it after it is retrieved. This requires modifying your application code to handle encryption and decryption, and it can add some performance overhead.
It is important to note that encryption alone is not enough to ensure data security. You also need to implement proper access controls, backup and recovery procedures, and other security measures to protect your data.
Keyring Plugin:
MySQL Community Keyring is a plugin that provides a secure store for sensitive information such as passwords, certificates, and keys. It is available in MySQL Community Server 5.7.12 and later versions.
Here are the steps to install and use the MySQL Community Keyring plugin:
Install MySQL Community Server 5.7.12 or later version.
Enable the plugin by adding the following line to the [mysqld] section of your MySQL configuration file (my.cnf or my.ini):
plugin-load-add = keyring_file.so
Restart the MySQL server to load the plugin.
Create a master key for the keyring by running the following command:
mysql> CREATE MASTER KEY;
Encrypt and store the sensitive information in the keyring by using the following syntax:
mysql> INSERT INTO mysql.keyring (service_name, key_name, key_value)
VALUES ('service_name', 'key_name', 'key_value')
ENCRYPTED BY 'master_key';
Replace 'service_name', 'key_name', and 'key_value' with your own values. The 'master_key' should be the password for the master key you created in step 4.
Retrieve the sensitive information by using the following syntax:
mysql> SELECT keyring_udf.decrypt('key_name', 'master_key');
Replace 'key_name' and 'master_key' with your own values.
That's it! You can now use the MySQL Community Keyring plugin to securely store and retrieve sensitive information in your MySQL database.