MySQL5.7開始支持表空間加密了，增強了MySQL的數據文件的安全性，這是一個很不錯的一個功能，這個特性默認是沒有啟用的，要使用這個功能要安裝插件keyring_file。
下面就來看看怎么安裝，安裝這個插件不用重啟MySQL
1.安裝插件
1.1 安裝插件
(mysql5.7)root@localhost [(none)]> INSTALL PLUGIN keyring_file soname 'keyring_file.so';
Query OK, 0 rows affected ( 0.01 sec)
2.創建密鑰文件目錄
mkdir -p /ssd01/3306/mysql-keyring/
chown -R mysql.mysql /ssd01/3306/mysql-keyring/
chmod 750 /ssd01/3306/mysql-keyring/
3.設置KEY文件，這個是動態參數，可以直接設置
(mysql5.7)root@localhost [(none)]> set global keyring_file_data='/ssd01/3306/mysql-keyring/keyring';
Query OK, 0 rows affected (0.00 sec)
(mysql5.7)root@localhost [(none)]>
4.重要事情說三遍：更新配置文件，避免遺忘更新配置文件，避免下次重啟出問題
在my.cnf的[mysqld]段，加這兩行
early-plugin-load=keyring_file.so
keyring_file_data=/ssd01/3306/mysql-keyring/keyring
##演示一下沒有把keyring_file_data寫到配置文件的情況。
KEY文件默認在base目錄
(mysql5.7)root@localhost [(none)]> show global variables like '%keyring_file_data%';
+-------------------+----------------------------------+
| Variable_name | Value |
+-------------------+----------------------------------+
| keyring_file_data | /usr/local/mysql/keyring/keyring |
+-------------------+----------------------------------+
1 row in set (0.00 sec)
插件還是在的
(mysql5.7)root@localhost [(none)]> show plugins;
+----------------------------+----------+--------------------+-----------------+---------+
| Name | Status | Type | Library | License |
+----------------------------+----------+--------------------+-----------------+---------+
| binlog | ACTIVE | STORAGE ENGINE | NULL | GPL |
| mysql_native_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| sha256_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| InnoDB | ACTIVE | STORAGE ENGINE | NULL | GPL |
| INNODB_TRX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCKS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCK_WAITS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_PER_INDEX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_PER_INDEX_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE_LRU | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_POOL_STATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_TEMP_TABLE_INFO | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_METRICS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_DEFAULT_STOPWORD | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_DELETED | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_BEING_DELETED | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_CONFIG | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_INDEX_CACHE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_INDEX_TABLE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLESTATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_INDEXES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_COLUMNS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FIELDS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FOREIGN | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FOREIGN_COLS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLESPACES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_DATAFILES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_VIRTUAL | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| PERFORMANCE_SCHEMA | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MRG_MYISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MyISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MEMORY | ACTIVE | STORAGE ENGINE | NULL | GPL |
| CSV | ACTIVE | STORAGE ENGINE | NULL | GPL |
| BLACKHOLE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| partition | ACTIVE | STORAGE ENGINE | NULL | GPL |
| FEDERATED | DISABLED | STORAGE ENGINE | NULL | GPL |
| ARCHIVE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| ngram | ACTIVE | FTPARSER | NULL | GPL |
| keyring_file | ACTIVE | KEYRING | keyring_file.so | GPL |
+----------------------------+----------+--------------------+-----------------+---------+
45 rows in set (0.00 sec)
訪問加密的表會報錯，找不到master_key
(mysql5.7)root@localhost [test]> show create table test_1;
ERROR 3185 (HY000): Can't find master key from keyring, please check keyring plugin is loaded.
2.測試加密表
(mysql5.7)root@localhost [(none)]> use test11;
Database changed
(mysql5.7)root@localhost [test11]> alter table test1 encryption='Y';
Query OK, 17 rows affected (0.04 sec) Records: 17 Duplicates: 0 Warnings: 0
查看一下information_schema.tables 看看是否加密成功
(mysql5.7)root@localhost [test11]> select * from information_schema.tables where CREATE_OPTIONS like '%ENCRYPTION="Y"%'\G;
*************************** 1. row ***************************
TABLE_CATALOG: def
TABLE_SCHEMA: test11
TABLE_NAME: test1
TABLE_TYPE: BASE TABLE
ENGINE: InnoDB
VERSION: 10
ROW_FORMAT: Dynamic
TABLE_ROWS: 17
AVG_ROW_LENGTH: 963
DATA_LENGTH: 16384
MAX_DATA_LENGTH: 0
INDEX_LENGTH: 16384
DATA_FREE: 0
AUTO_INCREMENT: 102
CREATE_TIME: 2016-06-21 15:17:33
UPDATE_TIME: 2016-06-21 15:17:33
CHECK_TIME: NULL
TABLE_COLLATION: utf8_general_ci
CHECKSUM: NULL
CREATE_OPTIONS: ENCRYPTION="Y"
TABLE_COMMENT:
1 row in set (0.03 sec)
(mysql5.7)root@localhost [test11]>
也許有人問，我這個支持在線DDL么，其實想一下，加密表空間應該是拷貝表方式。
(mysql5.7)root@localhost [test]> alter table test_1 encryption='Y',ALGORITHM=INPLACE,LOCK=none;
ERROR 1846 (0A000): ALGORITHM=INPLACE is not supported. Reason: Invalid encryption option.. Try ALGORITHM=COPY.
(mysql5.7)root@localhost [test]>
解密表空間
(mysql5.7)root@localhost [test]> alter table test1 encryption='N';
Query OK, 17 rows affected (0.01 sec) Records: 17 Duplicates: 0 Warnings: 0
(mysql5.7)root@localhost [test]> select * from information_schema.tables where CREATE_OPTIONS like '%ENCRYPTION="Y"%'\G;
Empty set (0.05 sec)
3.小結
安裝插件很簡單，有必要測試一下加密表空間對性能的影響。測試也很簡單，用sysbench,tpcc先創建表，再修改為加密表空間。還有key密鑰不要誤刪除了，不然就呵呵噠。你數據只能用備份來恢復了