Encrypt Data at Rest MySQL

customaware

Suppose I have 4 attributes in a BO, 2 Text Attributes and 2 Number Attributes using MySQL
How can I encrypt those values so that Aware can still read them but they cannot be read when looking in the DB?

Jaymer

Q: "not be read when looking in the DB"

you mean totally hidden from someone using a DB tool?
or you mean they can see the encrypted data?
how heavily does it need to be encrypted?

customaware

Just that they would see encrypted data.

In Aware there is this for each Attribute..... I want to know how to use it with MySQL... Step by Step. Cannot find a thing in the docs or anything meaningful on the Forum.

BobK

I do not use encryption now, but several years ago I did look into it.

Take a look at:

hpl123

Same scenario for me as for Bob, I looked into it a some years ago and got it working but unfortunately don´t have any notes etc. on it. I do remember this solution being cumbersome and difficult to use and another thing is, I think MySQL has removed DES encrypt after version 5.7 or so which means the Aware IM built in solution will most likely not work with later versions (another reason for support to update the functionality, see below) .

Support, I would REALLY REALLY like an update to this functionality and make it easy to use with options like encrypt entire database, encrypt selected objects (all attributes) etc. directly from the config tool (no other stuff, just option to encrypt and what to encrypt). A big thing from my wish list and is almost a must in todays world so something I hope you will prioritise.

PointsWell

I am going to be storing personal data and feel that not encrypting it would lay me open to all sorts of life shortening hassles.

intra

I believe in newer versions of MySQL , DES functions are now depreciated.

Would like to know if AES will be an option going forward or InnoDB Tablespace Encryption for AwareIM.

Taken from MySQL:
Starting with MySQL 5.7.6, the following functions are now deprecated:

DES_ENCRYPT
DES_DECRYPT
ENCRYPT
DES (Data Encryption Standard) is known to be less secure and slower than other available encryption methods. There are also many well known attack methods that can be used against it.

AES (Advanced Encryption Standard) was the chosen successor to DES. It provides better security and performance, thus obsoleting the older DES based functions. MySQL provides the following AES functions:

AES_ENCRYPT
AES_DECRYPT
When using the AES functions, you can also use the block_encryption_mode session variable to configure the following AES parameters:

Block encryption mode
Key size
Initialization vector
We recommend that users stop using the deprecated DES based functions and switch to AES functions as soon as possible.

ACDC

With all the new draconian privacy laws coming into being, encrypting certain attributes in the DB is vital

I have been using the DES encrypt but it's not secure enough and in the event of a breach the use of this insecure encryption method would be questioned and could find myself in a tight spot (I am thinking GDPR here and implications on the developer because of bad policy in the application design)

I asked Vlad about the possibility of bringing the AES Encryption onboard as a feature in the same way as the DES encrypt is featured and the response I got was "that they have no plans in the near future to change the encryption method. I found that strange, especially in light of the new privacy laws abound. So I asked if this could be done on a custom development, he confirmed and offered to do it for $2500.00

As much as I think this important feature should be a natural upgrade to the DES feature, if Vlad is not going reconsider in light of other interested developers and to come to the party, I would consider chipping in for the custom dev. Are there any other interested parties out there keen to participate in the funding of AES encrypt

customaware

I am in for 500 USD. I need it now.

hpl123

I´m in as well, not sure how much yet and will follow this thread. I do however think 2500 for this is a bit steep especially considering how important functionality this is for most webapps today (I think 0 for implementing it more fair to be honest i.e implement it as an upcoming feature but if that isn´t an option, reduce the cost for us developers).

ACDC

I do however think 2500 for this is a bit steep especially considering how important functionality this is for most webapps today

I totally agree

Also, IMHO I think all developers should consider encrypting critical data at rest as a default in the design in all applications - Also it's a good idea to get up to speed on GDPR from a developers perspective. I recently discovered that I needed to have a very detailed audit object (as per GDPR) in my application of every change and who made the change, Also an archived version of the audit trail had to be stored offsite in such a way that the administrator or developer of the app cannot manipulate the audit 😮 This can get quite complicated, possibly a third party type escrow account.
If the app does not comply and there is a breach you could be in hot water

BTW, once you have AES Decryption in place, there is another step that needs to be carried out and that is securing the encryption keys on the server. I don't have a clue how that would work, but there are some third-party solutions that specialises in this area

aware_support

We will try to provide support for AES encryption in 8.2 free of charge. The only thing we ask is for some volunteers to test it in the beta version

customaware

Jaymer

Vlad
Are we still going to have the "quickie" 8.2 release that just fixed a lot of simple requests by users?
At the conference, I thought y'all said a lot of the basic user requests for fine-tuning the product could/would be addressed in the next minor release.
... before moving on to "new" functionality.
Jaymer...

intra

As part of HIPPA requirements, i'm forced into a corner where i must take some action now to protect data.

There are many ways to encrypt data and out of the box MySQL allows for plain text extraction from the underlying database storage file (innodb).

The following link may help some people (it has for me) achieve some level of encryption with MySQL data at rest. Obviously encrypting data 'in transit' to the db is better, however this gets me over some of the compliance headaches now and gives me encryption at 'rest' (at write/store time to the db).

"https://dev.mysql.com/doc/refman/5.7/en/innodb-tablespace-encryption.html"

If you view the innodb file with a text editor you can see the plain text data quite easily.
Example:
#> strings sensitive_data_tb.ibd
infimum
supremum
Private sensitive data

After preforming this

#> strings sensitive_data_tb.ibd
a4f04306-2a29-11e6-8d3a-c8ff28b60643
]~&#
6}L*
Gw?<
u)l?

Uo-

AwareIM still functions as per normal (to date) , however i'm sure that this is something that will be unsupported from AwareIM's team.

Please wait for AwareIM's actual solution in 8.2 if you are not willing to get your hands dirty.

hpl123

aware_support wrote
We will try to provide support for AES encryption in 8.2 free of charge. The only thing we ask is for some volunteers to test it in the beta version

Awesome, thx support 🙂

ACDC

We will try to provide support for AES encryption in 8.2 free of charge. The only thing we ask is for some volunteers to test it in the beta version

Thank you Vlad 😃 , being able to confirm our apps are 100 % GDPR compliant is a big number for us and will assist in promoting new business for us

PointsWell

Thumbs Up!

(board doesn't like emojis)