Is there an easy way on how can I encrypt a data and store it MySQL database and also it also cannot be viewed by dba?
2
-
You need to make sure that the decyption key is not accessible to the DBA which typically means that the decryption is done outside the database and maybe outside the database host. How this is exactly done depends on the specific use case, but it could be for example that the keys are only located at the client. Still, w/o a more complete and detailed use case it is hard to write a more detailed answer.– Steffen UllrichCommented Jan 20, 2021 at 9:31
-
If you provide more information on your target environment, I will answer. Are you considering shared hosting on Linux/ Apache (LiteSpeed?)/ MySQL/ PHP? There are two possibles: 1) yes, you encrypt the data on a different host, before you store it in the database, and 2) no, there is no way to encrypt data within MySQL, such that the DBA can't decrypt it later, if they were prepared for such an occurrence. There are some interesting features of MySQL that you can take advantage though, such that if a DBA comes along later, they will be unable to recover the key used for symmetric encryption.– brynkCommented Jan 20, 2021 at 9:33
Add a comment
|
1 Answer
Traditionally this is done using a multi-tier architecture where the Application tier performs encryption before storing data in the Database tier. The database administrators have access to dump all the data, but they don't have the keys. The application administrators have the keys, but can't dump all the data out of the database. Logging and auditing helps ensure that the application administrators don't try to extract mass data using their limited access.
