MySQL Enterprise Backup supports encrypted InnoDB tablespaces. For details on how the MySQL server encrypts and decrypts InnoDB tables, see Tablespace Encryption. See Chapter 6, Working with Encrypted InnoDB Tables on how mysqlbackup commands handle encrypted InnoDB tables.
When InnoDB tablespace encryption uses Oracle Key Vault (OKV) for encryption key management, the feature is referred to as “MySQL Enterprise Transparent Data Encryption (TDE).”
The following is the command-line option for working with encrypted InnoDB tables:
Property Value Command-Line Format
The option must be used when backing up a server that has a keyring plugin enabled for InnoDB table encryption and for restoring a backup containing encrypted InnoDB tables. If the server is using the
keyring_encrypted_fileplugin, the password supplied with the option must match the value of the system variable
keyring_encrypted_file_passwordon the server.
The same password supplied during backup must be supplied again during a
apply-log, or an
apply-incremental-backupoperation for the backup, or mysqlbackup will error out when it encounters encrypted InnoDB tables during the operation. If different passwords were used for different backups in a sequence of full and incremental backups, make sure the very password used to create an individual backup is supplied when performing an
copy-back-and-apply-logoperation on it.
Users who do not want to supply the password on the command line or in a default file may use the option without specifying any value; mysqlbackup then asks the user to type in the password before the operation starts.