Skip to main content
MySQL Workbench is a versatile visual tool for database design, SQL development, and server administration. It offers advanced data modeling, query building, and MySQL-specific features for easier management of MySQL databases. This section demonstrates the following tasks:
  1. Connect to your MySQL Server from MySQL Workbench.
  2. Use MySQL Workbench to create a new database table with Transparent Data Encryption (TDE) enabled. This generates an AES-256 key on the CryptoHub that serves as the master encryption key for MySQL TDE.
  3. Insert example data into the table and list the contents to verify that the data is decrypted transparently.
  4. Confirm that you can successfully rotate the master encryption key stored on the CryptoHub.

​
Connect to MySQL Server

Perform the following steps to connect to your MySQL Server instance using MySQL Workbench:
1
L Start the program on your computer to open the initial MySQL Workbench dashboard.
2
On the MySQL Workbench dashboard, go to MySQL Connections and select the [+] button.
3
In the Setup New Connection window, input the details of your MySQL server connection.
OptionDescription or required configuration
Connection NameA label for your reference.
Connection MethodTypically, select Standard (TCP/IP) to connect to a standard MySQL server. Other methods, such as TCP/IP over SSH or a local socket or pipes for local connections, are available.
HostnameThe IP address or domain name of the MySQL server you’re connecting to. You can use localhost if your MySQL server is on the same machine as your MySQL Workbench.
PortThe port number that the MySQL server is listening on. The default MySQL port is 3306.
UsernameThe username you use to authenticate with the MySQL server.
PasswordIf your account requires a password, select [ Store in Vault… ] to enter and save your password
4
After you enter the preceding details, select [ Test Connection ] to ensure that your settings are correct and that MySQL Workbench can reach the MySQL server.
5
If the test succeeds, select [ OK ] to close the window and save the connection. Then, you can double-click on the saved connection to connect to your MySQL server.

​
Create a database table

Perform the following steps to create a new database table with TDE enabled:
1
Open a new SQL tab to execute queries.
2
Run the following query to create a new encrypted table called t1 in the world schema or database, which is a sample database that comes pre-installed in MySQL:
Mysql
Alternatively, you can enable encryption for an existing table by using the following SQL query:
Mysql

​
Insert data into the table

Perform the following steps to insert example data into the table:
1
Open a new SQL tab to execute queries.
2
Run the following query to insert example data into the t1 table:
Mysql

​
Verify the data

Perform the following steps to verify that the data decrypts transparently:
1
Open a new SQL tab to execute queries.
2
Run the following query to retrieve the data you inserted into the t1 table:
Mysql
This should return the unencrypted rows you just inserted.
From the user perspective, Transparent Data Encryption (TDE) use is truly transparent: data is automatically decrypted when you select it, and you won’t see any difference compared to unencrypted data. TDE is about securing data at rest—that is, the data files on disk are encrypted. When data is read from disk into memory, the MySQL server automatically decrypts it. When data is written back to disk, it’s automatically encrypted. So, as a user, you won’t see any difference between encrypted and unencrypted data when you’re querying it. The encryption doesn’t affect the data itself; it just affects how it is stored on disk. The purpose of TDE is to protect data if someone gets unauthorized access to the raw database files on the disk.

​
Rotate the key

Perform the following steps to rotate the TDE master key:
1
Open a new SQL tab to execute queries.
2
Run the following query to rotate the TDE master key:
Mysql
3
Verify the rotation by inserting some new data into your encrypted table and then retrieving it:
Mysql
If the insert and select operations succeed, MySQL can use the new key to encrypt and decrypt data.
The key rotation process doesn’t re-encrypt existing data with the new key—it just uses the new key for new encryptions. You must retain the old versions of the key as long as data that was encrypted with them exists.

​
View the MySQL TDE master keys

You can view the keys MySQL TDE creates on the CryptoHub in the Keys menu for the MySQL Enterprise TDE service you deployed.