According to MySQL, AES encryption (Advanced Encryption Standard) is the best method available for providing reversible encryption and decryption in SQL.
Formerly known as Rijndael, the AES_ENCRYPT and AES_DECRYPT functions are now built-in to MySQL so you can take user data, encrypt it with a salt, store it in your database, then extract it again later and decrypt it.
Define your salt
You'll need to apply a salt to the data that you encrypt. This is a special code that the encryption algorithm uses which works a bit like a key.
You'll need to provide the exact same key back to decrypt the data, and if an attacker should gain access to your database, they won't be able to decipher it without knowing the salt.
If you define your salt in PHP like this, you'll be able to pull the constant into your SQL statements more easily.
if(!define('SALT')) define('SALT','897sdn9j98u98jk');
To insert data into your MySQL database and encrypt the sensitive information, you'll need to issue a command like this, along with your salt.
INSERT INTO your_table (username,email,shoe size) VALUES ('$username', AES_ENCRYPT('$email','".SALT."'), AES_ENCRYPT('$shoesize','".SALT."'));
This will insert the username in plain text, as it's non-sensitive, but encrypt the user's email and shoesize, to prevent them from being viewed without access to the salt.
At some point, you're going to need to access some of the data you stored in its encrypted form, and you can do this very easily using the AES_DECRYPT function of MySQL and the same salt you used when you encrypted the data and inserted it.
SELECT username, AES_DECRYPT('email','".SALT."') AS email,
AES_DECRYPT('shoesize','".SALT."') AS shoesize FROM your_table WHERE username ='fred';
If you SELECT the encrypted data without running it through AES_DECRYPT or with the wrong or no salt, you'll get an ugly, unreadable string of odd characters. This means if an attacker manages to access your database, but does not have access to your server to view the salt, they won't be able to read any of the data you've stored. At least, not without going to great lengths to try and decrypt the data.
Updating encrypted records is very similar to insertion. Basically, you just apply the same salt and re-issue the AES_ENCRYPT command to re-encrypt the data again and lock it away safely.
UPDATE your_table SET email = AES_ENCRYPT('$email','".SALT."'), shoesize = AES_ENCRYPT('$shoesize','".SALT."') WHERE username= 'fred';
Searching encrypted data using both AES_ENCRYPT and AES_DECRYPT
Things get a little bit more complicated when you need to search for data that's encrypted and then display it in its unencrypted form.
Say you wanted to search for a user using their email address, but you'd encrypted that in the database. First, you'd need to encrypt the email address you want to search for with AES_ENCRYPT and your salt, and then you'd need to use AES_DECRYPT to ensure that MySQL decrypted it, returning it in a readable format.
You can achieve this, using code a bit like this:
SELECT user_username,
AES_DECRYPT(email,'".SALT."') AS email,
AES_DECRYPT(shoesize,'".SALT."') AS shoesize
FROM your_table WHERE
(email = AES_ENCRYPT('$q','".SALT."'));
For further informations, please see this link: http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html
Which one of these methods would be best to implement and scale for a realtime chat application. Method one seems pretty good but I'm not sure if constant SQL transactions are good for a server, the payload might be too much.
It seems that one of your main requirements is the technologies of your system to be scalable.
In such case you might like to move to big data platforms such as Apache Kafka, Apache flume, or RabbitMQ.
In that case I would recommend to have a look to Apache Kafka to create an scalable pipeline in which:
- A process receives SQL queries from the mobile devices. (Kafka Producer)
- A group of servers execute the SQL transaction and reply to the mobile device. (Kafka consumers)
Kafka API will allow you to easily setup this pipeline. While things can get more sophisticated, I hope I gave you an idea of how could you scale your service.
Get started with Apache Kafka: https://kafka.apache.org/documentation/#gettingStarted
Best Answer
As pvg has mentioned, a good option to use is an embedded database. The reason here is that the database can be included as a single JAR file, rather than needing to be installed on the system's user. Usually, you can access the databases using the standard JDBC API, so it really can act as a replacement for your current MySQL DB. The library will manage creation of DB files so you don't have to install anything.
Of course, these options are typically less robust than something like Oracle, however, it may suit your needs just fine.
For example, I recently utilized the H2 database, a 100% Java embedded DB, in a project of mine. http://www.h2database.com/html/main.html
Here is some example code which shows how using something like H2 would differ than MySQL when you want to get a connection object, but note, interacting with the DB to run queries would be the same as with MySQL: