SQL Server 2016 Always Encrypted 解析
首先最好的文件在微軟的網站:
https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-2017
always encrypted 有兩種方式, 一種是deterministic 和 randomized. 兩者的區別:
Deterministic encryption always generates the same encrypted value for any given plain text value. Using deterministic encryption allows point lookups, equality joins, grouping and indexing on encrypted columns. However, but may also allow unauthorized users to guess information about encrypted values by examining patterns in the encrypted column, especially if there is a small set of possible encrypted values, such as True/False, or North/South/East/West region. Deterministic encryption must use a column collation with a binary2 sort order for character columns.
Randomized encryption uses a method that encrypts data in a less predictable manner. Randomized encryption is more secure, but prevents searching, grouping, indexing, and joining on encrypted columns.
如果說要在某加密列上filter 或 join 建議使用Deterministic模式
Develop using Always Encrypted with .NET Framework Data Provider
| Query characteristic | Always Encrypted is enabled and application can access the keys and key metadata | Always Encrypted is enabled and application cannot access the keys or key metadata | Always Encrypted is disabled |
|---|---|---|---|
| Queries with parameters targeting encrypted columns. | Parameter values are transparently encrypted. | Error | Error |
| Queries retrieving data from encrypted columns, without parameters targeting encrypted columns. | Results from encrypted columns are transparently decrypted. The application receives plaintext values of the .NET datatypes corresponding to the SQL Server types configured for the encrypted columns. | Error | Results from encrypted columns are not decrypted. The application receives encrypted values as byte arrays (byte[]). |
所以對於Always Encrypted來說
有兩個開關:
一個是所謂的"Always Encrypted is disabled" , 指的是是否在連結字串里加上圖中的這句話
如果開啟的話, 當查詢加密的欄位時, 如果查詢者有許可權, 會自動解密, 透明傳輸.
另一個是Queries with parameters targeting encrypted columns.
指的是查詢會不會對加密的列進行 where 這樣的操作
declare @a char(10) ='str '
select * from [dbo].[ttt] where [str] = @a假設上面的str欄位有使用always encrypted加密的話, 就必須在SSMS中開啟一個選項, 見下圖:
然後查詢才能成功.
在dotnet程式設計時, 可以參考這個連結:
https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/develop-using-always-encrypted-with-net-framework-data-provider?view=sql-server-2017
在加密列上進行操作.
補記:
在使用Azure SQL Database時, 可以用Azure Key Vault來來儲存使用者加密的master key(普通sqlserver使用證書)
Deterministic encryption must use a column collation with a binary2 sort order for character columns.