Query Column With Always Encryption

While recently implementing SQL Always Encrypted feature I encountered a problem.
The column that has been encrypted cannot be used with certain operators(RIGHT/LEFT/LIKE and etc).

What I did for this is created a SQL/CLR method and passed ID as parameter, this method then queries the table again and decrypts the value if there is valid certificate on the server where this method is being executed.

[SqlFunction(SystemDataAccess = SystemDataAccessKind.Read, DataAccess = DataAccessKind.Read)]
    public static string GetDecryptedValueByID(int? id)
    {
       if (id == null) return null;
       using (SqlConnection conn = new SqlConnection("context connection=true"))
        {

            conn.Open();
            SqlCommand cmd = new SqlCommand("SELECT Column from Table where ID =" + id.ToString() ", conn);
            SqlDataReader reader = cmd.ExecuteReader();
            while (reader.Read())
            {
                return reader["Column "].ToString();
            }
           
        }
        return null;

    }
Drawback:-
1) Certificate has to be provided on server which means someone with access to server will be able to see the data by this method exposing decrypted value.
2)It can be slow if not used properly because every time you need value table will be queried again.

Advantage:-
If you are implementing SQL encryption in an existing application, this allows you to adopt incremental delivery where you encrypt everything first use this method with bit of performance overhead and then correct your reports slowly to eliminate need of certificate on server and then this method becomes obsolete.

Comments

Popular posts from this blog

RabbitMQ setup and cluster configuration on a windows network

Gitflow using source tree

Component analysis for application security

Analyse log using plug and play FileBeat

Introduction to Blazor

What Interview Is/Is Not for an interviewer

.NET MAUI and Blazor to create windows/web and mobile application (.NET 6.0)

Azure

WCAG Accessibility

Clean Architecture