Query Column With Always Encryption
While recently implementing SQL Always Encrypted feature I encountered a problem.
The column that has been encrypted cannot be used with certain operators(RIGHT/LEFT/LIKE and etc).
What I did for this is created a SQL/CLR method and passed ID as parameter, this method then queries the table again and decrypts the value if there is valid certificate on the server where this method is being executed.
1) Certificate has to be provided on server which means someone with access to server will be able to see the data by this method exposing decrypted value.
2)It can be slow if not used properly because every time you need value table will be queried again.
Advantage:-
If you are implementing SQL encryption in an existing application, this allows you to adopt incremental delivery where you encrypt everything first use this method with bit of performance overhead and then correct your reports slowly to eliminate need of certificate on server and then this method becomes obsolete.
The column that has been encrypted cannot be used with certain operators(RIGHT/LEFT/LIKE and etc).
What I did for this is created a SQL/CLR method and passed ID as parameter, this method then queries the table again and decrypts the value if there is valid certificate on the server where this method is being executed.
[SqlFunction(SystemDataAccess
= SystemDataAccessKind.Read, DataAccess = DataAccessKind.Read)]
public static string
GetDecryptedValueByID(int? id)
{
if (id == null) return null;
using (SqlConnection conn
= new SqlConnection("context connection=true"))
{
conn.Open();
SqlCommand cmd
= new SqlCommand("SELECT Column from Table where ID =" +
id.ToString() ", conn);
SqlDataReader
reader = cmd.ExecuteReader();
while (reader.Read())
{
return
reader["Column "].ToString();
}
}
return null;
}
Drawback:-1) Certificate has to be provided on server which means someone with access to server will be able to see the data by this method exposing decrypted value.
2)It can be slow if not used properly because every time you need value table will be queried again.
Advantage:-
If you are implementing SQL encryption in an existing application, this allows you to adopt incremental delivery where you encrypt everything first use this method with bit of performance overhead and then correct your reports slowly to eliminate need of certificate on server and then this method becomes obsolete.
Comments
Post a Comment