SQL Server 2016 - 是否可以连接两个nvarchar始终加密的列？

Question

我已创建使用表：

create table dbo.employee(firstname nvarchar(100) null,lastname nvarchar(100) null) 

使用插入一些样品数据：

insert into dbo.employee values('Sachin','Tendulkar') 
insert into dbo.employee values('Rohit','Sharma') 
insert into dbo.employee values('Virendra','Sehwag') 
insert into dbo.employee values('Irfan','Pathan') 

然后我用总是加密的向导来加密使用SSMS V17该表的两列。现在我试图来连接姓与名字是这样的：

select concat(firstname, lastname) from dbo.employee 

而且它给我下面的错误：

Operand type clash: nvarchar(100) encrypted with (encryption_type = 'DETERMINISTIC', encryption_algorithm_name = 'AEAD_AES_256_CBC_HMAC_SHA_256', column_encryption_key_name = 'SampleDB_CEK', column_encryption_key_database_name = 'SampleDB') is incompatible with varchar

当我试试这个：

select firstname + lastname from dbo.employee 

它提供了以下错误：

Encryption scheme mismatch for columns/variables 'firstname', 'lastname'. The encryption scheme for the columns/variables is (encryption_type = 'DETERMINISTIC', encryption_algorithm_name = 'AEAD_AES_256_CBC_HMAC_SHA_256', column_encryption_key_name = 'SampleDB_CEK', column_encryption_key_database_name = 'SampleDB') and the expression near line '1' expects it to be (encryption_type = 'PLAINTEXT') (or weaker).

任何帮助表示赞赏。

Answer 1

不允许在加密列上连接。目前加密列上唯一可能的操作是平等的。这是由于SQL Server没有密钥。

您可能必须在客户端应用程序中实现此逻辑。

从官方文件

Deterministic encryption always generates the same encrypted value for any given plain text value. Using deterministic encryption allows point lookups, equality joins, grouping and indexing on encrypted columns. However, but may also allow unauthorized users to guess information about encrypted values by examining patterns in the encrypted column, especially if there is a small set of possible encrypted values, such as True/False, or North/South/East/West region. Deterministic encryption must use a column collation with a binary2 sort order for character columns.

Randomized encryption uses a method that encrypts data in a less predictable manner. Randomized encryption is more secure, but prevents searching, grouping, indexing, and joining on encrypted columns.