This document discusses column level encryption in Microsoft SQL Server. It begins with an introduction to the problem of protecting sensitive data like credit card numbers. It then provides an overview of encryption types in databases before detailing the encryption hierarchy and specific mechanisms in SQL Server, including Transact-SQL functions, asymmetric keys, symmetric keys, certificates, and Transparent Data Encryption (TDE). The document focuses on column level encryption, outlining the process of creating keys and certificates and using encryption at the column level, along with the advantages of high security and disadvantages of potential performance impacts.

1. Column Level
Encryption
Presented by
Behnam Mohammadi
behnamm92@gmail.com
Database Security Course by
Dr. Meghdad Mirabi
Fall 2016
Microsoft SQL Server
Islamic Azad University
South Tehran Branch

2. Table of content
• Problem
• Encryption
• Database security tools
• Encryption Hierarchy
• Encryption Mechanisms
• Transact-SQL functions
• Asymmetric keys
228

3. Table of content
• Symmetric keys
• Certificates
• Transparent Data Encryption (TDE)
• Column Level Encryption
• Advantages and Disadvantages
• References
328

4. Problem
• For example financial firms have sensitive data
• Credit card numbers
• Financial history
• etc.
• Needs to be protected from unauthorized access
428

5. Encryption
• Most effective way to achieve data security
• Cannot be easily understood by anyone except authorized
parties
• Main types of encryption in databases
• Database level encryption
• Column level encryption
528

6. Database Security Tools
• Data stored in tables
• Views
• Column level permissions
• Database encryption
• Database
• Column
628

7. Encryption Hierarchy
728

8. Encryption Mechanisms
• Transact-SQL functions
• Asymmetric keys
• Symmetric keys
• Certificates
• Transparent Data Encryption (TDE)
828

9. Transact-SQL functions
• SQL Server built-in encryption function
• SQL Server built-in decryption function
928

10. Transact-SQL functions
• The encryption function password is plain text
• It can be stolen by a sniffer in case
• SQL Server profiler
1028

11. Certificates
• A public key certificate, usually just called a certificate
• Digitally-signed statement
• Certificates are issued and signed by a certification authority
• Subject is entity that receives a certificate form CA
• Relieve need to maintain a set of passwords for individual
subjects for hosts
1128

12. Certificates
• Certificate contents
• Subject public key
• Subject identifier information [name, e-mail and etc.]
• Validity period
• Issuer identifier information and digital signature
1228

13. Symmetric Keys
• Used for both encryption and decryption
• Encryption and decryption by using a symmetric key is fast
1328

14. Asymmetric Keys
• Made up of a private key and the corresponding public key
• Each key can decrypt data encrypted by the other
• Higher level of security than symmetric encryption
1428

15. Transparent Data Encryption (TDE)
• Transparent to end-user
• Protect data and log files
• Performed at page level
• Real time I/O Encryption and Decryption
• Impact on performance between 3% to 5%
1528

16. Transparent Data Encryption (TDE)
• Use a symmetric key called the database encryption key
• Protected by certificate that
it also protected by the DMK
• Protected by an asymmetric
key stored in an EKM
1628

17. Column Level Encryption
1. Create SQL Server Database Master Key (DMK)
2. Create a Self Signed SQL Server Certificate
3. Create SQL Server Symmetric Key
4. Using Encryption
1728

18. Column Level Encryption
1. Create SQL Server Database Master Key (DMK)
1828

19. Column Level Encryption
2. Create a Self Signed SQL Server Certificate
1928

20. Column Level Encryption
3. Create SQL Server Symmetric Key
2028

21. Column Level Encryption
4. Using Encryption Encrypt
2128

22. Column Level Encryption
4. Using Encryption Decrypt
2228

23. Column Level Encryption
• A user need to have permission to symmetric key and
certificate to decrypt data
• Decrypt with wrong key or certificate gives NULL for encrypted
values
2328

24. Column Level Encryption
• Grant Permissions to the Encrypted Data
2428

25. Advantages and Disadvantages
• High level security
• Requires no maintenance password for end-user
• Impact on performance
• Database migration is difficult
2528

26. References
• www.msdn.microsoft.com
• www.searchsecurity.techtarget.com [Margaret Rouse]
• www.mssqltips.com [Nitansh Agarwal]
2628

27. xx
END
SIMPLICITY IS POWER
Thanks 2727