SQL Server 2016 - 是否可以連接兩個nvarchar始終加密的列？

Question

我已創建使用表：

create table dbo.employee(firstname nvarchar(100) null,lastname nvarchar(100) null) 

使用插入一些樣品數據：

insert into dbo.employee values('Sachin','Tendulkar') 
insert into dbo.employee values('Rohit','Sharma') 
insert into dbo.employee values('Virendra','Sehwag') 
insert into dbo.employee values('Irfan','Pathan') 

然後我用總是加密的嚮導來加密使用SSMS V17該表的兩列。現在我試圖來連接姓與名字是這樣的：

select concat(firstname, lastname) from dbo.employee 

而且它給我下面的錯誤：

Operand type clash: nvarchar(100) encrypted with (encryption_type = 'DETERMINISTIC', encryption_algorithm_name = 'AEAD_AES_256_CBC_HMAC_SHA_256', column_encryption_key_name = 'SampleDB_CEK', column_encryption_key_database_name = 'SampleDB') is incompatible with varchar

當我試試這個：

select firstname + lastname from dbo.employee 

它提供了以下錯誤：

Encryption scheme mismatch for columns/variables 'firstname', 'lastname'. The encryption scheme for the columns/variables is (encryption_type = 'DETERMINISTIC', encryption_algorithm_name = 'AEAD_AES_256_CBC_HMAC_SHA_256', column_encryption_key_name = 'SampleDB_CEK', column_encryption_key_database_name = 'SampleDB') and the expression near line '1' expects it to be (encryption_type = 'PLAINTEXT') (or weaker).

任何幫助表示讚賞。

Answer 1

不允許在加密列上連接。目前加密列上唯一可能的操作是平等的。這是由於SQL Server沒有密鑰。

您可能必須在客戶端應用程序中實現此邏輯。

從官方文件

Deterministic encryption always generates the same encrypted value for any given plain text value. Using deterministic encryption allows point lookups, equality joins, grouping and indexing on encrypted columns. However, but may also allow unauthorized users to guess information about encrypted values by examining patterns in the encrypted column, especially if there is a small set of possible encrypted values, such as True/False, or North/South/East/West region. Deterministic encryption must use a column collation with a binary2 sort order for character columns.

Randomized encryption uses a method that encrypts data in a less predictable manner. Randomized encryption is more secure, but prevents searching, grouping, indexing, and joining on encrypted columns.