sql-server - SQL Server 2016 始终加密 - 使用 View 中始终加密的列进行比较和计算表达式

Question

我有一个列“Amount”numeric(18,2)，我已使用 SSMS v17 的加密列向导对其进行了加密。列数据现已加密。

但是，我有一个使用类似以下内容的 View :

create SampleView 
as
    Select 
        *, Amount * Rate as TotalAmount 
    From 
        SampleTable 
    Where 
        Amount > 0
go

Rate 列的类型为 numeric(18,8)。

我无法创建此 View 。它会给出数据类型不兼容的错误，因为一侧是加密的，另一侧是明文的。从我尝试过的各种排列中，我发现 > 0 的Where子句引起了问题，并且选择列表中的Amount*Rate也不起作用。

与Amount*Rate相关的错误是(我评论了Where子句)

Operand type clash: numeric(18,2) encrypted with (encryption_type = 'DETERMINISTIC', encryption_algorithm_name = 'AEAD_AES_256_CBC_HMAC_SHA_256', column_encryption_key_name = 'SampleDB_CEK', column_encryption_key_database_name = 'SampleDB') is incompatible with numeric

与 Where Amount>0 相关的错误是(我在 Select 子句中评论了 Amount*Rate)

The data types numeric(18,2) encrypted with (encryption_type = 'DETERMINISTIC', encryption_algorithm_name = 'AEAD_AES_256_CBC_HMAC_SHA_256', column_encryption_key_name = 'SampleDB_CEK', column_encryption_key_database_name = 'SampleDB') and tinyint are incompatible in the greater than operator.

我尝试了这些，但效果不佳:

Where Amount > cast(0 as numeric(18,2)
Select Amount * cast(Rate as numeric(18,2)

我们不能声明变量，因为它是 View 。这个 View 正在许多存储过程中使用。

任何想法表示赞赏。

Answer 1

加密列中不允许进行比较和数学运算。 目前，加密列上唯一可能的操作是相等。巴斯托斯的回答不起作用，因为 SQL Server 没有 key 。

您可能必须在客户端应用程序中实现此逻辑。

来自官方文档

Deterministic encryption always generates the same encrypted value for any given plain text value. Using deterministic encryption allows point lookups, equality joins, grouping and indexing on encrypted columns. However, but may also allow unauthorized users to guess information about encrypted values by examining patterns in the encrypted column, especially if there is a small set of possible encrypted values, such as True/False, or North/South/East/West region. Deterministic encryption must use a column collation with a binary2 sort order for character columns.

Randomized encryption uses a method that encrypts data in a less predictable manner. Randomized encryption is more secure, but prevents searching, grouping, indexing, and joining on encrypted columns.