Netherlands: Software

Introductie van Micorosoft SQL Server 2016

Issue link:

Contents of this Issue


Page 25 of 212

15 C H A P T E R 2 | Better security 1. Create the column master key definition 2. Create the column encryption key Column master key definition The column master key is a certificate that is stored within a Windows certificate store, a third-party Hardware Security Module (HSM), or the Azure Key Vault. The application that is encrypting the data uses the column master key to protect the various column encryption keys that handle the encryption of the data within the columns of a database table. Note Using an HSM, also known as an Enterprise Key Manager (EKM), requires the use of SQL Server Enterprise Edition. In this chapter, we describe the use of a self-signed certificate that you store in the Microsoft Certificate Store of the Windows operating system. While this is approach is not the optimal configuration, it demonstrates the concepts of Always Encrypted and is applicable to any edition of SQL Server. You can create a column master key definition by using the graphical interface within SQL Server Management Studio (SSMS) or by using T-SQL. In SSMS, connect to the SQL Server 2016 database instance in which you want to use Always Encrypted to protect a database table. In Object Explorer, navigate first to the database, then to Security, and then expand the Always Encrypted Keys folder to display its two subfolders, as shown in Figure 2-1. Figure 2-1: Always Encrypted Keys folder in SQL Server 2016 Object Explorer. To create the column master key, right-click the Column Master Keys folder and select New Column Master Key. In the New Column Master Key dialog box, type a name for the column master key, specify whether to store the key in the current user's or local machine's certificate store or the Azure Key Vault, and then select a certificate in the list, as shown in Figure 2-2. If there are no certificates, or if you want to use a new self-signed certificate, click the Generate Certificate button, and then click OK. This step creates a self-signed certificate and loads it into the certificate store of the current user account running SSMS.

Articles in this issue

Archives of this issue

view archives of Netherlands: Software - Introductie van Micorosoft SQL Server 2016