Skip to content

Commit 8b83304

Browse files
committed
Merge branch 'release-sqlseattle' of https://github.com/MicrosoftDocs/sql-docs-pr into 20180830-Kubernetes
2 parents d58e9bf + 76de7f3 commit 8b83304

3 files changed

Lines changed: 18 additions & 9 deletions

File tree

docs/relational-databases/security/encryption/always-encrypted-enclaves.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,24 +46,24 @@ With secure enclaves, Always Encrypted protects the confidentiality of sensitive
4646

4747
- **In-place encryption** – cryptographic operations on sensitive data, for example: initial data encryption or rotating a column encryption key, are performed inside the secure enclave and do not require moving the data outside of the database. You can issue in-place encryption using the ALTER TABLE Transact-SQL statement, and you do not need to use tools, such as the Always Encrypted wizard in SSMS or the Set-SqlColumnEncryption PowerShell cmdlet.
4848

49-
- **Rich computations (preview)** – operations on encrypted columns, including pattern matching (the LIKE predicate) and range comparisons, are supported inside the secure enclave, which unlocks Always Encrypted to a broad range of applications and scenarios that require such computations to be performed inside the database system.
49+
- **Rich computations (preview)** – operations on encrypted columns, including pattern matching (the LIKE predicate) and range comparisons, are supported inside the secure enclave, which unlocks Always Encrypted to a broad range of applications and scenarios that require such computations to be performed inside the database system.
5050

5151
> [!IMPORTANT]
52-
> In [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] CTP 2.0, rich computations are pending several performance optimizations, include limited functionality (no indexing, etc), and are currently disabled by default. To enable rich computations, see [Enable rich computations](configure-always-encrypted-enclaves.md#configure-a-secure-enclave).
52+
> In [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)], rich computations are pending several performance optimizations, include limited functionality (no indexing, etc), and are currently disabled by default. To enable rich computations, see [Enable rich computations](configure-always-encrypted-enclaves.md#configure-a-secure-enclave).
5353
54-
In [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] CTP 2.0, Always Encrypted with secure enclaves uses [Virtualization-based Security (VBS)](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-vbs) secure memory enclaves (also known as Virtual Secure Mode, or VSM enclaves) in Windows.
54+
In [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)], Always Encrypted with secure enclaves uses [Virtualization-based Security (VBS)](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-vbs) secure memory enclaves (also known as Virtual Secure Mode, or VSM enclaves) in Windows.
5555

5656
## Secure Enclave Attestation
5757

5858
The secure enclave inside the SQL Server Engine can access sensitive data stored in encrypted database columns and the corresponding column encryption keys in plaintext. Before submitting a query that involves enclave computations to SQL Server, the client driver inside the application must verify the secure enclave is a genuine enclave based on a given technology (for example, VBS) and the code running inside the enclave has been signed for running inside the enclave.
5959

6060
The process of verifying the enclave is called **enclave attestation**, and it usually involves a client driver within the application (and sometimes also SQL Server) contacting an external attestation service. The specifics of the attestation process depend on the enclave technology and the attestation service.
6161

62-
The attestation process SQL Server supports for VBS secure enclaves in SQL Server 2019 CTP 2.0 is Windows Defender System Guard runtime attestation, which uses Host Guardian Service (HGS) as an attestation service. You need to configure HGS in your environment and register the machine hosting your SQL Server instance in HGS. You also must configure you client applications or tools (for example, SQL Server Management Studio) with an HGS attestation.
62+
The attestation process SQL Server supports for VBS secure enclaves in [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] is Windows Defender System Guard runtime attestation, which uses Host Guardian Service (HGS) as an attestation service. You need to configure HGS in your environment and register the machine hosting your SQL Server instance in HGS. You also must configure you client applications or tools (for example, SQL Server Management Studio) with an HGS attestation.
6363

6464
## Secure Enclave Providers
6565

66-
To use Always Encrypted with secure enclaves, an application must use a client driver that supports the feature. In SQL Server 2019 CTP 2.0, your applications must use .NET Framework 4.7.2 and .NET Framework Data Provider for SQL Server. In addition, .NET applications must be configured with a **secure enclave provider** specific to the enclave type (for example, VBS) and the attestation service (for example, HGS), you are using. The supported enclave providers are shipped separately in a NuGet package, which you need to integrate with your application. An enclave provider implements the client-side logic for the attestation protocol and for establishing a secure channel with a secure enclave of a given type.
66+
To use Always Encrypted with secure enclaves, an application must use a client driver that supports the feature. In [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)], your applications must use .NET Framework 4.7.2 and .NET Framework Data Provider for SQL Server. In addition, .NET applications must be configured with a **secure enclave provider** specific to the enclave type (for example, VBS) and the attestation service (for example, HGS), you are using. The supported enclave providers are shipped separately in a NuGet package, which you need to integrate with your application. An enclave provider implements the client-side logic for the attestation protocol and for establishing a secure channel with a secure enclave of a given type.
6767

6868
## Enclave-enabled Keys
6969

docs/relational-databases/security/encryption/configure-always-encrypted-enclaves.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ monikerRange: ">= sql-server-ver15 || = sqlallproducts-allversions"
2222
To setup Always Encrypted with secure enclaves, use the following workflow:
2323

2424
1. Configure HGS attestation.
25-
2. Install [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] CTP 2.0 on the SQL Server computer.
25+
2. Install [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] on the SQL Server computer.
2626
3. Install tools on the client/development computer.
2727
4. Configure the enclave type in your SQL Server instance.
2828
5. Provision enclave-enabled keys.
@@ -40,7 +40,7 @@ The computer running SQL Server needs the following operating system and SQL Ser
4040

4141
*SQL Server*:
4242

43-
- [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] CTP 2.0 or later
43+
- [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] or later
4444

4545
*Windows*:
4646

@@ -130,7 +130,7 @@ On the client/development computer:
130130
DBCC traceon(127,-1)
131131
```
132132
> [!NOTE]
133-
> Rich computations are disabled by default in [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] CTP 2.0. They need to be enabled using the above statement after each restart of your SQL Server instance.
133+
> Rich computations are disabled by default in [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)]. They need to be enabled using the above statement after each restart of your SQL Server instance.
134134
135135
## Provision enclave-enabled keys
136136

docs/sql-server/sql-server-ver15-release-notes.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,16 @@ This article describes limitations and known issues for the [!INCLUDE[SQL Server
7878

7979
**Workaround**: No workaround for SQL Server 2019 CTP 2.0.
8080

81-
**Applies to**: SQL Server 2019 CTP 2.0
81+
**Applies to**: [!INCLUDE[SQL Server 2019](../includes/sssqlv15-md.md)] CTP 2.0.
82+
83+
84+
### Always Encrypted with secure enclaves
85+
86+
**Issue and customer impact**: Rich computations are pending several performance optimizations, include limited functionality (no indexing, etc), and are currently disabled by default.
87+
88+
**Workaround**: To enable rich computations, run `DBCC traceon(127,-1)`. For details, see [Enable rich computations](../relational-databases/security/encryption/configure-always-encrypted-enclaves.md#configure-a-secure-enclave).
89+
90+
**Applies to**: [!INCLUDE[SQL Server 2019](../includes/sssqlv15-md.md)] CTP 2.0.
8291

8392
[!INCLUDE[get-help-options-msft-only](../includes/paragraph-content/get-help-options.md)]
8493

0 commit comments

Comments
 (0)