You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/relational-databases/security/encryption/always-encrypted-enclaves.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -46,24 +46,24 @@ With secure enclaves, Always Encrypted protects the confidentiality of sensitive
46
46
47
47
-**In-place encryption** – cryptographic operations on sensitive data, for example: initial data encryption or rotating a column encryption key, are performed inside the secure enclave and do not require moving the data outside of the database. You can issue in-place encryption using the ALTER TABLE Transact-SQL statement, and you do not need to use tools, such as the Always Encrypted wizard in SSMS or the Set-SqlColumnEncryption PowerShell cmdlet.
48
48
49
-
-**Rich computations (preview)** – operations on encrypted columns, including pattern matching (the LIKE predicate) and range comparisons, are supported inside the secure enclave, which unlocks Always Encrypted to a broad range of applications and scenarios that require such computations to be performed inside the database system.
49
+
-**Rich computations (preview)** – operations on encrypted columns, including pattern matching (the LIKE predicate) and range comparisons, are supported inside the secure enclave, which unlocks Always Encrypted to a broad range of applications and scenarios that require such computations to be performed inside the database system.
50
50
51
51
> [!IMPORTANT]
52
-
> In [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] CTP 2.0, rich computations are pending several performance optimizations, include limited functionality (no indexing, etc), and are currently disabled by default. To enable rich computations, see [Enable rich computations](configure-always-encrypted-enclaves.md#configure-a-secure-enclave).
52
+
> In [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)], rich computations are pending several performance optimizations, include limited functionality (no indexing, etc), and are currently disabled by default. To enable rich computations, see [Enable rich computations](configure-always-encrypted-enclaves.md#configure-a-secure-enclave).
53
53
54
-
In [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] CTP 2.0, Always Encrypted with secure enclaves uses [Virtualization-based Security (VBS)](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-vbs) secure memory enclaves (also known as Virtual Secure Mode, or VSM enclaves) in Windows.
54
+
In [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)], Always Encrypted with secure enclaves uses [Virtualization-based Security (VBS)](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-vbs) secure memory enclaves (also known as Virtual Secure Mode, or VSM enclaves) in Windows.
55
55
56
56
## Secure Enclave Attestation
57
57
58
58
The secure enclave inside the SQL Server Engine can access sensitive data stored in encrypted database columns and the corresponding column encryption keys in plaintext. Before submitting a query that involves enclave computations to SQL Server, the client driver inside the application must verify the secure enclave is a genuine enclave based on a given technology (for example, VBS) and the code running inside the enclave has been signed for running inside the enclave.
59
59
60
60
The process of verifying the enclave is called **enclave attestation**, and it usually involves a client driver within the application (and sometimes also SQL Server) contacting an external attestation service. The specifics of the attestation process depend on the enclave technology and the attestation service.
61
61
62
-
The attestation process SQL Server supports for VBS secure enclaves in SQL Server 2019 CTP 2.0 is Windows Defender System Guard runtime attestation, which uses Host Guardian Service (HGS) as an attestation service. You need to configure HGS in your environment and register the machine hosting your SQL Server instance in HGS. You also must configure you client applications or tools (for example, SQL Server Management Studio) with an HGS attestation.
62
+
The attestation process SQL Server supports for VBS secure enclaves in [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] is Windows Defender System Guard runtime attestation, which uses Host Guardian Service (HGS) as an attestation service. You need to configure HGS in your environment and register the machine hosting your SQL Server instance in HGS. You also must configure you client applications or tools (for example, SQL Server Management Studio) with an HGS attestation.
63
63
64
64
## Secure Enclave Providers
65
65
66
-
To use Always Encrypted with secure enclaves, an application must use a client driver that supports the feature. In SQL Server 2019 CTP 2.0, your applications must use .NET Framework 4.7.2 and .NET Framework Data Provider for SQL Server. In addition, .NET applications must be configured with a **secure enclave provider** specific to the enclave type (for example, VBS) and the attestation service (for example, HGS), you are using. The supported enclave providers are shipped separately in a NuGet package, which you need to integrate with your application. An enclave provider implements the client-side logic for the attestation protocol and for establishing a secure channel with a secure enclave of a given type.
66
+
To use Always Encrypted with secure enclaves, an application must use a client driver that supports the feature. In [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)], your applications must use .NET Framework 4.7.2 and .NET Framework Data Provider for SQL Server. In addition, .NET applications must be configured with a **secure enclave provider** specific to the enclave type (for example, VBS) and the attestation service (for example, HGS), you are using. The supported enclave providers are shipped separately in a NuGet package, which you need to integrate with your application. An enclave provider implements the client-side logic for the attestation protocol and for establishing a secure channel with a secure enclave of a given type.
To setup Always Encrypted with secure enclaves, use the following workflow:
23
23
24
24
1. Configure HGS attestation.
25
-
2. Install [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)]CTP 2.0 on the SQL Server computer.
25
+
2. Install [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] on the SQL Server computer.
26
26
3. Install tools on the client/development computer.
27
27
4. Configure the enclave type in your SQL Server instance.
28
28
5. Provision enclave-enabled keys.
@@ -40,7 +40,7 @@ The computer running SQL Server needs the following operating system and SQL Ser
40
40
41
41
*SQL Server*:
42
42
43
-
-[!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)]CTP 2.0 or later
43
+
-[!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] or later
44
44
45
45
*Windows*:
46
46
@@ -130,7 +130,7 @@ On the client/development computer:
130
130
DBCC traceon(127,-1)
131
131
```
132
132
> [!NOTE]
133
-
> Rich computations are disabled by default in [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)] CTP 2.0. They need to be enabled using the above statement after each restart of your SQL Server instance.
133
+
> Rich computations are disabled by default in [!INCLUDE[sql-server-2019](..\..\..\includes\sssqlv15-md.md)]. They need to be enabled using the above statement after each restart of your SQL Server instance.
Copy file name to clipboardExpand all lines: docs/sql-server/sql-server-ver15-release-notes.md
+10-1Lines changed: 10 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -78,7 +78,16 @@ This article describes limitations and known issues for the [!INCLUDE[SQL Server
78
78
79
79
**Workaround**: No workaround for SQL Server 2019 CTP 2.0.
80
80
81
-
**Applies to**: SQL Server 2019 CTP 2.0
81
+
**Applies to**: [!INCLUDE[SQL Server 2019](../includes/sssqlv15-md.md)] CTP 2.0.
82
+
83
+
84
+
### Always Encrypted with secure enclaves
85
+
86
+
**Issue and customer impact**: Rich computations are pending several performance optimizations, include limited functionality (no indexing, etc), and are currently disabled by default.
87
+
88
+
**Workaround**: To enable rich computations, run `DBCC traceon(127,-1)`. For details, see [Enable rich computations](../relational-databases/security/encryption/configure-always-encrypted-enclaves.md#configure-a-secure-enclave).
89
+
90
+
**Applies to**: [!INCLUDE[SQL Server 2019](../includes/sssqlv15-md.md)] CTP 2.0.
0 commit comments