Combining Always Encrypted AND Column level encryption

Saravanan V

9y1.7k

We have requirements to encrypt sensitive column data using SQL Server 2016 and selected the Always Encrypted(AE) feature to encrypt those columns using deterministic approach..

Since, the AE deterministic encryption doesn't allow inequality, range, or LIKE queries on these encrypted columns, we have tried of doing encryption for these type of columns using the symmetric key (column level) encryption technique.

Is it a good practice to implement the AE feature on certain columns(which doesn't need any inequality, range, or LIKE queries ) and symmetric key type encryption on columns where inequality, range, or LIKE queries needs to be generated?

Is it a good practice to combine the AE encryption and column level encryption on a single table considering the performance, security and maintenance?

Experts advice please.

Thanks,

Saravanan V

5 Replies

Know the answer? Post it — somebody with the same question will find it here.

Sundaram Subramanian9y ago
Accepted answer
There may be slit slow down in process, since we are in encrpt and decrpt process. Apart from this, I figured any other much big issuses. I suggest you to go with this way.
Saravanan V9y ago
Thanks a lot Sundar. In my case, table's usage will be high. And also, we are going to implement the same strategy of encryption for successive projects. So, need to know any drawbacks are there considering the performance, security and maintenance for this hybrid approach of encryption.
Sundaram Subramanian9y ago
Hai Saravanan ,

You are following a good method of encryption only. In my projects also, some columns should be encrypted. And the same Method as you follow is done in my projects. But My table's column and that table's useage is less. Since I did not found any performance issues.
Saravanan V9y ago
Manikandan, I'm not asking for what is always encrypted or how to do it? Please read the complete details of the posted scenario.
Manikandan Murugesan9y ago
Refer the following Link : https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine