Purpose
This statement is used to modify sensitive data protection rules.
Note
For OceanBase Database V4.3.5, this statement is supported starting from V4.3.5 BP3.
Syntax
-- Add a sensitive column.
ALTER SENSITIVE RULE <rule_name> ADD COLUMN <sensitive_field_list>;
-- Drop a sensitive column.
ALTER SENSITIVE RULE <rule_name> DROP COLUMN <sensitive_field_list>;
-- Enable a rule.
ALTER SENSITIVE RULE <rule_name> ENABLE;
-- Disable a rule.
ALTER SENSITIVE RULE <rule_name> DISABLE;
-- Modify the encryption algorithm.
ALTER SENSITIVE RULE <rule_name> USING ENCRYPTION [= <encryption_method>];
Parameters
The following table describes the parameters.
| Parameter | Data type | Default value | Description |
|---|---|---|---|
| rule_name | VARCHAR | The name of the sensitive rule, which must be unique within the tenant. | |
| sensitive_field_list | VARCHAR | The columns to be encrypted. The format is db.table(col1, col2), db2.table2(col3, col4), .... Each sensitive item specifies one or more columns in a table, and columns are separated by commas. Sensitive items are separated by commas. If you do not specify db, the current database is used by default. |
|
| encryption_method | VARCHAR | The encryption method. The default value is aes-256 (cbc). Valid values are as follows. |
The following table describes the valid values of encryption_method.
| Value (used in SQL statements) | Encryption algorithm used | Key length | Mode | Description |
|---|---|---|---|---|
| aes-256 | AES-256-ECB | 256 bits | ECB | Default algorithm |
| aes-128 | AES-128-ECB | 128 bits | ECB | |
| aes-192 | AES-192-ECB | 192 bits | ECB | |
| aes-128-gcm | AES-128-GCM | 128 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| aes-192-gcm | AES-192-GCM | 192 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| aes-256-gcm | AES-256-GCM | 256 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| sm4-cbc | SM4-CBC | CBC | High security level | |
| sm4-GCM | SM4-GCM | GCM | High security level. Provides authenticated encryption (AEAD). |
Constraints:
- The
sensitive_field_listparameter ofADD COLUMNandDROP COLUMNis the same as that ofCREATE SENSITIVE RULE. - The columns added by
ADD COLUMNcannot be protected by any existing rules. - The columns dropped by
DROP COLUMNmust be protected by the specified rule. DISABLEtemporarily disables the sensitive rule but does not delete it (rules are enabled by default after creation).
Examples
Here are some examples:
-- Add the columns c of the tbl2 table and x of the db2.tbl3 table to the sensitive rule r1.
ALTER SENSITIVE RULE r1 ADD COLUMN tbl2(c), db2.tbl3(x);
-- Drop the column c of the tbl2 table from the sensitive rule r1.
ALTER SENSITIVE RULE r1 DROP COLUMN tbl2(c);
-- Enable the sensitive rule r1.
ALTER SENSITIVE RULE r1 ENABLE;
-- Disable the sensitive rule r1.
ALTER SENSITIVE RULE r1 DISABLE;
-- Change the encryption algorithm of the sensitive rule r1 to the default algorithm.
ALTER SENSITIVE RULE r1 USING ENCRYPTION;
-- Change the encryption algorithm of the sensitive rule r1 to sm4-cbc.
ALTER SENSITIVE RULE r1 USING ENCRYPTION = 'sm4-cbc';