Purpose
This statement is used to modify sensitive data protection rules.
Note
For OceanBase Database V4.3.5, this statement is supported starting from V4.3.5 BP3.
Syntax
-- Add sensitive columns.
ALTER SENSITIVE RULE <rule_name> ADD COLUMN <sensitive_field_list>;
-- Drop sensitive columns.
ALTER SENSITIVE RULE <rule_name> DROP COLUMN <sensitive_field_list>;
-- Enable the rule.
ALTER SENSITIVE RULE <rule_name> ENABLE;
-- Disable the rule.
ALTER SENSITIVE RULE <rule_name> DISABLE;
-- Modify the encryption algorithm.
ALTER SENSITIVE RULE <rule_name> USING ENCRYPTION [= <encryption_method>];
Parameters
The following table describes the parameters in the syntax.
| Parameter | Data type | Default value | Description | |--|--|--|--| | rule_name | String | | The name of the sensitive rule, which must be unique in the tenant. | | sensitive_field_list | String | | Specifies the columns to be encrypted, in the format db.table(col1, col2), db2.table2(col3, col4), .... Each sensitive item specifies one or more columns in a table, separated by commas. Multiple sensitive items are separated by commas. db can be omitted, in which case the current connected database is used by default. | | encryption_method | String | | The encryption method. The default value is aes-256(cbc). For more information, see the description of the values of this parameter. |
The allowed values for encryption_method are as follows.
| Value (in SQL syntax) | Actual encryption algorithm | Key length | Mode | Description |
|---|---|---|---|---|
| aes-256 | AES-256-ECB | 256 bits | ECB | Default algorithm |
| aes-128 | AES-128-ECB | 128 bits | ECB | Good compatibility |
| aes-192 | AES-192-ECB | 192 bits | ECB | Medium security level |
| aes-128-gcm | AES-128-GCM | 128 bits | GCM | Provides authenticated encryption |
| aes-256-gcm | AES-256-GCM | 256 bits | GCM | High security level. Provides authenticated encryption |
| sm4-cbc | SM4-CBC | CBC | High security level | |
| sm4-gcm | SM4-GCM | GCM | High security level |
Limitations:
- The
sensitive_field_listparameter in theADD/DROP COLUMNclause and theCREATE SENSITIVE RULEstatement must be the same. - The columns added by the
ADD COLUMNclause cannot be protected by any existing rules. - The columns dropped by the
DROP COLUMNclause must be protected by the specified rule. - The
DISABLEoption temporarily disables the sensitive rule without deleting it. By default, a sensitive rule is enabled after it is created.
Examples
The following examples are provided:
-- Add tbl2(c), db2.tbl3(x) to sensitive rule r1.
ALTER SENSITIVE RULE r1 ADD COLUMN tbl2(c), db2.tbl3(x);
-- Drop tbl2(c) from sensitive rule r1.
ALTER SENSITIVE RULE r1 DROP COLUMN tbl2(c);
-- Enable sensitive rule r1.
ALTER SENSITIVE RULE r1 ENABLE;
-- Disable sensitive rule r1.
ALTER SENSITIVE RULE r1 DISABLE;
-- Modify the encryption algorithm of the sensitive rule r1 to the default algorithm.
ALTER SENSITIVE RULE r1 USING ENCRYPTION;
-- Modify the encryption algorithm of the sensitive rule r1 to sm4-cbc.
ALTER SENSITIVE RULE r1 USING ENCRYPTION = 'sm4-cbc';