Purpose
This statement is used to modify the sensitive data protection rules.
Privilege requirements
To execute the ALTER SENSITIVE RULE statement, the current user must have the CREATE SENSITIVE RULE privilege. For more information about OceanBase Database privileges, see Privilege classification in MySQL-compatible mode.
Syntax
-- Add a sensitive column.
ALTER SENSITIVE RULE <rule_name> ADD COLUMN <sensitive_field_list>;
-- Drop a sensitive column.
ALTER SENSITIVE RULE <rule_name> DROP COLUMN <sensitive_field_list>;
-- Enable the rule.
ALTER SENSITIVE RULE <rule_name> ENABLE;
-- Disable the rule.
ALTER SENSITIVE RULE <rule_name> DISABLE;
-- Modify the encryption algorithm.
ALTER SENSITIVE RULE <rule_name> USING ENCRYPTION [= <encryption_method>];
Parameters
The following table describes the parameters.
| Parameter | Data type | Default value | Description |
|---|---|---|---|
| rule_name | String | The name of the sensitive rule, which must be unique within the tenant. | |
| sensitive_field_list | String | The columns to be encrypted, in the format of db.table(col1, col2), db2.table2(col3, col4), .... Each sensitive item specifies one or more columns in a table, with columns separated by commas. Sensitive items are separated by commas. The db parameter can be empty, in which case the current connected database is used by default. |
|
| encryption_method | String | The encryption method. The default value is aes-256, which refers to the AES-256-ECB encryption algorithm. The value range is described in the following table. |
The encryption_method parameter can take the following values:
| Value (used in SQL syntax) | Actual encryption algorithm | Key length | Mode | Description |
|---|---|---|---|---|
| aes-256 | AES-256-ECB | 256 bits | ECB | Default algorithm |
| aes-128 | AES-128-ECB | 128 bits | ECB | |
| aes-192 | AES-192-ECB | 192 bits | ECB | |
| aes-128-gcm | AES-128-GCM | 128 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| aes-192-gcm | AES-192-GCM | 192 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| aes-256-gcm | AES-256-GCM | 256 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| sm4-cbc | SM4-CBC | CBC | High security level. | |
| sm4-GCM | SM4-GCM | GCM | High security level. Provides authenticated encryption (AEAD). |
The following limits apply:
- The
sensitive_field_listparameter forADD/DROP COLUMNis the same as that in theCREATE SENSITIVE RULEstatement. - The columns added by
ADD COLUMNcannot be protected by any existing rules. - The columns dropped by
DROP COLUMNmust be protected by the specified rule. DISABLEtemporarily disables the sensitive rule but does not delete it (rules are enabled by default after creation).
Examples
Here are some examples:
-- Add the columns c in tbl2 and x in db2.tbl3 to the sensitive rule r1.
ALTER SENSITIVE RULE r1 ADD COLUMN tbl2(c), db2.tbl3(x);
-- Drop the column c in tbl2 from the sensitive rule r1.
ALTER SENSITIVE RULE r1 DROP COLUMN tbl2(c);
-- Enable the sensitive rule r1.
ALTER SENSITIVE RULE r1 ENABLE;
-- Disable the sensitive rule r1.
ALTER SENSITIVE RULE r1 DISABLE;
-- Change the encryption algorithm of the sensitive rule r1 to the default algorithm.
ALTER SENSITIVE RULE r1 USING ENCRYPTION;
-- Change the encryption algorithm of the sensitive rule r1 to sm4-cbc.
ALTER SENSITIVE RULE r1 USING ENCRYPTION = 'sm4-cbc';