Purpose
This statement is used to modify the sensitive data protection rule.
Privilege requirements
To execute the ALTER SENSITIVE RULE statement, the current user must have the CREATE SENSITIVE RULE privilege. For more information about OceanBase Database privileges, see Privilege classification in Oracle-compatible mode.
Syntax
-- Add a sensitive column.
ALTER SENSITIVE RULE <rule_name> ADD COLUMN <sensitive_field_list>;
-- Drop a sensitive column.
ALTER SENSITIVE RULE <rule_name> DROP COLUMN <sensitive_field_list>;
-- Enable a rule.
ALTER SENSITIVE RULE <rule_name> ENABLE;
-- Disable a rule.
ALTER SENSITIVE RULE <rule_name> DISABLE;
-- Modify the encryption algorithm.
ALTER SENSITIVE RULE <rule_name> USING ENCRYPTION [= <encryption_method>];
Parameters
The following table describes the parameters.
| Parameter | Data type | Default value | Description |
|---|---|---|---|
| rule_name | VARCHAR | N/A | The name of the sensitive rule, which must be unique within the tenant. |
| sensitive_field_list | VARCHAR | N/A | The columns to be encrypted. The format is user.table(col1, col2), user2.table2(col3, col4), .... Each sensitive item specifies one or more columns in a table. The columns are separated by commas. The sensitive items are separated by commas. A rule can specify multiple columns in multiple tables of multiple users. Parameter description:
|
| encryption_method | VARCHAR | N/A | The encryption method. The default value is aes-256, which refers to the AES-256-ECB encryption algorithm. Valid values are described in the following table. |
The following table describes the valid values of encryption_method.
| Value (in SQL syntax) | Actual encryption algorithm | Key length | Mode | Description |
|---|---|---|---|---|
| aes-256 | AES-256-ECB | 256 bits | ECB | Default algorithm |
| aes-128 | AES-128-ECB | 128 bits | ECB | |
| aes-192 | AES-192-ECB | 192 bits | ECB | |
| aes-128-gcm | AES-128-GCM | 128 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| aes-192-gcm | AES-192-GCM | 192 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| aes-256-gcm | AES-256-GCM | 256 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| sm4-cbc | SM4-CBC | CBC | High security level. | |
| sm4-GCM | SM4-GCM | GCM | High security level. Provides authenticated encryption (AEAD). |
When you modify a sensitive rule, note the following:
- The modification takes effect immediately.
- The
sensitive_field_listparameter in theADD/DROP COLUMNclause is the same as that in theCREATE SENSITIVE RULEstatement. - The
DISABLEclause temporarily disables the sensitive rule but does not delete it (the rule is enabled by default after it is created).
When you modify a sensitive rule, note the following limitations:
- The columns added by using the
ADD COLUMNclause cannot be protected by any existing rule. - The columns dropped by using the
DROP COLUMNclause must be protected by the specified rule.
Examples
Here are some examples:
-- Add the tbl2(c) and db2.tbl3(x) columns to the sensitive rule r1.
ALTER SENSITIVE RULE r1 ADD COLUMN tbl2(c), db2.tbl3(x);
-- Drop the tbl2(c) column from the sensitive rule r1.
ALTER SENSITIVE RULE r1 DROP COLUMN tbl2(c);
-- Enable the sensitive rule r1.
ALTER SENSITIVE RULE r1 ENABLE;
-- Disable the sensitive rule r1.
ALTER SENSITIVE RULE r1 DISABLE;
-- Change the encryption algorithm of the sensitive rule r1 to the default algorithm.
ALTER SENSITIVE RULE r1 USING ENCRYPTION;
-- Change the encryption algorithm of the sensitive rule r1 to sm4-cbc.
ALTER SENSITIVE RULE r1 USING ENCRYPTION = 'sm4-cbc';