Purpose
This statement is used to modify the sensitive data protection rules.
Privilege requirements
To execute the ALTER SENSITIVE RULE statement, the current user must have the CREATE SENSITIVE RULE privilege. For more information about the privileges of OceanBase Database, see Privilege classification in MySQL mode.
Syntax
ALTER SENSITIVE RULE rule_name ADD COLUMN sensitive_field_list
ALTER SENSITIVE RULE rule_name DROP COLUMN sensitive_field_list
ALTER SENSITIVE RULE rule_name ENABLE
ALTER SENSITIVE RULE rule_name DISABLE
ALTER SENSITIVE RULE rule_name USING ENCRYPTION [ = { DEFAULT | encryption_method } ]
Parameters
The following table describes the parameters.
| Parameter | Data type | Default value | Description |
|---|---|---|---|
| rule_name | String | The name of the sensitive rule, which must be unique within the tenant. | |
| sensitive_field_list | String | The columns to be encrypted, in the format of db.table(col1, col2), db2.table2(col3, col4), .... Each sensitive item specifies one or more columns in a table, with columns separated by commas. Sensitive items are separated by commas. If db is not specified, the current database is used by default. |
|
| encryption_method | String | The encryption method. The default value is aes-256, which refers to the AES-256-ECB encryption algorithm. The value range is described below. |
The following table describes the allowed values of encryption_method.
| Value (used in SQL syntax) | Actual encryption algorithm | Key length | Mode | Description |
|---|---|---|---|---|
| aes-256 | AES-256-ECB | 256 bits | ECB | Default algorithm |
| aes-128 | AES-128-ECB | 128 bits | ECB | |
| aes-192 | AES-192-ECB | 192 bits | ECB | |
| aes-128-gcm | AES-128-GCM | 128 bits | GCM | High security level, provides authenticated encryption (AEAD) |
| aes-192-gcm | AES-192-GCM | 192 bits | GCM | High security level, provides authenticated encryption (AEAD) |
| aes-256-gcm | AES-256-GCM | 256 bits | GCM | High security level, provides authenticated encryption (AEAD) |
| sm4-cbc | SM4-CBC | CBC | High security level | |
| sm4-GCM | SM4-GCM | GCM | High security level, provides authenticated encryption (AEAD) |
The following limitations apply:
- The
sensitive_field_listparameter forADD/DROP COLUMNis the same as the corresponding field in theCREATE SENSITIVE RULEstatement. - Columns added by
ADD COLUMNcannot be protected by any existing rules. - Columns dropped by
DROP COLUMNmust be protected by the specified rule. DISABLEtemporarily disables the sensitive rule without deleting it (rules are enabled by default after creation).
Examples
Here are some examples:
-- Add columns c of table tbl2 and x of table db2.tbl3 to the sensitive rule r1.
ALTER SENSITIVE RULE r1 ADD COLUMN tbl2(c), db2.tbl3(x);
-- Drop column c of table tbl2 from the sensitive rule r1.
ALTER SENSITIVE RULE r1 DROP COLUMN tbl2(c);
-- Enable the sensitive rule r1.
ALTER SENSITIVE RULE r1 ENABLE;
-- Disable the sensitive rule r1.
ALTER SENSITIVE RULE r1 DISABLE;
-- Change the encryption method of the sensitive rule r1 to the default algorithm.
ALTER SENSITIVE RULE r1 USING ENCRYPTION;
-- Change the encryption method of the sensitive rule r1 to sm4-cbc.
ALTER SENSITIVE RULE r1 USING ENCRYPTION = 'sm4-cbc';