Purpose
This statement is used to modify sensitive data protection rules.
Privilege requirements
To execute the ALTER SENSITIVE RULE statement, the current user must have the CREATE SENSITIVE RULE privilege. For more information about OceanBase Database privileges, see Privilege classification in Oracle mode.
Syntax
-- Add a sensitive column.
ALTER SENSITIVE RULE <rule_name> ADD COLUMN <sensitive_field_list>;
-- Drop a sensitive column.
ALTER SENSITIVE RULE <rule_name> DROP COLUMN <sensitive_field_list>;
-- Enable the rule.
ALTER SENSITIVE RULE <rule_name> ENABLE;
-- Disable the rule.
ALTER SENSITIVE RULE <rule_name> DISABLE;
-- Modify the encryption algorithm.
ALTER SENSITIVE RULE <rule_name> USING ENCRYPTION [= <encryption_method>];
Parameters
The following table describes the parameters.
| Parameter | Data type | Default value | Description |
|---|---|---|---|
| rule_name | String | The name of the sensitive rule, which must be unique in the tenant. | |
| sensitive_field_list | String | The columns to be encrypted, in the format of user.table(col1, col2), user2.table2(col3, col4), .... Each sensitive item specifies one or more columns in a table, and columns are separated by commas. Sensitive items are separated by commas. This parameter specifies the columns to be protected by the sensitive rule. A single rule can specify multiple columns across multiple users and tables. Parameter description:
|
|
| encryption_method | String | The encryption method. The default value is aes-256, which refers to the AES-256-ECB encryption algorithm. Valid values are described in the following table. |
The following table describes the allowed values of encryption_method.
| Value (used in SQL syntax) | Actual encryption algorithm | Key length | Mode | Description |
|---|---|---|---|---|
| aes-256 | AES-256-ECB | 256 bits | ECB | Default algorithm |
| aes-128 | AES-128-ECB | 128 bits | ECB | |
| aes-192 | AES-192-ECB | 192 bits | ECB | |
| aes-128-gcm | AES-128-GCM | 128 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| aes-192-gcm | AES-192-GCM | 192 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| aes-256-gcm | AES-256-GCM | 256 bits | GCM | High security level. Provides authenticated encryption (AEAD). |
| sm4-cbc | SM4-CBC | CBC | High security level. | |
| sm4-GCM | SM4-GCM | GCM | High security level. Provides authenticated encryption (AEAD). |
When you modify a sensitive rule, note the following:
- The changes take effect immediately.
- The
sensitive_field_listparameter in theADD/DROP COLUMNclause is the same as that in theCREATE SENSITIVE RULEstatement. - The
DISABLEclause temporarily disables the sensitive rule but does not delete it (a rule is enabled by default after it is created).
When you modify a sensitive rule, note the following limitations:
- The columns added by the
ADD COLUMNclause must not be protected by any existing rule. - The columns dropped by the
DROP COLUMNclause must be protected by the specified rule.
Examples
Here are some examples:
-- Add columns c of table tbl2 and x of table tbl3 in database db2 to the sensitive rule r1.
ALTER SENSITIVE RULE r1 ADD COLUMN tbl2(c), db2.tbl3(x);
-- Drop column c of table tbl2 from the sensitive rule r1.
ALTER SENSITIVE RULE r1 DROP COLUMN tbl2(c);
-- Enable the sensitive rule r1.
ALTER SENSITIVE RULE r1 ENABLE;
-- Disable the sensitive rule r1.
ALTER SENSITIVE RULE r1 DISABLE;
-- Modify the encryption algorithm of the sensitive rule r1 to the default algorithm.
ALTER SENSITIVE RULE r1 USING ENCRYPTION;
-- Modify the encryption algorithm of the sensitive rule r1 to sm4-cbc.
ALTER SENSITIVE RULE r1 USING ENCRYPTION = 'sm4-cbc';