SQL Server : Implementing One-Way Encryption (part 1) - Create the Primary Hash Column,Create a Secondary Hash Column for Searching

- Free product key for windows 10
- Free Product Key for Microsoft office 365
- Malwarebytes Premium 3.7.1 Serial Keys (LifeTime) 2019

Using the HomeLending database, we will implement one-way encryption. For simplicity and clarity, we will focus on the Borrower_Identification table and we will assume that the modifications to the Borrower_Identification table and Identification_Value column,  either have been reversed through a backup file restore, or not implemented.

The steps we will follow are as follows:

  1. Always backup your database prior to implementing any method of protection.

  2. Create the primary varbinary hash column to store the hashed values of the Identification_Value column. This hashed column must only be accessible to members of the Sensitive_high database role.

  3. Create a secondary version of the hash column that stores truncated hash values of the underlying plain text, in order that lower-privilege roles can still perform searches based on the values contained in the primary hash column.

  4. Salt the values stored in the Identification_value column, using the GetSaltHash UDF created in Listing 7.1, and then hash the values, using the HashBytes method, and populate the hash columns.

  5. Test and verify our new one-way encryption architecture.

  6. Drop the original plain-text Identification_Value column.

These steps would be repeated, as needed, for each column in the database tables that are subject to the implementation of one-way encryption.

Please note that the process of implementing one-way encryption involves modification of existing database objects. Please perform a full database backup prior to proceeding in the event that recovery is required.

Create the Primary Hash Column

The Identification_Value column contains the plain text representation of the actual identification value for a given borrower. For example, if the identification value was a Social Security Number, the value contained in this column would appear in the format of "555-55-5555".

The Hashbytes method that we'll use to one-way-encrypt our Identification_Value column returns a varbinary data type, which stores a variable-length numeric representation of a value. For example, the value of "A" is stored with the value of "0x41" while "ABC" is stored as "0x414243". The varbinary (and Binary) data type has a maximum length of 8,000 characters.

However, in the original schema design, the Identification_Value column is of data type varchar. Therefore, we will need to create a new column in the HomeLending database to store the encrypted varbinary values. Listing 1 shows the script to create a new Identification_Value_H column (where the "H" stands for hash) with the varbinary data type, using the ALTERTABLE method.

Listing 1. Creating the hash column.

In Listing 2, we execute the sp_addextendedproperty system stored procedure in order to document the fact that the new Identification_Value_H column is classified as "High" sensitivity.

Listing 2. Documenting the encrypted column as "high" sensitivity.

Create a Secondary Hash Column for Searching

With our HomeLending database, there is an expectation by the users that the members of the Sensitive_medium database role should be able to search for borrowers based upon the values contained in the Identification_Value column. However, our security policy dictates that the Identification_Value_H column has a Sensitivity_Class of "High", and so only members of the Sensitive_high database role are granted permissions to access it. This presents an interesting challenge.

A solution to this challenge is to offer an additional column that will contain the hash values of truncated versions of the original plain text. For example, this column would contain a hash of the last four digits of the Social Security Number. This new column will be offered to users who are not members of the Sensitive_high database role, as a way to search this data.

Listing 3 creates this new column, called Identification_Value_HT, on the Borrower_Identification table. The "T" represents the fact that it is a truncated version of the plain text value. In addition, we define its Sensitivity_Class designation as "Medium."

Listing 3. Creating and documenting the secondary hash column.

When we populate these new columns, the Identification_Value_H column will be populated with a hash value that is based on the full plain text value of the Identification_Value column, and the Identification_Value_HT column will be populated with a hash value that is based on the last four digits of the plain text. A salt will be applied to both, based upon our previously created GetHashSalt user defined function.

  •  Sql Server 2012 : Hierarchical Data and the Relational Database - Hierarchical Table Indexing Strategies
  •  Sql Server 2012 : Hierarchical Data and the Relational Database - Populating the Hierarchy (part 3) - The GetAncestor Method
  •  Sql Server 2012 : Hierarchical Data and the Relational Database - Populating the Hierarchy (part 2) - The ToString Method
  •  Sql Server 2012 : Hierarchical Data and the Relational Database - Populating the Hierarchy (part 1)
  •  Sql Server 2012 : Hierarchical Data and the Relational Database - The hierarchyid Data Type, Creating a Hierarchical Table
  •  Personal Cloud WD My Cloud EX2 Review
  •  Synology DS213j Your Own Cloud Entertainment Starts Here
  •  ADATA Premier Pro SP920 256GB
  •  Netgear ReadyNAS 314 Enterprise Network Storage
  •  Budget Portable Hard Drivers Review
    Top 10
    Free Mobile And Desktop Apps For Accessing Restricted Websites
    MASERATI QUATTROPORTE; DIESEL : Lure of Italian limos
    TOYOTA CAMRY 2; 2.5 : Camry now more comely
    KIA SORENTO 2.2CRDi : Fuel-sipping slugger
    How To Setup, Password Protect & Encrypt Wireless Internet Connection
    Emulate And Run iPad Apps On Windows, Mac OS X & Linux With iPadian
    Backup & Restore Game Progress From Any Game With SaveGameProgress
    Generate A Facebook Timeline Cover Using A Free App
    New App for Women ‘Remix’ Offers Fashion Advice & Style Tips
    SG50 Ferrari F12berlinetta : Prancing Horse for Lion City's 50th
    - Messages forwarded by Outlook rule go nowhere
    - Create and Deploy Windows 7 Image
    - How do I check to see if my exchange 2003 is an open relay? (not using a open relay tester tool online, but on the console)
    - Creating and using an unencrypted cookie in ASP.NET
    - Directories
    - Poor Performance on Sharepoint 2010 Server
    - SBS 2008 ~ The e-mail alias already exists...
    - Public to Private IP - DNS Changes
    - Send Email from Winform application
    - How to create a .mdb file from ms sql server database.......
    programming4us programming4us