Download eBook (PDF) - Red Gate Software

5 – Cell-Level Encryptionself-signed certificate, which in turn can be used to protect our symmetric key.This hierarchy not only provides a seamless and maintainable structure, but italso reduces the possibility that the sensitive data can be disclosed externallyfrom the database and instance.Therefore, we arrive at our fourth requirement:Requirement 4: The Encryption Key HierarchyAll symmetric keys that are used to protect sensitive data will utilize theencryption key hierarchy and be protected by a self-signed certificate that issecured by the database master key. The database master key will be protectedby the service master key.Implementing Cell-Level EncryptionWe are now ready to begin the implementation of our cell-level encryption,based on our previous requirements. This involves two basic steps:• Implementing and testing the chosen key hierarchy.• Modifying the schema to store the encrypted data.Implementing the Key HierarchyWe will implement our key hierarchy based upon requirements 3 and 4. Theservice master key is the highest tier in this hierarchy and exists at the instancelevel. As previously noted, the service master key of our instance was createdwhen our instance was setup. The pre-existence of the service master key canbe confirmed by querying the sys.symmetric_keys catalog view of themaster database for the key with the name of##MS_ServiceMasterKey##, as shown in Listing 5-2.USE master;GOSELECT*FROMsys.symmetric_keysWHEREname = '##MS_ServiceMasterKey##';GOListing 5-2: Confirming the existence of the Service Master Key.109