You need one machine (it can be a virtual machine) that runs SQL Server. It must meet the SQL Server computer requirements. In addition, you will need to install Visual Studio 2022 or later, to compile and run the sample web application. Secondly, make sure you have installed SQL Server Management Studio 19 or later.

Setup

This section describes the initial setup steps.

Enable virtualization-based security (VBS) on the machine and Always Encrypted with secure enclaves in your SQL Server instance following Steps 1-2 in Tutorial: Getting started with Always Encrypted with secure enclaves in SQL Server.
Import the ContosoHR demo database.
1. Clone/Download the repository.
2. Open SSMS and connect to your SQL Server instance.
3. In SSMS, right-click on Databases in Object Explorer and select Import Data-tier Application....
4. Locate the ContosoHR bacpac file the /setup folder.
5. Complete the steps of the wizard to import the ContosoHR database.
Configure the Contoso HR web application
1. Start Visual Studio and open the ContosoHR solution file located in ../source.
2. Using Solution Explorer, locate and open the appsettings.json file under the ContosoHR project.
3. Look for the line that contains the database connection string for the web application. The line should look like this:
```
"ContosoHRDatabase": "Server=tcp:<yourservername>.database.windows.net;Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=<yourattestationurl>; Authentication=Active Directory Managed Identity"
```
replace it with
```
"ContosoHRDatabase": "Data Source=.;Initial Catalog=ContosoHR;Column Encryption Setting=Enabled;Attestation Protocol=None;Integrated Security=true"
```
1. Make sure the value of the Data Source keyword in the database connection string correctly identifies your SQL Server instance.
2. The Attestation Protocol should be set to None.
3. Save the file.
In Visual Studio, select Build>Build Solution to build the demo application.

Prepare for the demo

This section describes the steps you should execute before each demo presentation.

During the demo, you will use two instances of SSMS:

DBA's instance - when using it, you will assume the role of a DBA.
Security Administrator's instance - when using it, you will assume the role of a Security Administrator, who configures Always Encrypted in the database.

Perform the below steps before you show the demo.

Close all running SSMS instances.
Prepare DBA's instance of SSMS.
1. Start SSMS.
2. In the Connect to Server dialog:
  1. In the main page of the dialog, enter your database server name. For example, enter . to connect to the default instance on the local machine. Set your authentication parameters.
  2. Click the Options >> button, select the Connection Properties tab and enter the database name (ContosoHR).
  3. Select the Always Encrypted tab. Make sure the Enable Always Encrypted checkbox is not selected.
  4. Click Connect.
3. Configure an extended event session to intercept application's queries.
  1. Click Ctrl + O. In the Open File dialog, navigate to the tsql-scripts folder and select *CreateXESession.sql. Click F5 to execute the query.
  2. In Object Explorer, locate the newly created Demo extended event session - under your server, go to Management/Extended Events/Sessions.
  3. Righ-click the Demo session and select Watch Live Data. This will open the Demo Live Data window.
  1. Close the tab with the *CreateXESession.sql query.
4. Prepare the query windows for the demo.
  1. With the ContosoHR database selected in Object Explorer, click Ctrl + O. In the Open File dialog, navigate to the tsql-scripts folder and select ListAllEmployees.sql. Do not execute the query yet.
Prepare Security Administrator's instance of SSMS.
1. Start SSMS.
2. In the Connect to Server dialog:
  1. In the main page of the dialog, enter your database server name. For example, enter . to connect to the default instance on the local machine. Set your authentication parameters.
  2. Click the Options >> button, select the Connection Properties tab and enter the database name (ContosoHR).
  1. Select the Always Encrypted tab. Make sure the Enable Always Encrypted and the Enable secure enclaves checkbox are selected. Set the Enclave attestation Protocol to None.
  1. Click Connect.
3. Configure query windows.
  1. In Object Explorer, find and select the ContosoHR database.
  2. With the ContosoHR database selected, click Ctrl + O. In the Open File dialog, navigate to the tsql-scripts folder and select EncryptColumns.sql. Do not execute the query yet.
Run the web application
1. Open the ContosoHR solution, located in ../source, in Visual Studio.
2. Click F5 to run the solution. The Contoso HR web application should open in a browser window.

Demo steps

Show the Contoso HR web app in the browser. This application displays employee records and allows you to filter employees by salary or by a portion of the social security number (SSN). Move the salary slider and enter a couple of digits in the search box to filter by salary and SSN. You can also click on the Ssn or Salary headers to sort by SSN or salary.
Switch to DBA's instance of SSMS, select the ListAllEmployees.sql tab and click F5 to execute the query, which shows the content of the Employees table, the web application uses as a data store. As a DBA, you can view all sensitive information about employees, including the data stored in the SSN and Salary columns. A malicious DBA could easily exfiltrate the data by running a simple query like this one.
Inspect the queries the demo application has sent to the database.
1. Select the Demo Live Data window, which should contain a table with some events your demo application triggered.
2. If the table does not contain the statement column, right click on the header of the table and select Choose Columns.... Move statement to Selected columns and click OK.
3. Double click on the statement column in the last row of the table to see the last query the application sent to the database. Inspect the query statement. Note that the query contains the WHERE clause with rich computations on encrypted columns: pattern matching using the LIKE predicate on the SSN column and the range comparison on the Salary column. The query also sorts records (the ORDER BY clause) by SSN or Salary.
4. Locate the value of query parameters: @SSNSearchPattern, @MinSalary, @MaxSalary. Note that the values of the parameters are in plaintext, as the columns, the parameters correspond to, are not encrypted.
1. Click OK to close the statement window.
As a Security Administrator, provision a column master key for Always Encrypted.
1. In Object Explorer of the Security Administrator's instance of SSMS, expand the node of the ContosoHR database and navigate to Security/ Always Encrypted Keys/Column Master Keys.
2. Right-click on the Column Master Keys folder and select New Column Master Key….
3. Enter a column master key name: CMK1.
4. Select Windows Certificate Store - Current User.
5. Make sure Allow enclave computations is selected.
6. Click Generate Certificate to create a new certificate to be used as a column master key.
7. Click OK.
As a Security Administrator, provision a column encryption key for Always Encrypted.
1. In Object Explorer of the Security Administrator's instance of SSMS, expand the node of the ContosoHR database and navigate to Security/ Always Encrypted Keys/Column Encryption Keys.
2. Right-click on the Column Encryption Keys folder and select New Column Encryption Key….
3. Enter a column encryption key name: CEK1.
4. Select CMK1 as the column master key to protect your new column encryption key.
5. Click OK.
As a Security Administrator, encrypt the SSN and Salary columns in place, using the secure enclave.
1. In Security Administrator's instance of SSMS, select the EncryptColumns.sql tab and click F5 to execute the query.
Switch back to DBA's instance of SSMS, select the ListAllEmployees.sql tab and click F5 to execute the query again. Now the query should show the encrypted data in the SSN and Salary columns. As both columns are encrypted, the DBA cannot see the data in plaintext.
In the web browser containing the web app, move the slider to reset the filter for salary and then re-enter a few digits of an SSN. Confirm the application still can filter employee records by salary and SSN.
Inspect the queries the demo application sends to the database, after encrypting the columns.
1. In DBA's instance of SSMS, select the Demo Live Data window, which should contain a table with some events your demo application triggered.
2. Double click on the statement column in the last row of the table to see the last query the application sent to the database. Inspect the query statement. Note that the query statement the query sends to the database has not changed - it still contains pattern matching using the LIKE predicate on the SSN column and the range comparison on the Salary column, as well as sorting (the ORDER BY clause) by SSN or Salary.
3. Locate the value of query parameters: @SSNSearchPattern, @MinSalary, @MaxSalary. Note that the values of the parameters are now encrypted – the client driver inside the web app transparently encrypts parameters corresponding to encrypted columns, before sending the query to the database. Not only does not the DBA have access to sensitive data in the database, but the DBA cannot see the plaintext values of query parameters used to process that data either.
1. Click OK to close the statement window.

Key takeaways

Secure enclaves make it possible to encrypt sensitive data columns in-place, eliminating a need to move the data outside of the database for cryptographic operations.

The unique benefit of Always Encrypted with secure enclaves is that it allows you to protect your sensitive data from high-privilege users, including DBAs in your organization, and, after you encrypt your data to protect it, your applications can continue running rich queries on encrypted columns.

Reset the demo

In Security Administrator's instance of SSMS:

Open and execute tsql-scripts/DecryptColumns.sql.
Open and execute tsql-scripts/DropKeys.sql.
Close both SSMS windows.

README.md Unescape Escape

Always Encrypted with secure enclaves in SQL Server without attestation - Demos

Contents

About this sample

Before you begin

Setup

Prepare for the demo

Demo steps

Key takeaways

Reset the demo

README.md