Confidential development with Always Encrypted using enclaves
summary
Always Encrypted with secure enclaves in Azure SQL enables in-place encryption and key rotation without exporting data, and unlocks rich confidential queries (>, <, LIKE, ORDER BY, indexes) but requires randomized encryption for enclave-protected columns. Choose between Intel SGX (stronger, needs MAA attestation and specific DC-series VMs) or VBS enclaves (wider region availability, no attestation yet). Practical requirements: upgrade drivers, add column encryption settings and attestation URL in the connection string, register Azure Key Vault provider, use parameterized queries. Demo shows first query ~3s (metadata/attestation) then cached fast.
AI-written summary · about
chapters (16)
- 0:00Confidential dev with Always Encrypted
- 1:31What is Always Encrypted
- 2:57Always Encrypted in practice
- 5:02Limitations and enclaves
- 7:29Secure enclaves and types
- 10:59Intel SGX vs VBS enclaves
- 11:41Attestation for Intel SGX
- 12:22Randomized vs deterministic encryption
- 13:24Implementation roles
- 15:29Encryption in app code
- 18:19Live demo: encrypting data
- 26:35App code issues
- 29:06Demo: errors and fixes
- 36:18Key steps for Always Encrypted
- 39:11Parameterized queries impact
- 40:40Summary and resources
related talks
48mProtecting the confidentiality and integrity of your high value data with Azure SQL and SQL Server 2
40mUnderstanding the cryptographic controls in Azure SQL Database
22mSecuring the Future with Azure Confidential Computing
16mSecure data processing with AMD Confidential VMs on Azure Databricks
32mDesigning secure Azure SQL Database solutions
51mWhere should I be encrypting my data
48mGetting To Know SQL Server Encryption Capabilities
12mUsing AMD based confidential VMs for your Azure Data Explorer clusters