Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves
This recommendation meets all the specified requirements:
Minimizes risks of malware using elevated privileges: Always Encrypted with Intel SGX enclaves protects sensitive data from high-privilege users and malware in the database environment3.
Prevents database administrators from accessing sensitive data: Always Encrypted provides separation between those who own the data and those who manage it but should have no access3.
Enables pattern matching for server-side database operations: Intel SGX enclaves support rich confidential queries, including pattern matching, on encrypted data8.
Supports Microsoft Azure Attestation: Intel SGX enclaves in Azure SQL Database work with Azure Attestation for verifying the authenticity of the secure enclave6.
Uses hardware-based encryption: Intel SGX is a hardware-based technology that provides stronger security guarantees compared to virtualization-based security (VBS) enclaves4.
Additionally, Intel SGX enclaves offer the highest level of data protection among the options, as they are resistant to attacks from the host operating system...