Table of Contents
- Title and Copyright Information
- Preface
- Changes in This Release for Oracle Database Transparent Data Encryption Guide
- 1 Quick-start Setup Guide for Wallet Based Transparent Data Encryption
-
2
Introduction to Transparent Data Encryption
- 2.1 What Is Transparent Data Encryption?
- 2.2 How Configuring Transparent Data Encryption Works
- 2.3 Benefits of Using Transparent Data Encryption
- 2.4 Who Can Configure Transparent Data Encryption?
-
2.5
Types and Components of Transparent Data Encryption
- 2.5.1 About Transparent Data Encryption Types and Components
- 2.5.2 How Transparent Data Encryption Tablespace Encryption Works
- 2.5.3 How Transparent Data Encryption Column Encryption Works
- 2.5.4 How the Keystore for the Storage of TDE Master Encryption Keys Works
- 2.5.5 Supported Encryption and Integrity Algorithms
- 2.6 Transparent Data Encryption in a Multitenant Environment
- 2.7 Transparent Data Encryption Keystore Search Order
-
3
Configuring United Mode
- 3.1 About Configuring United Mode
- 3.2 Operations That Are Allowed in United Mode
-
3.3
Configuring the Keystore Location and Type for United Mode
- 3.3.1 About Configuring the Keystore Location and Type for United Mode
- 3.3.2 Configuring United Mode with the Initialization Parameter File and ALTER SYSTEM
- 3.3.3 Example: Configuring a TDE Wallet When Multiple Databases Share the Same Host
- 3.3.4 Example: Configuring a TDE Wallet for an Oracle Automatic Storage Management Disk Group
- 3.4 Configuring a TDE Wallet and TDE Master Encryption Key for United Mode
- 3.5 Operations That Are Not Allowed in a United Mode PDB
-
3.6
Configuring a Container Database with United Mode PDBs for Oracle Key Vault
- 3.6.1 About Configuring a Container Database with United Mode PDBs for Oracle Key Vault
- 3.6.2 About Configuring a Container Database with United Mode PDBs for Oracle Key Vault
- 3.6.3 Step 1: Configure Oracle Key Vault for United Mode
- 3.6.4 Step 2: Open the Connection to Oracle Key Vault
-
3.6.5
Step 3: Set the TDE Master Encryption Key in Oracle Key Vault
- 3.6.5.1 About Setting the External Keystore TDE Master Encryption Key
- 3.6.5.2 Heartbeat Batch Size for External Keystores
- 3.6.5.3 Setting the TDE Master Encryption Key for United Mode PDBs in an External Keystore
- 3.6.5.4 Migration of an Encrypted Database from a TDE Wallet to Oracle Key Vault or OCI KMS
- 3.6.6 Step 4: Encrypt Your Data in United Mode
-
4
Configuring Isolated Mode
- 4.1 About Configuring Isolated Mode
- 4.2 Operations That Are Allowed in Isolated Mode
- 4.3 Operations That Are Not Allowed in an Isolated Mode PDB
-
4.4
Configuring the Keystore Location and Type for Isolated Mode
- 4.4.1 About Configuring the Keystore Location and Type for Isolated Mode
- 4.4.2 Configuring the Keystore Location and Keystore Type for an Isolated Mode PDB
- 4.4.3 Example: Restoring an Older Version of a Control File
- 4.4.4 Example: Addressing the Problem of a Lost Control File
- 4.4.5 Example: Configuring Isolated Mode in an Oracle Real Application Clusters Environment
-
4.5
Configuring a TDE Wallet and TDE Master Encryption Key in Isolated Mode
- 4.5.1 About Configuring a TDE Wallet in Isolated Mode
- 4.5.2 Step 1: Create a TDE Wallet in a PDB Configured in Isolated Mode
- 4.5.3 Step 2: Open the TDE Wallet in an Isolated Mode PDB
- 4.5.4 Step 3: Set the TDE Master Encryption Key in the TDE Wallet of the Isolated Mode PDB
- 4.5.5 Step 4: Encrypt Your Data in Isolated Mode
-
4.6
Configuring a Container Database with Isolated Mode PDBs for Oracle Key Vault
- 4.6.1 About Configuring an External Keystore in Isolated Mode
- 4.6.2 Step 1: Configure Isolated PDBs for Oracle Key Vault
- 4.6.3 Step 2: Open the Isolated Mode PDB External Keystore
- 4.6.4 Step 3: Set the First TDE Master Encryption Key in the External Keystore
- 4.6.5 Step 4: Encrypt Your Data in Isolated Mode
-
5
Encrypting Columns in Tables
- 5.1 About Encrypting Columns in Tables
- 5.2 Data Types That Can Be Encrypted with TDE Column Encryption
- 5.3 Restrictions on Using TDE Column Encryption
-
5.4
Creating Tables with Encrypted Columns
- 5.4.1 About Creating Tables with Encrypted Columns
- 5.4.2 Creating a Table with an Encrypted Column Using the Default Algorithm
- 5.4.3 Creating a Table with an Encrypted Column Using No Algorithm or a Non-Default Algorithm
- 5.4.4 Using the NOMAC Parameter to Save Disk Space and Improve Performance
- 5.4.5 Example: Using the NOMAC Parameter in a CREATE TABLE Statement
- 5.4.6 Example: Changing the Integrity Algorithm for a Table
- 5.4.7 Creating an Encrypted Column in an External Table
- 5.5 Encrypting Columns in Existing Tables
- 5.6 Creating an Index on an Encrypted Column
- 5.7 Adding Salt to an Encrypted Column
- 5.8 Removing Salt from an Encrypted Column
- 5.9 Changing the Encryption Key or Algorithm for Tables with Encrypted Columns
- 5.10 Migrating the Algorithm to the Latest Supported Algorithm for Tables
-
6
Encryption Conversions for Tablespaces and Databases
- 6.1 About Encryption Conversion for Tablespaces and Databases
- 6.2 Impact of a Closed TDE Keystore on Encrypted Tablespaces
- 6.3 Restrictions on Using Transparent Data Encryption Tablespace Encryption
- 6.4 Creating an Encrypted New Tablespace
- 6.5 Setting the Tablespace Encryption Default Algorithm
- 6.6 Encrypting Future Tablespaces
- 6.7 Encrypted Sensitive Credential Data in the Data Dictionary
- 6.8 Encryption Conversions for Existing Offline Tablespaces
-
6.9
Encryption Conversions for Existing Online Tablespaces
- 6.9.1 About Encryption Conversions for Existing Online Tablespaces
- 6.9.2 Encrypting an Existing Tablespace with Online Conversion
- 6.9.3 Rekeying an Existing Tablespace with Online Conversion
- 6.9.4 Rekeying the SYSAUX and UNDO Tablespaces with Online Conversion
- 6.9.5 Decrypting an Existing Tablespace with Online Conversion
- 6.9.6 Finishing an Interrupted Online Encryption Conversion
- 6.10 Rekeying an Encrypted Tablespace
- 6.11 Creating an Encrypted Database Using DBCA
- 6.12 Encryption Conversions for Existing Databases
-
7
Managing the Keystore and the Master Encryption Key
-
7.1
Managing the Keystore
- 7.1.1 Performing Operations That Require a Keystore Password
- 7.1.2 Configuring Auto-Open Connections into External Key Managers
- 7.1.3 Changing the Oracle Key Vault Password
- 7.1.4 Configuring an External Store for a Keystore Password
- 7.1.5 Backing Up Password-Protected TDE Wallets
- 7.1.6 How the V$ENCRYPTION_WALLET View Interprets Backup Operations
- 7.1.7 Backups of the External Keystore
- 7.1.8 Merging TDE Wallets
- 7.1.9 Moving a TDE Wallet to a New Location
- 7.1.10 Moving a TDE Wallet Out of Automatic Storage Management
- 7.1.11 Migrating from a TDE Wallet to Oracle Key Vault
- 7.1.12 Migration of Keystores to and from Oracle Key Vault
- 7.1.13 Configuring Keystores for Automatic Storage Management
- 7.1.14 Managing Updates to the PKCS#11 Library
- 7.1.15 Backup and Recovery of Encrypted Data
- 7.1.16 Dangers of Deleting TDE Wallets
- 7.1.17 Features That Are Affected by Deleted Keystores
-
7.2
Managing the TDE Master Encryption Key
- 7.2.1 TDE Master Encryption Key Attribute Management
- 7.2.2 Creating Custom TDE Master Encryption Key Attributes for Reports
-
7.2.3
Setting or Rekeying the TDE Master Encryption Key in the Keystore
- 7.2.3.1 About Setting or Rekeying the TDE Master Encryption Key in the Keystore
- 7.2.3.2 Creating, Tagging, and Backing Up a TDE Master Encryption Key
- 7.2.3.3 About Rekeying the TDE Master Encryption Key
- 7.2.3.4 Rekeying the TDE Master Encryption Key
- 7.2.3.5 Changing the TDE Master Encryption Key for a Tablespace
-
7.2.4
Exporting and Importing the TDE Master Encryption Key
- 7.2.4.1 About Exporting and Importing the TDE Master Encryption Key
- 7.2.4.2 About Exporting TDE Master Encryption Keys
- 7.2.4.3 Exporting a TDE Master Encryption Key
- 7.2.4.4 Example: Exporting a TDE Master Encryption Key by Using a Subquery
- 7.2.4.5 Example: Exporting a List of TDE Master Encryption Key Identifiers to a File
- 7.2.4.6 Example: Exporting All TDE Master Encryption Keys of the Database
- 7.2.4.7 About Importing TDE Master Encryption Keys
- 7.2.4.8 Importing a TDE Master Encryption Key
- 7.2.4.9 Example: Importing a TDE Master Encryption Key
- 7.2.4.10 How Keystore Merge Differs from TDE Master Encryption Key Export or Import
- 7.2.5 Converting from ENCRYPTION_WALLET_LOCATION to WALLET_ROOT and TDE_CONFIGURATION
- 7.2.6 Management of TDE Master Encryption Keys Using Oracle Key Vault
- 7.3 Transparent Data Encryption Data Dynamic and Data Dictionary Views
-
7.1
Managing the Keystore
-
8
Administering United Mode
-
8.1
Administering Keystores and Master Encryption Keys in United Mode
- 8.1.1 Changing the Keystore Password in United Mode
- 8.1.2 Backing Up a Password-Protected TDE Wallet in United Mode
- 8.1.3 Closing Keystores in United Mode
- 8.1.4 Creating TDE Master Encryption Keys for Later Use in United Mode
- 8.1.5 Example: Creating a Master Encryption Key in All PDBs
- 8.1.6 Activating TDE Master Encryption Keys in United Mode
- 8.1.7 Creating User-Defined TDE Master Encryption Keys
- 8.1.8 Rekeying the TDE Master Encryption Key in United Mode
- 8.1.9 Finding the TDE Master Encryption Key That Is in Use in United Mode
- 8.1.10 Creating a Custom Attribute Tag in United Mode
- 8.1.11 Moving TDE Master Encryption Keys into a New Keystore in United Mode
- 8.1.12 Automatically Removing Inactive TDE Master Encryption Keys in United Mode
- 8.1.13 Isolating a Pluggable Database Keystore
-
8.2
Administering Transparent Data Encryption in United Mode
- 8.2.1 Moving PDBs from One CDB to Another in United Mode
-
8.2.2
Unplugging and Plugging a PDB with Encrypted Data in a CDB in United Mode
- 8.2.2.1 Unplugging a PDB That Has Encrypted Data in United Mode
- 8.2.2.2 Plugging a PDB That Has Encrypted Data into a CDB in United Mode
- 8.2.2.3 Unplugging a PDB That Has Master Encryption Keys Stored in an External Keystore in United Mode
- 8.2.2.4 Plugging a PDB That Has Master Encryption Keys Stored in an External Keystore in United Mode
- 8.2.3 Managing Cloned PDBs with Encrypted Data in United Mode
- 8.2.4 How Keystore Open and Close Operations Work in United Mode
- 8.2.5 Finding the Keystore Status for All of the PDBs in United Mode
-
8.1
Administering Keystores and Master Encryption Keys in United Mode
-
9
Administering Isolated Mode
-
9.1
Administering Keystores and TDE Master Encryption Keys in Isolated Mode
- 9.1.1 Changing the Keystore Password in Isolated Mode
- 9.1.2 Backing Up a Password-Protected TDE Wallet in Isolated Mode
- 9.1.3 Merging TDE Wallets in Isolated Mode
- 9.1.4 Closing Keystores in Isolated Mode
- 9.1.5 Creating a User-Defined TDE Master Encryption Key in Isolated Mode
- 9.1.6 Creating a TDE Master Encryption Key for Later Use in Isolated Mode
- 9.1.7 Activating a TDE Master Encryption Key in Isolated Mode
- 9.1.8 Rekeying the TDE Master Encryption Key in Isolated Mode
- 9.1.9 Moving a TDE Master Encryption Key into a New Keystore in Isolated Mode
- 9.1.10 Creating a Custom Attribute Tag in Isolated Mode
- 9.1.11 Exporting and Importing the TDE Master Encryption Key in Isolated Mode
-
9.1.12
Storing Oracle Database Secrets in Isolated Mode
- 9.1.12.1 About Storing Oracle Database Secrets in a Keystore in Isolated Mode
- 9.1.12.2 Storing Oracle Database Secrets in a TDE Wallet in Isolated Mode
- 9.1.12.3 Example: Adding an Oracle Key Vault Password to a TDE Wallet
- 9.1.12.4 Example: Changing an Oracle Key Vault Password Stored as a Secret in a TDE Wallet
- 9.1.12.5 Example: Deleting an Oracle Key Vault Password Stored as a Secret in a TDE Wallet
- 9.1.12.6 Storing Oracle Database Secrets in an External Keystore in Isolated Mode
- 9.1.12.7 Example: Adding an Oracle Database Secret to an External Keystore
- 9.1.12.8 Example: Changing an Oracle Database Secret in an External Keystore
- 9.1.12.9 Example: Deleting an Oracle Database Secret in an External Keystore
-
9.1.13
Storing Oracle GoldenGate Secrets in a Keystore in Isolated Mode
- 9.1.13.1 About Storing Oracle GoldenGate Secrets in Keystores in Isolated Mode
- 9.1.13.2 Oracle GoldenGate Extract Classic Capture Mode TDE Requirements
-
9.1.13.3
Configuring Keystore Support for Oracle GoldenGate
- 9.1.13.3.1 Step 1: Decide on a Shared Secret for the Keystore
- 9.1.13.3.2 Step 2: Configure Oracle Database for TDE Support for Oracle GoldenGate
- 9.1.13.3.3 Step 3: Store the TDE GoldenGate Shared Secret in the Keystore
- 9.1.13.3.4 Step 4: Set the TDE Oracle GoldenGate Shared Secret in the Extract Process
- 9.1.14 Migrating Keystores in Isolated Mode
- 9.1.15 Uniting a Pluggable Database Keystore
- 9.1.16 Creating a Keystore When the PDB Is Closed
-
9.2
Administering Transparent Data Encryption in Isolated Mode
- 9.2.1 Cloning or Relocating Encrypted PDBs in Isolated Mode
-
9.2.2
Unplugging and Plugging a PDB with Encrypted Data in a CDB in Isolated Mode
- 9.2.2.1 Unplugging a PDB That Has Encrypted Data in Isolated Mode
- 9.2.2.2 Plugging a PDB That Has Encrypted Data into a CDB in Isolated Mode
- 9.2.2.3 Unplugging a PDB That Has Master Encryption Keys Stored in an External Keystore in Isolated Mode
- 9.2.2.4 Plugging a PDB That Has Master Keys Stored in an External Keystore in Isolated Mode
- 9.2.3 Cloning a PDB with Encrypted Data in a CDB in Isolated Mode
- 9.2.4 Remotely Cloning an Encrypted PDB in Isolated Mode
- 9.2.5 Relocating an Encrypted PDB in Isolated Mode
- 9.2.6 How Keystore Open and Close Operations Work in Isolated Mode
-
9.2.7
Exporting and Importing Master Encryption Keys for a PDB in Isolated Mode
- 9.2.7.1 About Exporting and Importing Master Encryption Keys for a PDB in Isolated Mode
- 9.2.7.2 Exporting or Importing a Master Encryption Key for a PDB in Isolated Mode
- 9.2.7.3 Example: Exporting a Master Encryption Key from a PDB in Isolated Mode
- 9.2.7.4 Example: Importing a Master Encryption Key into a PDB in Isolated Mode
-
9.1
Administering Keystores and TDE Master Encryption Keys in Isolated Mode
-
10
General Considerations of Using Transparent Data Encryption
- 10.1 Migrating Encrypted TDE Columns or Tablespaces after a Database Upgrade from Release 11g
- 10.2 Compression and Data Deduplication of Encrypted Data
- 10.3 Security Considerations for Transparent Data Encryption
- 10.4 Performance and Storage Overhead of Transparent Data Encryption
- 10.5 Modifying Your Applications for Use with Transparent Data Encryption
- 10.6 How ALTER SYSTEM and orapki Map to ADMINISTER KEY MANAGEMENT
- 10.7 Data Loads from External Files to Tables with Encrypted Columns
- 10.8 Transparent Data Encryption and Database Close Operations
-
11
Using Transparent Data Encryption with Other Oracle Features
- 11.1 How Transparent Data Encryption Works with Export and Import Operations
-
11.2
How Transparent Data Encryption Works with Oracle Data Guard
- 11.2.1 About Using Transparent Data Encryption with Oracle Data Guard
- 11.2.2 Encryption of Tablespaces in an Oracle Data Guard Environment
- 11.2.3 Configuring TDE and Oracle Key Vault in an Oracle Data Guard Environment
- 11.2.4 Configuring TDE Wallet-Based Transparent Data Encryption in Oracle Data Guard
- 11.2.5 Migrating a TDE Wallet in an Oracle Data Guard Environment to Oracle Key Vault
- 11.2.6 Isolating an Encrypted PDB in an Oracle Data Guard Environment
- 11.2.7 Uncoupling the Standby Database from the Primary Database Online Encryption Process
- 11.3 How Transparent Data Encryption Works with Oracle Real Application Clusters
- 11.4 How Transparent Data Encryption Works with SecureFiles
- 11.5 How Transparent Data Encryption Works with Oracle Call Interface
- 11.6 How Transparent Data Encryption Works with Editions
- 11.7 Configuring Transparent Data Encryption to Work in a Multidatabase Environment
- 12 Frequently Asked Questions About Transparent Data Encryption
- Index