Oracle Transparent Data Encryption (TDE)

What is Oracle Transparent Data Encryption (TDE)

Transparent Data Encryption (TDE) enables you to encrypt data so that only an authorized recipient can read it. With Oracle TDE You can encrypt individual columns in a database table, or you can encrypt an entire tablespace. To use Transparent Data Encryption, you do not need to modify your applications. TDE enables your applications to continue working seamlessly as before, because oracle database take cares of encryption and decryption itself completely transparent with the application.
TDE helps protect data stored on media (also called data at rest) in the event that the storage media or data file is stolen.

How Oracle Transparent Data Encryption (TDE) Works

TDE uses TDE encryption keys to encrypt and decrypt the data stored in the data file and the encryption keys are stored in external security module outside of the database, called a keystore

What Level of Transparent Data Encryption is Available

There are 2 types of TDE encryption available
1> Column level
2> Tablespace level.
Both type of encryption uses the two-tiered key-based architecture to transparently encrypt and decrypt sensitive data.
The TDE master encryption key is stored in an external security module (called Keystores), which can be an Oracle software keystore or hardware keystore.

How Column Level Encryption Works

The TDE master encryption key (stored outside of database in hardware or software security module and accessible to only authorized users) encrypts and decrypts the TDE table key (stored in dictionary tables), which in turn encrypts and decrypts data in the table column.
TDE uses a single TDE table key regardless of the number of encrypted columns in that table. Each TDE table key is individually encrypted with the TDE master encryption key and are located together in the colklc column of the ENC$ data dictionary table.
SQL> select MKEYID as MasterKey,colklc from enc$;

MASTERKEY	COLKLC
Ae3sJ0HmGk+svxga/lc625EAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	41774141414141414141414141414141414141414141434E614F564C6537 39334A464F423135573953452F756F764A54684378742B70397751486562 6C6A4A30564C6A5755396A5574724A6978546446584C53393431633D

Ae3sJ0HmGk+svxga/lc625EAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	417741414141414141414141414141414141414141414474784D76757951 6D465178572B696F5044545A4E53324D536D473732343832654A72653350 4859627372516E584256665769414230444763444137426F6271733D

How Tablespace Level Encryption Works

Transparent Data Encryption (TDE) tablespace encryption enables you to encrypt an entire tablespace and all the objects created in an encrypted tablespace is encrypted automatically.
In Tablespace Encryption the TDE master encryption key (stored outside of the database(software or hardware keystore) is used to encrypt the TDE tablespace encryption key, which in turn is used to encrypt and decrypt data in the tablespace.

By Far we already know that the Master Encryption key is stored outside of the database in Keystores. Let us see what options we have for KeyStores to store the Master Encryption key for TDE

What are the Types TDE Keystores

There are two types of keystore. Software KeyStores and Hardware KeyStores

A Software KeyStore Can be one of the following type

Password-based software keystores:

Password-based software keystores are protected by using a password that you create. You must open this type of keystore before the keys can be retrieved or used

Auto-login software keystores:

Auto-login software keystores are protected by a system-generated password. Auto-login software keystores are automatically opened when accessed.

Local auto-login software keystores:

Local auto-login software keystores are auto-login software keystores that are local to the computer on which they are created. Local auto-login keystores cannot be opened on any computer other than the one on which they are created.

Software keystores can be stored on ASM disk groups or in a regular file system.

Hardware KeStore
Hardware Security Modules are physical devices that provide secure storage for
encryption keys, in hardware keystores.

Comments

DataPump Import Of Object Types Fails With Errors ORA-39083 ORA-2304 Or ORA-39117 ORA-39779

<<Back to Oracle DATAPUMP Main Page ORA-39083: Object type TYPE:"TEST_QA01"."LOG_RECORD" failed to create with error: ORA-02304: invalid object identifier literal Import: Release 12.1.0.2.0 - Production on Tue May 29 07:59:12 2018 Copyright (c) 1982, 2014, Oracle and/or its affiliates. All rights reserved. Connected to: Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 - 64bit Production With the Partitioning, Real Application Clusters, Automatic Storage Management, Oracle Label Security, OLAP, Advanced Analytics and Real Application Testing options Master table "SYSTEM"."SYS_IMPORT_FULL_01" successfully loaded/unloaded Starting "SYSTEM"."SYS_IMPORT_FULL_01": system/********@TEST_QA parfile=import_TEST.par Processing object type SCHEMA_EXPORT/USER Processing object type SCHEMA_EXPORT/SYSTEM_GRANT Processing object type SCHEMA_EXPORT/ROLE_GRANT Processing object type SCHEMA_EXPORT/DEFAULT_ROLE Pr

ORA-28374: typed master key not found in wallet

<<Back to Oracle DB Security Main Page ORA-46665: master keys not activated for all PDBs during REKEY SQL> ADMINISTER KEY MANAGEMENT SET KEY FORCE KEYSTORE IDENTIFIED BY xxxx WITH BACKUP CONTAINER = ALL ; ADMINISTER KEY MANAGEMENT SET KEY FORCE KEYSTORE IDENTIFIED BY xxxx WITH BACKUP CONTAINER = ALL * ERROR at line 1: ORA-46665: master keys not activated for all PDBs during REKEY I found following in the trace file REKEY: Create Key in PDB 3 resulted in error 46658 *** 2019-02-06T15:27:04.667485+01:00 (CDB$ROOT(1)) REKEY: Activation of Key AdnU5OzNP08Qv1mIyXhP/64AAAAAAAAAAAAAAAAAAAAAAAAAAAAA in PDB 3 resulted in error 28374 REKEY: Keystore needs to be restored from the REKEY backup.Aborting REKEY! Cause: All this hassle started because I accidently deleted the wallet and all wallet backup files too and also forgot the keystore password. There was no way to restore the wallet back. Fortunately in my case the PDB which had encrypted data was supposed to be deco

How to Find VIP of an Oracle RAC Cluster

<<Back to Oracle RAC Main Page How to Find Out VIP of an Oracle RAC Cluster Login clusterware owner (oracle) and execute the below command to find out the VIP hostname used in Oracle RAC $ olsnodes -i node1 node1-vip node2 node2-vip OR $ srvctl config nodeapps -viponly Network 1 exists Subnet IPv4: 10.0.0.0/255.255.0.0/bondeth0, static Subnet IPv6: Ping Targets: Network is enabled Network is individually enabled on nodes: Network is individually disabled on nodes: VIP exists: network number 1, hosting node node1 VIP Name: node1-vip VIP IPv4 Address: 10.0.0.1 VIP IPv6 Address: VIP is enabled. VIP is individually enabled on nodes: VIP is individually disabled on nodes: VIP exists: network number 1, hosting node node2 VIP Name: node2-vip VIP IPv4 Address: 10.0.0.2 VIP IPv6 Address: VIP is enabled. VIP is individually enabled on nodes: VIP is individually disabled on nodes:

How to Power On/off Oracle Exadata Machine

<<Back to Exadata Main Page How to Power On/off Oracle Exadata Machine Oracle Exadata machines can be powered on/off either by pressing the power button on front of the server or by logging in to the ILOM interface. Powering on servers using button on front of the server The power on sequence is as follows. 1. Start Rack, including switches Note:- Ensure the switches have had power applied for a few minutes to complete power on configuration before starting Exadata Storage Servers 2.Start Exadata Storage Servers Note:- Ensure all Exadata Storage Servers complete the boot process before starting the database servers 3. Start Database Servers Powering On Servers Remotely using ILOM The ILOM can be accessed using the Web console, the command-line interface (CLI), IPMI, or SNMP. For example, to apply power to server dm01cel01 using IPMI, where dm01cel01-ilom is the host name of the ILOM for the server to be powered on, run the

How to Attach to a Datapump Job and Check Status of Export or Import

<<Back to Oracle DATAPUMP Main Page How to check the progress of export or import Jobs You can attach to the export/import job using ATTACH parameter of oracle datapump utility. Once you are attached to the job you check its status by typing STATUS command. Let us see how Step1> Find the Export/Import Job Name You can find the datapump job information from DBA_DATAPUMP_JOBS or USER_DATAPUMP_JOBS view. SQL> SELECT OWNER_NAME,JOB_NAME,OPERATION,JOB_MODE,STATE from DBA_DATAPUMP_JOBS; OWNER_NAME JOB_NAME OPERATION JOB_MODE STATE ---------- ------------------------------ -------------------- ---------- ---------- SYSTEM SYS_EXPORT_FULL_02 EXPORT FULL EXECUTING OR You can also find the job name for export/import in logfile in beginning itself. Step2>Attach to the Job and check status One you get the Export/Import Job Name attach the job and check its status. You can attach or det

How to Create Pfile from Spfile and Vice Versa

<<Back to DB Administration Main Page There are instances when a DBA need to start the database using pfile, for example to trouble an instance startup error or to validate init file post parameter changes etc. In such situations you can create a pfile from spfile and once you are done with your changes you can create spfile from updated/modified pfile to start the database. How to Create Pfile from Spfile As sysdba execute following command SQL> create pfile='/tmp/initOrcl.ora' from spfile; How to Create SPfile from Pfile As sysdba execute following command SQL> create spfile from pfile='/tmp/initOrcl.ora'; You can also create the pfile directly from memory How to Create Pfile from Memory As sysdba execute following command SQL> create pfile='/tmp/initOrcl.ora' from memory;

How to export only data or only metadata using expdp

<<Back to Oracle DATAPUMP Main Page CONTENT parameter of expdp let you select whether you want to export only data or only metadata or both Default : ALL Syntax and Description CONTENT=[ALL | DATA_ONLY | METADATA_ONLY] DATA_ONLY exports only table row data; no database object definitions are exported. METADATA_ONLY exports only database object definitions; no table row data is exported. Exporting metadata only $ cat exp_full_pdb01.par directory=dump dumpfile=EXP_PDB01_FULL%U.dmp logfile=EXP_PDB01_FULL.log full=y CONTENT=METADATA_ONLY $ expdp system@PDB01 parfile=exp_full_pdb01.par Exporting data only directory=dump dumpfile=EXP_PDB01_FULL%U.dmp logfile=EXP_PDB01_FULL.log full=y CONTENT=DATA_ONLY $ expdp system@PDB01 parfile=exp_full_pdb01.par

Step by Step How to Configure Software Keystore/ Oracle Wallet

<<Back to Oracle DB Security Main Page How to Configure a Software Keystore A software keystore is a container that stores the Transparent Data Encryption master encryption key. To configure a software Keystore follow the steps below. Step 1: Set the Keystore Location in the sqlnet.ora File You can store the software keystore (also known as wallet) in file system or in ASM Diskgroup. Does not matter where you want to store the keystore you have modify the sqlnet.ora and make an entry accordingly Make an entry as shown below in $ORACLE_HOME/network/admin/sqlnet.ora file Example1: If Storing the Wallet in ASM ENCRYPTION_WALLET_LOCATION= (SOURCE=(METHOD=FILE) (METHOD_DATA= (DIRECTORY= +DG_TST_DATA/$ORACLE_SID/wallet ) ) ) Example2: If Storing the Wallet in File System ENCRYPTION_WALLET_LOCATION= (SOURCE=(METHOD=FILE) (METHOD_DATA= (DIRECTORY= /u01/dbatst1/admin/wallet/$ORACLE_SID) ) ) NOTE: Ensure that the path you entered in DIREC

ORA-15040: diskgroup is incomplete

<<Back to Oracle ASM Main Page ORA-15040: diskgroup is incomplete SQL> startup ORA-00099: warning: no parameter file specified for ASM instance ASM instance started Total System Global Area 1140850688 bytes Fixed Size 8629704 bytes Variable Size 1107055160 bytes ASM Cache 25165824 bytes ORA-15110: no diskgroups mounted Reason: The reason of this error is simply the ASM is not able to find the some or all the disks. Solution: Investigate and make all the disks available to ASM to mount the disk group. Make sure the disks has proper permissions. If you are using AFD check following services are online oracleacfs oracleadvm oracleoks oracleafd Source of Problem : Issue started after restart of the server After restarting the server when I tried to start the ASM instance its started throwing error. ORA-15110: no diskgroups mounted Investigation in my Case Step1> ASM Logfile Scanning Looked i

ORA-28365: wallet is not open while starting the database

<<Back to DB Administration Main Page ORA-28365: wallet is not open Encountered while Starting the Database $ srvctl start instance -d CDB001 -i CDB0011 PRCR-1013 : Failed to start resource ora.cdb001.db PRCR-1064 : Failed to start resource ora.cdb001.db on node node1.oracle.com CRS-5017: The resource action "ora.cdb001.db start" encountered the following error: ORA-28365: wallet is not open . For details refer to "(:CLSN00107:)" in "/u01/app/oracle/diag/crs/node1.oracle.com/crs/trace/crsd_oraagent_oracle.trc". CRS-2674: Start of 'ora.cdb001.db' on 'node1.oracle.com' failed Solution : Start the instance in mount mode SQL> startup mount; ORACLE instance started. Total System Global Area 2147483648 bytes Fixed Size 2926472 bytes Variable Size 1392511096 bytes Database Buffers 738197504 bytes Redo Buffers 13848576 bytes Database mounted. Check Wallet status set linesiz

Online DBA

Search This Blog