Transparent Data Encryption (TDE) in Oracle (Bathymetry Solution)

Transparent Data Encryption (TDE) enables you to encrypt sensitive data, such as credit card numbers, stored in tables and tablespaces. Encrypted data is transparently decrypted for a database user or application that has access to data. TDE helps protect data stored on media in the event that the storage media or data file is stolen. Oracle uses authentication, authorization, and auditing mechanisms to secure data in the database but not in the operating system data files where data is stored. To protect these data files, Oracle provides TDE. TDE encrypts sensitive data stored in data files. To prevent unauthorized decryption, TDE stores the encryption keys in a security module external to the database.

Benefits of using TDE:

See Oracle documentation for more information on configuring TDE tablespace encryption.

To use TDE, follow one of these methods.

Configuring TDE Oracle Enterprise Manager

The following steps show how to configure TDE using Oracle Enterprise Manager (OEM).

RemarqueRemarque :

Copying and pasting the examples may cause syntax errors.

Etapes :
  1. Create the wallet folder.
    mkdir C:\oracle\admin\wallets
    
    OEM > login as sys / sysdba
    
    OEM > Server > Transparent Data Encryption
    
    Advanced Options > Change Location
    
    	Host Credentials
    	Username: <DOMAIN>\dbs_ora
    	Password: xxxxxxx
    
    	Configuration Method: File System
    	
    	Encryption Wallet Directory: C:\oracle\admin\wallets
    
    	OK
    
    Create Wallet > Local Auto-Open Wallet > Create
    
    	Host Credentials
    	Username: <DOMAIN>\dbs_ora
    	Password: xxxxxxx
    
    	Wallet Password:  walletadmin
    
    	Continue
    
  2. Back up the wallet folder.
    cd C:\oracle\admin
    
    zip -r wallets wallets
    

Configuring TDE manually

The following steps show how to manually configure TDE.

RemarqueRemarque :

Copying and pasting the examples may cause syntax errors.

Etapes :
  1. From the command window, create the wallet folder.
    mkdir C:\oracle\admin\wallets
    
  2. Add the wallet location to the sqlnet.ora file.
    ENCRYPTION_WALLET_LOCATION =
      (SOURCE =
        (METHOD = FILE)
        (METHOD_DATA =
          (DIRECTORY = C:\oracle\admin\wallets\$ORACLE_SID)
    
    RemarqueRemarque :

    The default encryption wallet location is $ORACLE_BASE/admin/<global_db_name>/wallet. If you want to allow Oracle to manage a wallet in the default location, there is no need to set the ENCRYPTION_WALLET_LOCATION parameter in the sqlnet.ora file.

  3. Using Oracle SQL Plus or Oracle SQL Developer, generate a master key.
    alter system set encryption key identified by "walletadmin";
    
  4. Using Oracle SQL Plus or Oracle SQL Developer, verify the status of the wallet.
    select * from "v$encryption_wallet";
    
  5. From the command window, set the wallet to auto login.
    set ORACLE_SID=prodlibdb
    
    orapki wallet create -wallet C:\oracle\admin\wallets -auto_login -pwd walletadmin
    
  6. From the command window, back up the wallet folder.
    cd C:\oracle\admin
    
    zip -r wallets wallets
    
4/26/2014