Configuration of transparent data encryption

Similar Questions

• Transparent data encryption and Performance

  We started a project to encrypt our SAP database using the transparent data encryption.  The project is currently mandated by corporate policy, so there is not much choice involved.  The indications are:

  The server O/s: HP - UX 11.31

  CPU: HP Itanium

  Oracle Version: 11.2.0.3 (64-bit)

  DB Dimensions: Approx. 5 TB

  Core SAP: 7.x

  Our leadership is very concerned about the impact on performance.  If you have encrypted your database, SAP or not, I am very interested in hearing if you the performance of your server data after encryption.  Good news, bad news, either.

  TIA,

  Mike

  Dear Mike,

  I can give you a few comments based on direct experience, since we recently migrated from an unencrypted Oracle (11g Enterprise Edition Release 11.2.0.3.0) server to a new server with encryption TDE (same version db).

  Our application is a warehouse of data with massive volumes of data (terabytes) and a few very large tables.

  After having migrated to the new server, which was much more powerful than the former, we were surprised to discover that the performance was much worse (about two times slower, on average, measured on our typical user queries).

  A study on the causes of degradation in performance shows that transparent data encryption are the source of the problem, causing a saturation of the individual CPU (do not look at the aggregate average load on the CPU, which is misleading).

  Basically, we have been deceived by the official Oracle documentation that estimates the impact on the performance of the transparent data encryption in the order of 5 to 8%. Further investigation showed that this low impact may be true of operations that involve a small amount of data. With the full picture of the analyses on large tables however, the truth is that the performance may be (5 - 10 times) slower order that without transparent encryption of data.

  If you want more information, take a look at this excellent article (in two parts):

  https://communities.Intel.com/community/datastack/blog/2012/03/23/real-world-database-encryption-performance-with-Intel-AES-NI-PT-1

  Best,

  Andrea

• After TDE (Transparent Data Encryption) data are always considered as is

  Hello
  
  I encrypted column in the table by using TDE (Transparent Data Encryption), but the data in the column is always displayed as it is. How can I verify that the data has been encrypted. What is the use if tha data are visible even after encryption.
  
  SELECT * from user_encrypted_columns where table_name = 'OA_TRAN_STOCK ';
  
  TABLE_NAME COLUMN_NAME ENCRYPTION_ALG SALT INTEGRITY_ALG
  
  OA_TRAN_STOCK RDPK_KEY AES 128-bit key no. SHA-1
  OA_TRAN_STOCK RDPK_BIN_FILE AES 128-bit key no. SHA-1
  
  Select rdpk_key, RDPK_BIN_FILE from OA_TRAN_STOCK;
  
  RDPK_KEY RDPK_BIN_FILE(Hexadecimal value as inserted in table)
  
  11111 22222-33333-44444-55555 1000011ABCDAAACCC0011110CCBADEF
  11111 21222-33333-44444-55556 1000011ABCDAAACCC0011110CCBADEE
  
  Help, please.

  583003 wrote:
  Tubby thanks for the info.

  But the data is stored as it is in the table. How can I check/confirm that the data is encrypted with proof. Shoding only the metadata that the column was perhaps not enough for the customer.

  Where exactly in the database, I can get this info or how to prove to the client that the data is encrypted, because he sees data as it is in the database.

  http://docs.Oracle.com/CD/E11882_01/network.112/e10746/asotrans.htm#BABEBFBA

  Obviously not something you want to run on a production system, but something that you can easily run in a test/development to demonstrate to your customers environment.

  If they worry about someone in your database hacking and questioning, steal data in this way, then this isn't the solution that you want to implement (or he is not the only solution you would need to implement). As noted in the links I posted before, TDE is designed to protect you against someone steal your support (data files).

  See you soon,.

• Transparent data encryption are supported with Oracle Advanced Replication?

  Which version of DB, TDE supported with Oracle Advanced Replication?

  user939188 wrote:
  Which version of DB, TDE supported with Oracle Advanced Replication?

  "Materialized views do not support columns that have been encrypted by using transparent data encryption."

  Source - http://oracle.su/docs/11g/server.112/e10706/repmview.htm

• Error using Transparent data encryption

  Hi all
  I try to activate the transparent data encryption by performing the following steps:
  1. Add the following clause in sqlnet.ora

  ENCRYPTION_WALLET_LOCATION = (SOURCE =
  (METHOD = FILE)
  (METHOD_DATA =
  (DIRECTORY =
  /usr/oracle/wallets/)))

  2. open wallet set

  SQL> alter system set encryption wallet open identified by foo;
  
  System altered.

  3 but I got the following error when you set the encryption key:

  SQL> alter system set encryption key identified by foo;
  alter system set encryption key identified by manga2
  *
  ERROR at line 1:
  ORA-00600: internal error code, arguments: [ztsmsmkh:set basic key failed], [18446744073709551615],
  [], [], [], [], [], [], [], [], [], []

  What has gone wrong?
  
  Best regards
  Val
  
  Published by: Valerie good-natured October 6, 2011 04:24

  Ora-00600 errors must be triggered through Support of Oracle. They have a corrector of error ora-00600 there, but it does not mean that there's something gone wrong internally and is not likely to be something that someone here can help with, unless they go to Oracle Support themselves and look it up.

• Transparent data encryption

  Hello
  
  How can I migrate my no tablespace for tablespace encriptación encriptación data?

  user011232 wrote:
  without data can pump including metod I use?

  my no tablespace have 50 GB of data, and I have to migrate data to new encryption tablespace.

  50 GB is a very tiny data volume. Please use the Datapump parallel option to speed up the process, if you think that its slow.

  Aman...

• TDE - Transparent data encryption

  Hi all

  I have an EMP table with encrypted column CREDIT_CARD_NO.

  This encrypted table resides on PROD.

  Then I export using the EXP of EMP table that resides on DEV server and it is not encrypted.

  Can I import (imp) this dumpfile prod that is encrypted?

  I tried, but I got error

  H/h = emp file tables IMP = expdat.dmp ignore = yes

  Import: Release 11.2.0.3.0 - Production on Thu Aug 15 18:42:53 2013

  Copyright (c) 1982, 2011, Oracle and/or its affiliates.  All rights reserved.

  IMP-00058: ORACLE error 1031

  ORA-01031: insufficient privileges

  I have already given HR a dba role privileges EXP/IMP.

  Correction: I have only granted privileges DPPUMP, which is the equivalent for EXP/IMP?

  Thank you very much

  zxy

  Post edited by: yxes2013

  Hello

  My knowledge of database vault is that theoretical - I've never really used. As far as I know that same SYS cannot bypass the security of vault database - that explain the error you get with SYS. I think the error with HR is misleading (unless there no DBA) - try to remove the fromuser/touser completely you have not needed - does work?

  Users who access was granted to the Kingdom of database vault? You can import one of these users (temporarily give them s/n?)

  Can give you Kingdom access to HR through the vault db gui tool (see the example here for 12 c - Although it should be the same in previous versions http://docs.oracle.com/cd/E16655_01/server.121/e17609/tdpsg_dv.htm)

  You might have more luck this announcement in a database vault forum - I guess there's a?

  See you soon,.

  Harry

  http://dbaharrison.blogspot.com

• How to reset the Master encryption key in the encryption Transparent data...

  Hello

  I use Transparent data encryption in Oracle Database 11g Release 2.

  After having specified an Oracle Wallet location in the sqlnet.ora file as shown below:

  
  

  ENCRYPTION_WALLET_LOCATION =

  (SOURCE =

  (METHOD = FILE)

  (METHOD_DATA =

  (DIRECTORY = D:\Oracle\enc\admin\tde\wallet)

  )

  )

  Created the master encryption key using the statement

  SQL > ALTER the ENCRYPTION KEY SET of SYSTEM IDENTIFIED BY 'Abc123def456 ';

  Modified system.

  When I reset the master Encryption Key by using the statement get an error as shown below:

  
  SQL > ALTER the ENCRYPTION KEY SET of SYSTEM IDENTIFIED BY 'Easy2rem ';

  ERROR on line 1:

  ORA-28353: cannot open portfolio

  Please help me how to reset the master encryption key.

  Kind regards

  Kalashnikoff.

  Hi currently,

  you need to reset the master encryption key by using the exact same statement:

  CHANGE the ENCRYPTION KEY SET of SYSTEM IDENTIFIED BY 'Abc123def456 ';

  
  

  The passworsd you provide is only the password of the portfolio, the MK is not derived from this, but

  using a secure random number generator, the Wallet password can be changed separately

  using owm or orapki.

  
  

  Greetings,

  
  

  Damage
  

• Develop the encryption Transparent data with Oracle 10 g XE

  Currently I develop an application that will require encrypted in some tables columns, I will recommended to the customer buying an Oracle database for the application and that you have installed Oracle 10 g XE to begin development, I found that I can't create tables with columns TDE tho I can't create a portfolio. I searched the forums and found that a portfolio manager is not available with Oracle XE.
  
  My plan was to develop the application and then provide scripts for creating the DBA of the customer so that they can create data tables in their Oracle database... Can I develop the application without transparent data encryption and then say s/n, which must be implemented in the version of the application? The application needs to know the password of portfolio/TDE to encrypt/decrypt the columns!
  
  Any ideas how I could go on the development of the customer Oracle XE database without access to CDW?

  The T in TDE is transparent, so that your application should need not even be aware that all columns or storage are encrypted. Transparent data encryption are generally implemented in systems that were never designed to encrypt data, so in theory it should be 'perfectly safe' to develop not encrypted and have the client encrypt the columns during installation.

  Of course, when marketing people start talking about things that are 'perfectly safe', it is always a sign of coming danger. Although I have never heard of a case where encrypt a column caused a problem for an application, I would be very doubtful to the development in an environment different from that of production. This includes the exact version of the database (I guess that the customer has installed the last patchsets, so they run 10.2.0.4, for example) as well as editing. If you decide to rely on the fact that everything should go smoothly when you promote to a different version of a different edition of the database with a different schema definition, even if it would normally, you virtually guarantee that you will end up with a problem that will be difficult to solve.

  In your case, I would use XE to the development. It would be much safer to develop against the personal edition. It's not free, but it's the database licensed Enterprise edition to run on developer machines. It is not free, but it is much less than an enterprise edition license.

  Justin

• Oracle encryption vs servers - dba access to unencrypted data encryption

  Hi guys,.
  I have an application that consists of about 20 java servers and batch programs connect to an instance of oracle 11g. Some of the columns in the database are enrypted. This is achieved via PvE (keys stored in HSM, you can configure the columns of database specified etc.).
  I'd use the encryption of the Oracle instead, but I understand there was a requirement of the customer that DBA could not simply get access to unencrypted data.
  
  Is there a way to circumvent this requirement?
  
  Rgds
  Peter

  Hello

  ... There was a requirement of the customer that DBA could not simply get access to unencrypted data.

  Is there a way to circumvent this requirement?

  I'm not sure I understand, as far as I know, in 11g, you have the option to encrypt the data (Transparent data encryption) to the level of the Table or Tablespace level as well.

  For this, Oracle uses a master encryption key. It is true that the master key is stored outside the database (for example, by using an Oracle Wallet) so that the responsibility of the security administrator can be separated from the database one administrator.

  So, later, depends on who has the safety requirement. Access to the master key is a key issue:

  "+ Security is improved because the portfolio password may be unknown to the database administrator, security administrator provide the password. + »

  You will have much more information on the link below:

  http://download.Oracle.com/docs/CD/E11882_01/network.112/e10746/asotrans.htm#g1011122

  Hope this helps.
  Best regards
  Jean Valentine

• I replaced my original Apple Watch with a watch of S2. When I install and associate the new shows, is there a way I can restore all applications, configuration information and data of the original of the new shows so I don't have to start from scratch?

  I replaced my original Apple Watch with a watch of S2. When I install and associate the new watch and my iPhone 7 more, is there any way I can restore all applications, configuration info and data between the original and the new shows, so I don't have to start from scratch?

  Try this procedure

  Cancel the twinning of your iPhone - Apple and Apple Watch Support

  Spend your Apple Watch a new iPhone - Apple Support

• Satellite Pro L450 - automatic change of data encryption

  Hello
  I wonder if anyone can help with a problem I have with a Satellite Pro L450.

  I work in a school and we have a WiFi network. In a particular area, we have 4 laptops that connect to the network wireless without any problem. The problem I have is that the L450 continues to lose its connection and when I look at the properties of the connection, WEP form (which we use) has changed data encryption to WPA - PSK alone. I remove then completely and add it again the network connection and set it to wep and enter my WEP and try to connect.

  In the wireless box, then pronounce the name of my network and not connected says, but at the bottom of the box, it says disconnect? If I then go back to the properties, once more data encryption has changed itself from WEP to WPA - PSK.

  I would be very grateful for any help.
  Thank you
  Paul

  Hey Buddy,

  Which is really strange, but I m wondering your school uses non-secure WEP encryption

  In any case, I recommend an update of page of Toshiba WLAN driver. This might solve your problem:
  http://APS2.toshiba-tro.de/WLAN/

  But before you install the new driver I recommend to remove the old version first.

• Remote Desktop sessions fail with the error of data encryption

  All my remote desktop sessions attempts fail with an error of bull data encryption *. It seems that half of the world has this error and no one can provide an answer. Before binding you to an answer without value, it is all my clients servers with Windows Server 2003-2011 everything, cannot RDP to any of them.

  Most suggested answers a problem of router or server specific problem or suggest disabling large unloading on the network card.  Well, this problem hooked 30 + servers I've tried lately.  I tried with unloading defined on deactivate and activate.  I tried ethernet and wifi.  I tried to do different internet connect, work, home to various customer sites.

  In other words, I can no longer use RDP to connect to servers on ANY connection.  It simply doesn't work anymore.

  I run Windows 7 32 bit and this couple suddenly some days ago.  Before you start, no virus, no updated drivers... blah blah blah.

  The first day, he started, he wouldn't let me RDP via VPN but if I went through the external IP (mapped ports).  Then, it only works if I was on ethernet, not the wireless.  Then he just decided it wouldn't work at all.  Today, that I even tried to get back into the work remotely via RWW and the RDP ActiveX... did not work.  Tried both servers a SBS 2003 to 2008.  Nope.

  XP has a ten years more of life.  Win7 has done roughly three years, now it starts to fall apart.

  If you can fix this before moving on to Windows 8, and without having to wipe my whole PC, it would be much appreciated.

  Hello

  The question you posted would be better suited in the TechNet Forums. I would recommend posting your query in the TechNet Forums:

  http://social.technet.Microsoft.com/forums/en/winserverTS/threads

• Several primary and physical databases Configuration ensures in Data Guard Broker

  Hello

  Is it possible to add two or several primary and physical databases configuration ensures in data guard broker?

  I have 1 primary databases and two databases physical standby that is

  (1) primary that is pri - (database primary)

  (2) secondary i, e, s (physical pending)

  (3) Secondary2 i.e. sec2 (physical pending)

  Practical AM sinister place, my scenario is my pri and dry machines are in seat, if the pri crashed it switch to s that works very well and my S2 is in another area office. Suppose that if my two siege machines pri and sec crashed, so I want to do my mahcine sec2 as primary.

  I have two separate computers to the broker a headquarters and a District Office

  Use failure of quick start on Data Guard Broker, broker headquarters machine I have configured pri and dry but in sector office broker not able congifured pri and S2 and the machine.

  can be done several primary database configuration with data bases on hold?

  Has anyone done this before, or has a perform a recovery after loss of place...

  need help or suggestion

  thanx

  No.... It is not possible. When you use the DG broker, the first thing you can do in the DGMGRL utility is to deliver CONFIGURATION to CREATE. You can see on the doc of this command that you define here the PRIMARY DATABASE.

  The command to add a DATABASE to the broker, adds a new database pending. You cannot add an another primary.

  The broker configuration is explicitly for a primary and all standby databases is supported. If you have an another primary, you create a separate DG broker configuration.

  See you soon,.
  Brian

• Oracle transparent encryption of the data (encryption of data in Table)

  Hello
  
  I use Oracle Database 10.2.0.1 in windows server. I need to encrypt a column of a table in my database. That any demand prior to this and how do I encrypt the data of an existing
  column in a table.
  
  Kind regards
  007

  If I select * from the output of the encrypted column must be encrypted.

  Read post Osama mustafa on DBMS_CRYPTO