TDE column encryption of database security

Transparent data encryption (Transparent encryption)

TDE-column-based encryptionWith Oracle's tde-column-based encryption, all you have to do is define the columns that need to be encrypted, Oracle creates a private security encryption key for the table that contains the encrypted columns, and then encrypts the plaintext data for the specified column with the encryption algorithm that you specify. This encryption, does not require us to write special code, as long as we make "need to encrypt the column", when the user inserts the next row of data, the database transparent encrypted data and then store the encrypted data. When the user reads the data, the database automatically decrypts us and does not require the application to modify any code. 1. Ensure that the database compatibility version is higher than 10gsql> show parameter compatible

NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
Compatible string 11.2.0

2. Set the location of the WALLET (write the following in the Sqlnet.ora file, need to restart the database to take effect): Specify the Encryption_wallet_location parameter

[email protected] admin]$ cat Sqlnet.ora

#SQLNET. Authentication_services= (NTS)
NAMES. Directory_path= (TNSNames)
Encryption_wallet_location =
(source=
(Method=file)
(Method_data=
(Directory=/home/oracle/wallet)))

3) in the designation (directory path, build the wallet directory. Otherwise newspaper: Ora-28368:cannot auto-create Wallet

[Email protected] ~]$ mkdir Wallet

[Email protected] wallet]$ pwd

/home/oracle/wallet

4) Create key in wallet

Sql> alter system set encryption key authenticated by "Andy";

System altered.

5) Create a table to encrypt one of the columns

Sql> CREATE TABLE Andy.andy_tde (
ID Number (TEN) primary key,
Col_tde VARCHAR2 (Encrypt) using ' AES192 '
); 2 3 4

Table created.

Description:The cryptographic algorithms supported by TDE:

3des168 AES128 AES192 (default) AES256

Sql> set Linesize 300
Sql> select * from Dba_encrypted_columns;

OWNER table_name column_name ENCRYPTION_ALG
------------------------------ ------------------------------ ------------------------------ ------------------
ANDY andy_tde col_tde AES 192 bits key

sql> INSERT INTO ANDY_TDE values (1, ' tde ');

1 row created.

Sql> commit;

Commit complete.

Sql> select * from Andy_tde;

ID col_tde
---------- ---------------------------------
1 TDE

6) If wallet is turned off, the encrypted data cannot be accessed:

Sql> alter system set wallet close identified by "Andy";

System altered.

Sql> select * from Andy_tde;
SELECT * FROM Andy_tde
*
ERROR at line 1:
Ora-28365:wallet is not open

7) Re-open wallet to access encrypted data

Sql> alter system set wallet open identified by "Andy";

System altered.

Sql> select * from Andy_tde;

ID col_tde
---------- ----------------------------
1 TDE

TDE column encryption of database security