< TDE >
-Transparent Data Encryption
-응용 프로그램의 수정 없이 DB 내부에서 컬럼, 테이블스페이스 레벨의 암호화를 하는 것
<TDE에서 지원되는 암호화 알고리즘>
- AES128 : AES (Advanced Encryption Standard), 128 bits (Key Size)
- AES192 : AES (Advanced Encryption Standard), 192 bits(defalut)(Key Size)
- AES256 : AES (Advanced Encryption Standard), 256 bits (Key Size)
- 3DES168 : Three DES (Data Encryption Standard), 168 bits (Key Size)
<TDE 암호화>
1) Columns Level Encryption (10g,11g)
: 테이블의 특정 컬럼만 암호화, 블록의 특정 부분만 암호화
2) Tablespace Level Encryption (11g)
: 테이블스페이스 전체가 암호화, 테이블 사이즈의 증가가 없음.
- System, Sysaux, Undo, Temp 의 경우 테이블스페이스 레벨 암호화 방식을 사용할 수 없다.
- Expdp/Impdp 는 TDE 를 지원 (10g R2, 11g)
- Bitmap index, Index range scan 지원
- Lob 지원(11g), Logminer, logical standby db, streams, HSM(Hardware Security Module)
<TDE_Colnums Level Test> - 11g
1.Master Key 생성
[oracle@11g-:~]$pwd
/home/oracle
[oracle@11g-:~]$mkdir tde_wallet
[oracle@11g-:/u01/base/product/11g/network/admin]$vi sqlnet.ora
ENCRYPTION_WALLET_LOCATION=
(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/home/oracle/tde_wallet)))
SQL> alter system set encryption key identified by walltest;
System altered.
[oracle@11g-:~/tde_wallet]$ll
total 4
-rw-r--r--. 1 oracle dba 2845 Nov 16 00:14 ewallet.p12
SQL> select * from v$encryption_wallet
WRL_TYPE WRL_PARAMETER STATUS
---------- --------------------------------- ---------------
file /home/oracle/tde_wallet OPEN
2.Create Encrypted Table & Manage Wallet
SQL> CREATE TABLESPACE tde DATAFILE '/oradata/tde.dbf' SIZE 100m autoextend on ;
Tablespace created.
SQL> create user tde_user identified by oracle default tablespace tde;
User created.
SQL> grant resource, connect to tde_user;
Grant succeeded.
SQL> conn tde_user
Enter password:
Connected.
SQL> show user
USER is "TDE_USER"
SQL> create table tde_table (cust_id number, cust_name varchar2(20), card_num varchar2(20) encrypt);
Table created.
=========(sys계정에서 table 생성 X)
ERROR at line 1:
ORA-28336: cannot encrypt SYS owned objects
SQL> insert into tde_table values (1, 'a', 'a');
insert into tde_table values (2, 'a', 'a');
insert into tde_table values (3, 'a', 'a');
insert into tde_table values (4, 'a', 'a');
insert into tde_table values (5, 'a', 'a');
insert into tde_table values (6, 'a', 'a');
SQL> select * from user_encrypted_columns
TABLE_NAME COLUMN_NAME ENCRYPTION_ALG SALT INTEGRITY_
-------------------- -------------------- -------------------- --------- ----------
TDE_TABLE CARD_NUM AES 192 bits key YES SHA-1
SQL>select * from v$encryption_wallet
WRL_TYPE WRL_PARAMETER STATUS
---------- ------------------------------ ------------------------------------------------------
file /home/oracle/tde_wallet OPEN
SQL> alter system set encryption wallet close identified by walltest;
System altered.
SQL> select * from v$encryption_wallet;
WRL_TYPE WRL_PARAMETER STATUS
---------- ------------------------------ ------------------------------------------------------
file /home/oracle/tde_wallet CLOSED
SQL> conn tde_user
Enter password:
Connected.
SQL> select * from tde_table;
select * from tde_table
*
ERROR at line 1:
ORA-28365: wallet is not open
SQL> select cust_id, cust_name from tde_table;
CUST_ID CUST_NAME
---------- ------------------------------------------------------------
1 a
2 a
3 a
4 a
5 a
6 a
6 rows selected.
SQL> select cust_id, cust_name, cust_num from tde_table;
select cust_id, cust_name, cust_num from tde_table
*
ERROR at line 1:
ORA-00904: "CUST_NUM": invalid identifier
<TDE_Tablespace Level Test> - 11g
1.Master Key 생성
SQL> conn / as sysdba
Connected.
SQL> show user
USER is "SYS"
SQL> alter system set encryption key identified by walltest;
System altered.
SQL> CREATE TABLESPACE tde_table DATAFILE '/oradata/tde_table.dbf' SIZE 100m autoextend on encryption using 'AES256' default storage(encrypt);
Tablespace created.
SQL> select tablespace_name, encrypted from dba_tablespaces where tablespace_name='TDE_TABLE';
TABLESPACE_NAME ENCRYPTED
------------------------------------------------------------------------------------------ ---------
TDE_TABLE YES
2.Create Encrypted Tablespace & Manage Wallet - 11g
SQL> conn tde_user/oracle
Connected.
SQL> create table tde_tablespace (cust_id number, cust_name varchar2(20), card_num varchar2(20)) tablespace tde_table;
Table created.
SQL>insert into tde_tablespace values (2, 'a', 'a');
insert into tde_tablespace values (3, 'a', 'a');
insert into tde_tablespace values (4, 'a', 'a');
insert into tde_tablespace values (5, 'a', 'a');
insert into tde_tablespace values (6, 'a', 'a');
SQL> commit;
Commit complete.
SQL> select * from tde_tablespace
CUST_ID CUST_NAME CARD_NUM
---------- ---------- ----------
2 a a
3 a a
4 a a
5 a a
6 a a
SQL> show user
USER is "TDE_USER"
SQL> conn / as sysdba
Connected.
SQL> show user
USER is "SYS"
SQL> alter system set encryption wallet close identified by walltest;
System altered.
SQL> select * from v$encryption_wallet;
WRL_TYPE WRL_PARAMETER STATUS
---------- ------------------------------ ------------------------------------------------------
file /home/oracle/tde_wallet CLOSED
SQL> select * from wallet.tde_tablespace;
select * from wallet.tde_tablespace
*
ERROR at line 1:
ORA-00942: table or view does not exist
<TDE Test> - 12c
[oracle@12c-:~]$ll
total 0
drwxr-xr-x. 2 oracle dba 6 Nov 16 01:19 wallet
[oracle@12c-:~]$pwd
/home/oracle
[oracle@12c-:/u01/base/product/12c/network/admin]$vi sqlnet.ora -- key 생성
ENCRYPTION_WALLET_LOCATION=
(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/home/oracle/wallet)))
SQL> administer key management create keystore '/home/oracle/wallet/' identified by wallet; -- key open
keystore altered.
SQL> host ls /home/oracle/wallet/
ewallet.p12
SQL> administer key management set keystore open identified by wallet; -- key active
keystore altered.
SQL> select con_id, key_id from v$encryption_keys;
no rows selected
SQL> administer key management set key identified by wallet with backup;
keystore altered.
SQL> select con_id, key_id from v$encryption_keys;
CON_ID KEY_ID
---------- ------------------------------------------------------------------------------
0 AaOoOeolCU+7v+OcVlHybrMAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
SQL> select * from v$encryption_wallet;
WRL_TYPE WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR FULLY_BAC CON_ID
-------------------- -------------------------------------------------- ------------------------------ -------------------- --------- --------- ----------
FILE /home/oracle/wallet/ OPEN PASSWORD SINGLE NO 0
SQL> select * from v$encryption_wallet
WRL_TYPE WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR FULLY_BAC CON_ID
-------------------- ------------------------------ ------------------------------ -------------------- --------- --------- ----------
FILE /home/oracle/wallet/ OPEN PASSWORD SINGLE NO 0
SQL> select * from v$encryption_wallet
WRL_TYPE WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR FULLY_BAC CON_ID
-------------------- ------------------------------ ---------- -------------------- --------- --------- ----------
FILE /home/oracle/wallet/ OPEN PASSWORD SINGLE NO 0
SQL> create tablespace tde_table datafile '/oradata/tde_table.dbf' size 100m encryption using 'AES256' default storage(encrypt);
Tablespace created.
SQL> create user tde_user identified by oracle default tablespace tde_table;
User created.
SQL> grant resource, connect to tde_user;
Grant succeeded.
SQL> create table tde_tablespace (name number, id varchar2(20), num varchar2(20)) tablespace tde_table;
Table created.
SQL> select tablespace_name, encrypted from dba_tablespaces where tablespace_name='TDE_TABLE';
TABLESPACE_NAME ENC
------------------------------ ---
TDE_TABLE YES
SQL> conn tde_user
Enter password:
Connected.
SQL> create table tde_table ( name number, id varchar2(20), num varchar2(20) encrypt) tablespace tde_table;
Table created.
SQL> create table tde ( name number, id varchar2(20), num varchar2(20) encrypt);
Table created.
SQL> conn / as sysdba
Connected.
SQL> select owner, table_name, column_name, encryption_alg from dba_encrypted_columns where table_name='TDE_TABLE'
OWNER TABLE_NAME COLUMN_NAM ENCRYPTION_ALG
---------- ---------- ---------- -----------------------------
TDE_USER TDE_TABLE NUM AES 192 bits key
SQL> select owner, table_name, column_name, encryption_alg from dba_encrypted_columns where table_name='TDE';
OWNER TABLE_NAME COLUMN_NAM ENCRYPTION_ALG
---------- ---------- ---------- -----------------------------
TDE_USER TDE NUM AES 192 bits key
SQL> select * from v$encryption_wallet;
WRL_TYPE WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR FULLY_BAC CON_ID
-------------------- ------------------------------ ---------- -------------------- --------- --------- ----------
FILE /home/oracle/wallet/ OPEN PASSWORD SINGLE NO 0
SQL> administer key management create auto_login keystore from keystore '/home/oracle/wallet/' identified by wallet;
keystore altered.
SQL> select * from v$encryption_wallet;
WRL_TYPE WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR FULLY_BAC CON_ID
-------------------- ------------------------------ ---------- -------------------- --------- --------- ----------
FILE /home/oracle/wallet/ OPEN PASSWORD SINGLE NO 0
SQL> startup force
ORACLE instance started.
Total System Global Area 2399141888 bytes
Fixed Size 8623496 bytes
Variable Size 654314104 bytes
Database Buffers 1728053248 bytes
Redo Buffers 8151040 bytes
Database mounted.
Database opened.
SQL> select * from v$encryption_wallet;
WRL_TYPE WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR FULLY_BAC CON_ID
-------------------- ------------------------------ ---------- -------------------- --------- --------- ----------
FILE /home/oracle/wallet/ OPEN AUTOLOGIN SINGLE NO 0
-- 모든 pdbs에서 keystore 열고 활성화
administer key management set keystore open identified by wallet container=all;
administer key management set key identified by wallet with backup container=all;
-- TDE 확인 명령어
SQL> select table_name, column_name from dba_encrypted_columns;
TABLE_NAME COLUMN_NAM
---------- ----------
TDE_TABLE NUM
TDE NUM
SQL> select a.table_name, a.tablespace_name from dba_tables a, dba_tablespaces b where a.tablespace_name = b.tablespace_name and b.encrypted = 'YES'
TABLE_NAME TABLESPACE_NAME
-------------------- ------------------------------
TDE_TABLESPACE TDE_TABLE
TDE_TABLE TDE_TABLE
TDE TDE_TABLE
SQL> select a.index_name, a.tablespace_name from dba_indexes a, dba_tablespaces b where a.tablespace_name = b.tablespace_name and b.encrypted = 'YES' and index_name not like 'SYS_IL%';
no rows selected
SQL> select * from v$encryption_wallet;
WRL_TYPE WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR FULLY_BAC CON_ID
-------------------- ------------------------------ ---------- -------------------- --------- --------- ----------
FILE /home/oracle/wallet/ OPEN AUTOLOGIN SINGLE NO 0
SQL> SELECT con_id, key_id FROM v$encryption_keys;
CON_ID KEY_ID
---------- ------------------------------------------------------------------------------
0 AaOoOeolCU+7v+OcVlHybrMAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
<TDE Test> - 19c
**혹시 안되면
[oracle@19c-:~]$echo $ORACLE_UNQNAME
ver19c
--19c에서 wallet_root 경로를 설정하면 하위폴더로 tde가 설정됨
ex)
SQL> alter system set wallet_root="/oradata" scope=spfile;
SQL> select * from v$encryption_wallet
WRL_T WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC CON_ID
----- ------------------------- ------------------------------ -------------------- --------- -------- --------- ----------
FILE /oradata/tde/ NOT_AVAILABLE UNKNOWN SINGLE NONE UNDEFINED 0
[oracle@19c-:/u01/base/admin/ver19c]$mkdir wallet
[oracle@19c-:/u01/base/admin/ver19c]$ll
total 4
drwxr-x--- 2 oracle dba 4096 Nov 17 01:47 adump
drwxr-x--- 2 oracle dba 20 Nov 17 01:18 dpdump
drwxr-x--- 2 oracle dba 35 Nov 17 01:34 pfile
drwxr-xr-x 2 oracle dba 6 Nov 17 01:48 wallet
drwxr-x--- 2 oracle dba 44 Nov 17 01:06 xdb_wallet
SQL> select * from v$encryption_wallet
WRL_T WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC CON_ID
----- ------------------------------ ------------------------------ -------------------- --------- -------- --------- ----------
FILE /u01/base/admin/ver19c/wallet NOT_AVAILABLE UNKNOWN SINGLE NONE UNDEFINED 0
[oracle@19c-:/u01/base/product/19c/network/admin]$vi sqlnet.ora
ENCRYPTION_WALLET_LOCATION=
(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/u01/base/admin/ver19c/wallet/)))
SQL> create pfile from spfile;
File created.
[oracle@19c-:/u01/base/product/19c/dbs]$vi initver19c.ora
WALLET_ROOT=/u01/base/admin/ver19c/wallet
SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup pfile='/u01/base/product/19c/dbs/initver19c.ora'
ORACLE instance started.
Total System Global Area 2399140616 bytes
Fixed Size 8899336 bytes
Variable Size 520093696 bytes
Database Buffers 1862270976 bytes
Redo Buffers 7876608 bytes
Database mounted.
Database opened.
SQL> show parameter spfile
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
spfile string
SQL> select * from v$encryption_wallet;
WRL_T WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC CON_ID
----- ------------------------------ ------------------------------ -------------------- --------- -------- --------- ----------
FILE NOT_AVAILABLE UNKNOWN SINGLE NONE UNDEFINED 0
SQL> create spfile from pfile;
File created.
SQL> alter system set WALLET_ROOT="/u01/base/admin/ver19c/wallet" scope=spfile;
System altered.
SQL> alter system set TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=FILE" scope=spfile;
System altered.
SQL> select * from v$encryption_wallet;
WRL_T WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC CON_ID
----- ------------------------------ ------------------------------ -------------------- --------- -------- --------- ----------
FILE NOT_AVAILABLE UNKNOWN SINGLE NONE UNDEFINED 0
SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORACLE instance started.
Total System Global Area 2399140616 bytes
Fixed Size 8899336 bytes
Variable Size 520093696 bytes
Database Buffers 1862270976 bytes
Redo Buffers 7876608 bytes
Database mounted.
Database opened.
SQL> select * from v$encryption_wallet;
WRL_T WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC CON_ID
----- ------------------------------ ------------------------------ -------------------- --------- -------- --------- ----------
FILE /u01/base/admin/ver19c/wallet/ NOT_AVAILABLE UNKNOWN SINGLE NONE UNDEFINED 0
tde/
SQL> ADMINISTER KEY MANAGEMENT CREATE KEYSTORE '/u01/base/admin/ver19c/wallet/tde' IDENTIFIED BY wallet;
keystore altered.
SQL> SELECT STATUS FROM V$ENCRYPTION_WALLET;
STATUS
------------------------------
CLOSED
SQL> select WRL_TYPE, WRL_PARAMETER, STATUS, CON_ID from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS CON_ID
------------------------------ ----------
FILE
/u01/base/admin/ver19c/wallet/tde/
CLOSED 0
SQL> !ls -lrt /u01/base/admin/ver19c/wallet/tde
total 4
-rw------- 1 oracle dba 2555 Nov 17 02:25 ewallet.p12
SQL> administer key management create auto_login keystore from keystore '/u01/base/admin/ver19c/wallet/tde' identified by wallet;
keystore altered.
SQL> select WRL_TYPE, WRL_PARAMETER, STATUS, CON_ID from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS CON_ID
------------------------------ ----------
FILE
/u01/base/admin/ver19c/wallet/tde/
OPEN_NO_MASTER_KEY 0
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC
------------------------------ -------------------- --------- -------- ---------
CON_ID
----------
FILE
/u01/base/admin/ver19c/wallet/tde/
OPEN_NO_MASTER_KEY AUTOLOGIN SINGLE NONE UNDEFINED
0
SQL> administer key management set keystore open force keystore identified by wallet;
keystore altered.
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC
------------------------------ -------------------- --------- -------- ---------
CON_ID
----------
FILE
/u01/base/admin/ver19c/wallet/tde/
OPEN_NO_MASTER_KEY AUTOLOGIN SINGLE NONE UNDEFINED
0
SQL> administer key management set key FORCE KEYSTORE identified by wallet with backup;
keystore altered.
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC
------------------------------ -------------------- --------- -------- ---------
CON_ID
----------
FILE
/u01/base/admin/ver19c/wallet/tde/
OPEN AUTOLOGIN SINGLE NONE NO
0
SQL> create tablespace TBS_NAME datafile '/oradata/tbs_name.dbf' size 100m autoextend on maxsize 100m EXTENT MANAGEMENT LOCAL SEGMENT SPACE MANAGEMENT AUTO ENCRYPTION DEFAULT STORAGE (ENCRYPT);
Tablespace created.
SQL> CREATE TABLESPACE TBS_NAME2 DATAFILE '/oradata/tbs_name2.dbf' SIZE 100m AUTOEXTEND ON maxsize 200m ENCRYPTION USING 'AES256' DEFAULT STORAGE(ENCRYPT);
Tablespace created.
SQL> select TABLESPACE_NAME, ENCRYPTED from dba_tablespaces;
TABLESPACE_NAME ENC
------------------------------ ---
SYSTEM NO
SYSAUX NO
UNDOTBS1 NO
TEMP NO
USERS NO
TBS_NAME YES
TBS_NAME2 YES