{"id":3985,"date":"2018-07-01T13:04:54","date_gmt":"2018-07-01T04:04:54","guid":{"rendered":"http:\/\/haisins.epac.to\/wordpress\/?p=3985"},"modified":"2018-07-01T13:06:18","modified_gmt":"2018-07-01T04:06:18","slug":"tde-in-oracle-cdb","status":"publish","type":"post","link":"http:\/\/haisins.synology.me\/wordpress\/?p=3985","title":{"rendered":"TDE in Oracle CDB"},"content":{"rendered":"

TDE in Multitenant Database<\/h2>\n

\uae30\uc874\uc5d0\ub294 TDE\uc758 key\uc640 wallet(12c \ubd80\ud130 keystore\ub85c \uba85\uba85, \uc774\ud558 keystore)\uad00\ub9ac\ub97c \uc704\ud574 ‘ALTER SYSTEM SET ENCRYPTION(WALLET)’ \uba85\ub839\uc5b4\ub97c \uc774\uc6a9\ud558\uc600\uc9c0\ub9cc, 12c\ubd80\ud130\ub294 TDE \uad00\ub9ac\ub97c \uc704\ud574 ‘ADMINISTER KEY MANAGENT’ \uba85\ub839\uc5b4\ub97c \uc0ac\uc6a9\ud558\uc5ec\uc57c \ud569\ub2c8\ub2e4. Multitenant \uad6c\uc870\uc5d0\uc11c TDE\uc758 keystore\ub294 CDB Level\uc5d0\uc11c \ud1b5\ud569 \uad00\ub9ac\ub418\uba70, keystore\uc5d0\ub294 \ud574\ub2f9 CDB\uc5d0 \uc5f0\uad00\ub41c PDB\ub4e4\uc758 encryption key\ub4e4\uc744 \ud3ec\ud568\ud558\uace0 \uc788\uc2b5\ub2c8\ub2e4. \ub530\ub77c\uc11c \uac01 PDB\ubcc4\ub85c master encryption key\uac00 \ud544\uc694\ud569\ub2c8\ub2e4. Keystore\ub294 CDB-level\uc5d0\uc11c \ud1b5\ud569\uad00\ub9ac\ub418\ubbc0\ub85c, CDB\uc5d0 \uc811\uc18d\ud558\uc5ec TDE\uc758 Default Setting\uc744 \uc0b4\ud3b4\ubcf4\ub3c4\ub85d \ud558\uaca0\uc2b5\ub2c8\ub2e4.<\/p>\n

\n\n\n<\/colgroup>\n\n\n
[oracle@New-Features-12c ~]$ sqlplus \/ as sysdba<\/span>
\n<\/span><\/p>\n

SQL*Plus: Release 12.1.0.2.0 Production on Wed Oct 7 07:51:11 2015
\n<\/span><\/p>\n

Copyright (c) 1982, 2014, Oracle. All rights reserved.
\n<\/span><\/p>\n

Connected to:
\n<\/span><\/p>\n

Oracle Database 12c EE Extreme Perf Release 12.1.0.2.0 – 64bit Production
\n<\/span><\/p>\n

With the Partitioning, Oracle Label Security, OLAP, Advanced Analytics
\n<\/span><\/p>\n

and Real Application Testing options
\n<\/span><\/p>\n

SQL> set linesize 200
\n<\/span><\/p>\n

SQL> col PARAMETER for a30
\n<\/span><\/p>\n

SQL> col VALUE for a10
\n<\/span><\/p>\n

SQL> SELECT * FROM v$option where parameter like ‘%Transparent Data Encryption%’;
\n<\/span><\/span><\/p>\n

PARAMETER VALUE CON_ID
\n<\/span><\/p>\n

—————————— ———- ———-
\n<\/span><\/p>\n

Transparent Data Encryption TRUE<\/span> 0
\n<\/span><\/p>\n

SQL> col WRL_TYPE for a5
\n<\/span><\/p>\n

SQL> col WRL_PARAMETER for a40
\n<\/span><\/p>\n

SQL> col STATUS for a5
\n<\/span><\/p>\n

SQL> col WALLET_TYPE for a10
\n<\/span><\/p>\n

SQL> col con_id for 99
\n<\/span><\/p>\n

SQL> SELECT * FROM V$ENCRYPTION_WALLET;<\/span>
\n<\/span><\/p>\n

WRL_T WRL_PARAMETER STATU WALLET_TYP WALLET_OR FULLY_BAC CON_ID
\n<\/span><\/p>\n

—– —————————————- —– ———- ——— ——— ——
\n<\/span><\/p>\n

FILE \/u01\/app\/oracle\/admin\/CDB1\/tde_wallet\/<\/span>
\nOPEN<\/span>
\nAUTOLOGIN<\/span> SINGLE NO 0
\n<\/span><\/p>\n

SQL> SELECT con_id, key_id FROM v$encryption_keys;<\/span>
\n<\/span><\/p>\n

CON_ID KEY_ID
\n<\/span><\/p>\n

———- ——————————————————————————
\n<\/span><\/p>\n

0 AWVQNZewSU9qv2w22Z0a6rEAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<\/span>
\n<\/span><\/p>\n

0 AbYg00QInU9jv1Ewc7rZbQ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAA<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

[PDB1]\uc5d0 \uc811\uc18d\ud558\uc5ec, \ud604\uc7ac PDB1\uc5d0\uc11c \uc0ac\uc6a9\ub418\ub294 key\ub97c \ud655\uc778\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \ub610\ud55c \uae30\ubcf8\uc801\uc73c\ub85c PDB1 \ub0b4\uc5d0\uc11c\ub3c4 TDE\uac00 Enable \ub418\uc5b4 \uc788\uc74c\uc744 \ud655\uc778\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n

\n\n\n<\/colgroup>\n\n\n
SQL> connect sys\/oracle_4U@pdb1 as sysdba<\/span>
\n<\/span><\/p>\n

Connected.
\n<\/span><\/p>\n

SQL> SELECT * FROM v$option where parameter like ‘%Transparent Data Encryption%’;
\n<\/span><\/p>\n

PARAMETER VALUE CON_ID
\n<\/span><\/p>\n

—————————— ———- ———-
\n<\/span><\/p>\n

Transparent Data Encryption TRUE<\/span> 0
\n<\/span><\/p>\n

SQL> SELECT con_id, key_id FROM v$encryption_keys;
\n<\/span><\/p>\n

CON_ID KEY_ID
\n<\/span><\/p>\n

———- ——————————————————————————
\n<\/span><\/p>\n

0 AWVQNZewSU9qv2w22Z0a6rEAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<\/span>
\n<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\ud604\uc7ac \uc811\uc18d\ub418\uc5b4 \uc788\ub294 \uc778\uc2a4\ud134\uc2a4\uac00 PDB1\uc778\uc9c0 \ud655\uc778\ud55c \ub4a4, PDB1\uc5d0\uc11c TDE\ub97c \uc774\uc6a9\ud55c \uc554\ud638\ud654\ub41c \ud14c\uc774\ube14\uc2a4\ud398\uc774\uc2a4\ub97c \uc0dd\uc131\ud569\ub2c8\ub2e4.(* TDE\ub294 \ud14c\uc774\ube14, \ud14c\uc774\ube14\uc2a4\ud398\uc774\uc2a4 \ub808\ubca8\ub85c \uc554\ud638\ud654\ub97c \ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.)<\/p>\n

\n\n\n<\/colgroup>\n\n\n
SQL> show pdbs<\/span>
\n<\/span><\/p>\n

CON_ID CON_NAME OPEN MODE RESTRICTED
\n<\/span><\/p>\n

———- —————————— ———- ———-
\n<\/span><\/p>\n

3 PDB1<\/span> READ WRITE NO
\n<\/span><\/p>\n

SQL> CREATE TABLESPACE enc_tbs DATAFILE SIZE 128K AUTOEXTEND ON NEXT 64K ENCRYPTION USING ‘AES256’DEFAULT STORAGE(ENCRYPT);<\/span>
\n<\/span><\/p>\n

Tablespace created.
\n<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\uc554\ud638\ud654\ub41c \ud14c\uc774\ube14\uc2a4\ud398\uc774\uc2a4\ub97c \uc0dd\uc131\ud55c\ub4a4 \uc0dd\uc131\ud55c enc_tbs \ud14c\uc774\ube14\uc2a4\ud398\uc774\uc2a4\uc758 \uc554\ud638\ud654 \uc5ec\ubd80\ub97c \ud655\uc778\ud569\ub2c8\ub2e4.<\/p>\n

\n\n\n<\/colgroup>\n\n\n
SQL> show pdbs<\/span>
\n<\/span><\/p>\n

CON_ID CON_NAME OPEN MODE RESTRICTED
\n<\/span><\/p>\n

———- —————————— ———- ———-
\n<\/span><\/p>\n

3 PDB1<\/span> READ WRITE NO
\n<\/span><\/p>\n

SQL> CREATE TABLESPACE enc_tbs DATAFILE SIZE 128K AUTOEXTEND ON NEXT 64K ENCRYPTION USING ‘AES256’DEFAULT STORAGE(ENCRYPT);<\/span>
\n<\/span><\/p>\n

Tablespace created.
\n<\/span><\/p>\n

SQL> SELECT TABLESPACE_NAME, ENCRYPTED FROM DBA_TABLESPACES;
\n<\/span><\/span><\/p>\n

TABLESPACE_NAME ENC
\n<\/span><\/p>\n

—————————— —
\n<\/span><\/p>\n

SYSTEM NO
\n<\/span><\/p>\n

SYSAUX NO
\n<\/span><\/p>\n

TEMP NO
\n<\/span><\/p>\n

USERS NO
\n<\/span><\/p>\n

EXAMPLE NO
\n<\/span><\/p>\n

APEX_1701140435539813 NO
\n<\/span><\/p>\n

LAB_DATA NO
\n<\/span><\/p>\n

RTL_DATA NO
\n<\/span><\/p>\n

ENC_TBS YES<\/span>
\n<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

TDE in Multitenant Database \uae30\uc874\uc5d0\ub294 TDE\uc758 key\uc640 wallet(12c \ubd80\ud130 keystore\ub85c \uba85\uba85, \uc774\ud558 keystore)\uad00\ub9ac\ub97c \uc704\ud574 ‘ALTER SYSTEM SET ENCRYPTION(WALLET)’ \uba85\ub839\uc5b4\ub97c \uc774\uc6a9\ud558\uc600\uc9c0\ub9cc, 12c\ubd80\ud130\ub294 TDE \uad00\ub9ac\ub97c \uc704\ud574 ‘ADMINISTER KEY MANAGENT’ \uba85\ub839\uc5b4\ub97c \uc0ac\uc6a9\ud558\uc5ec\uc57c \ud569\ub2c8\ub2e4. Multitenant \uad6c\uc870\uc5d0\uc11c TDE\uc758 keystore\ub294 CDB Level\uc5d0\uc11c \ud1b5\ud569 \uad00\ub9ac\ub418\uba70, keystore\uc5d0\ub294 \ud574\ub2f9 CDB\uc5d0 \uc5f0\uad00\ub41c PDB\ub4e4\uc758 encryption key\ub4e4\uc744 \ud3ec\ud568\ud558\uace0 \uc788\uc2b5\ub2c8\ub2e4. \ub530\ub77c\uc11c \uac01 PDB\ubcc4\ub85c master encryption key\uac00 \ud544\uc694\ud569\ub2c8\ub2e4. Keystore\ub294 […]<\/p>\n","protected":false},"author":1,"featured_media":2428,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"spay_email":""},"categories":[20,336],"tags":[710,760,1077,74,762],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/haisins.synology.me\/wordpress\/wp-content\/uploads\/2018\/01\/Bull-cyber-Data-encryption-1.jpg?fit=538%2C303","amp_enabled":true,"_links":{"self":[{"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/3985"}],"collection":[{"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3985"}],"version-history":[{"count":2,"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/3985\/revisions"}],"predecessor-version":[{"id":3987,"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/3985\/revisions\/3987"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=\/wp\/v2\/media\/2428"}],"wp:attachment":[{"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3985"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3985"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/haisins.synology.me\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3985"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}