{"id":8167,"date":"2019-08-15T13:33:38","date_gmt":"2019-08-15T13:33:38","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/secure-an-oracle-database-by-using-transparent-data-encryption\/"},"modified":"2026-11-03T19:29:28","modified_gmt":"2026-11-03T19:29:28","slug":"secure-an-oracle-database-by-using-transparent-data-encryption","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/de\/blogs\/secure-an-oracle-database-by-using-transparent-data-encryption\/","title":{"rendered":"Secure an Oracle database by using Transparent Data Encryption"},"content":{"rendered":"

Introduction<\/strong><\/p>\n

TDE enables the encryption of sensitive database data, which is stored in the operating system files. It provides secure storage and management of encryption keys in a security module located outside the database.<\/p>\n

Encrypted data is transparently decrypted for a database user who has access to the data. TDE stores the encryption keys in a security module external to the database.<\/p>\n

This blog covers the essentials of how to use the advanced security option to secure sensitive data within an Oracle\u00a9 database by using Transparent Data Encryption (TDE). This feature enables you to encrypt database columns and manage encryption keys.<\/p>\n

Why use TDE?<\/strong><\/p>\n

If thieves steal backup tapes of the database, and restore it on their own server, they have access to the company’s most sensitive data. This is an unacceptable risk. Most company regulations and guidelines consider protecting database data a compliance requirement. How can you protect your database from this vulnerability?<\/p>\n

One solution is to encrypt the sensitive data in the database and to store the encryption keys in a separate location. Without the keys, any stolen data is worthless.<\/p>\n

How does TDE work?<\/strong><\/p>\n

TDE is a key-based access control system. Even if the encrypted data is retrieved, it is useless without authorized decryption, which occurs automatically for users authorized to access the table.<\/p>\n

For tables containing encrypted columns, the encryption key is called the column encryption key. Each table’s column encryption key is encrypted with the database server’s master key. The master encryption key is stored outside the database in the Oracle Wallet.<\/p>\n

Encrypted table keys are placed in the data dictionary. When a user enters data into a column this is defined as encrypted, Oracle performs the following tasks:<\/p>\n

1) It retrieves the master key from the wallet.
\n2) It decrypts the encryption key for that table from the data dictionary.
\n3) It uses that encryption key on the input value.
\n4) It stores the encrypted data in the database.<\/p>\n

\"oracle<\/p>\n

Image Source<\/em><\/a> <\/p>\n

TDE encrypts the data in the following database files:<\/p>\n