{"id":7107,"date":"2022-11-21T17:54:11","date_gmt":"2022-11-21T17:54:11","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/transparent-data-encryption\/"},"modified":"2026-11-03T19:27:51","modified_gmt":"2026-11-03T19:27:51","slug":"transparent-data-encryption","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/transparent-data-encryption\/","title":{"rendered":"Transparent Data Encryption"},"content":{"rendered":"

Introduction<\/strong><\/h3>\n

Oracle introduced the Transparent Data Encryption (TDE) feature in Oracle 12C for security purposes to let users enable tablespace and column-level encryption for sensitive data. <\/p>\n

After you encrypt data, only authorized users or applications can access it. Oracle uses tools and processes to authenticate, authorize, and audit databases but not the OS data files that store the data.<\/p>\n

According to [the Oracle Database Advanced Security Guide ASOAG<\/a>, “TDE encrypts sensitive data stored in data files. To prevent unauthorized decryption, TDE stores the encryption keys in a security module external to the database, called a keystore.”<\/p>\n

Required TDE privileges<\/strong><\/p>\n

To configure TDE, grant the user the `SYSKM` administrative privilege. Then the ASOAG<\/a> recommends that you “create a password file for it so that the user can connect to the database as SYSKM using a password. To configure TDE column or tablespace encryption,
\nyou don’t need SYSKM … privilege.” However, the ASOAG adds that you do need the following “privileges to encrypt table columns and tablespaces:<\/p>\n

– CREATE TABLE
\n– ALTER TABLE
\n– CREATE TABLESPACE
\n– ALTER TABLESPACE (for online and offline tablespace encryption)
\n– ALTER DATABASE (for fast offline tablespace encryption)<\/em>“<\/p>\n

Apart from these privileges, you should create a wallet that should always be open to enable TDE. The wallet is also known as a *keystore* in 12c.<\/p>\n

Two types of TDE <\/strong><\/p>\n

The following sections describe the two types of TDE:<\/p>\n

    \n
  1. Transparent Data Encryption column encryption<\/strong><\/li>\n<\/ol>\n

    This protects confidential data like credit cards, social security numbers, and so on, stored in the table. According to ASOAG<\/a>, it uses “two-tiered key-based architecture to transparently encrypt and decrypt sensitive table columns. The TDE master encryption key is stored in an external security module, which can be an Oracle software or hardware keystore. This TDE master encryption key encrypts and decrypts the TDE table key, which in turn encrypts and decrypts data in the table column.”<\/p>\n

    \"ted<\/p>\n

     
    \n    Image source<\/a><\/p>\n

    2. Transparent Data Encryption tablespace encryption<\/strong><\/p>\n

    All objects created in the encrypted tablespace are automatically encrypted. It helps you to encrypt the entire table or multiple columns. ASOAG<\/a> adds this: “TDE tablespace encryption uses the two-tiered, key-based architecture to transparently encrypt (and decrypt) tablespaces. The TDE master encryption key is stored in an external security module (software or hardware keystore). This TDE master encryption key is used to encrypt the TDE tablespace encryption key, which in turn is used to encrypt and decrypt data in the tablespace.”<\/p>\n

    3. Required TDE privileges<\/strong><\/p>\n

    To configure TDE, grant the user the `SYSKM` administrative privilege. Then the ASOAG<\/a> recommends that you “create a password file for it so that the user can connect to the database as SYSKM using a password. … To configure TDE column or tablespace encryption, you don’t need SYSKM … privilege.” However, the ASOAG adds that you do need the following “privileges to encrypt table columns and tablespaces:<\/p>\n

    – CREATE TABLE
    \n– ALTER TABLE
    \n– CREATE TABLESPACE
    \n– ALTER TABLESPACE (for online and offline tablespace encryption)
    \n– ALTER DATABASE (for fast offline tablespace encryption)<\/em><\/p>\n

    \nApart from these privileges, you should create a wallet that should always be open to enable TDE. The wallet is also known as a *keystore* in 12c.<\/p>\n

    Two types of TDE <\/strong><\/p>\n

    The following sections describe the two types of TDE:<\/p>\n

    1. Transparent Data Encryption column encryption<\/p>\n

    This protects confidential data like credit cards, social security numbers, and so on,
    \nstored in the table. According to    ASOAG<\/a>,it uses “two-tiered key-based architecture to transparently encrypt and decrypt sensitivetable columns. The TDE master encryption key is stored in an external security module,
    \nwhich can be an Oracle software or hardware keystore. This TDE master encryption key encrypts
    \nand decrypts the TDE table key, which in turn encrypts and decrypts data in the table column.”<\/p>\n

    \"tde<\/p>\n

    *Image source*: [https:\/\/docs.oracle.com\/database\/121\/ASOAG\/introduction-to-transparent-data-encryption.htm#ASOAG10137<\/a>](https:\/\/docs.oracle.com\/database\/121\/ASOAG\/introduction-to-transparent-data-encryption.htm#ASOAG10137<\/a>)*<\/p>\n

    2. Transparent Data Encryption tablespace encryption<\/p>\n

    All objects created in the encrypted tablespace are automatically encrypted. It helps you to encrypt the entire table or multiple columns.
    \n[ASOAG](https:\/\/docs.oracle.com\/database\/121\/ASOAG\/introduction-to-transparent-data-encryption.htm#ASOAG10117    https:\/\/docs.oracle.com\/database\/121\/ASOAG\/introduction-to-transparent-data-encryption.htm#ASOAG10117<\/a>) adds this: “TDE tablespace encryption uses the two-tiered, key-based architecture to transparently encrypt (and decrypt) tablespaces. The TDE master encryption key is stored in an external security module (software or hardware keystore). This TDE master encryption key is used to encrypt the TDE tablespace encryption key, which in turn is used to encrypt and decrypt data in the tablespace.”<\/p>\n

    \"tde<\/p>\n

     Image Source<\/em><\/a><\/p>\n

    Purpose of TDE<\/strong>
    \nThe     ASOAG<\/a> mentions the following reasons to use TDE:<\/p>\n

      \n
    1. To secure sensitive data even if someone steals the storage media or data file.<\/li>\n
    2. To help us to address security-related regulatory compliance issues.<\/li>\n
    3. To create additional auxiliary or views to decrypt application data. It transparently decrypts table data for the database user and application with little or no change to the application.<\/li>\n
    4. DB and application users need not be aware that the data they are accessing is encrypted.<\/li>\n
    5. You can encrypt data with no downtime by using online redefinition or encrypting it in offline mode.<\/li>\n
    6. You don’t need any application changes to handle the encrypted data. The database encrypts and decrypts the data.<\/li>\n
    7. Oracle Database automates TDE master encryption key and keystore management operations.<\/li>\n<\/ol>\n

      Configure TDE<\/strong>
      \n1. Create a wallet or keystore location:<\/strong><\/p>\n

              mkdir -p \/u01\/oracle\/wallet<\/strong><\/p>\n

      2. Update the wallet or keystore location in **sqlnet.ora**:<\/strong><\/p>\n

        <\/strong>      cat $ORACLE_HOME\/network\/admin\/sqlnet.ora
      \n        # sqlnet.ora Network Configuration File: \/home\/oracle\/app\/oracle\/product\/12.1.0\/dbhome_1\/network\/admin\/sqlnet.ora
      \n        # Generated by Oracle configuration tools.
      \n        NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
      \n        ENCRYPTION_WALLET_LOCATION =
      \n        (SOURCE =(METHOD = FILE)(METHOD_DATA =
      \n        (DIRECTORY = \/u01\/oracle\/wallet)))<\/p>\n

      3. Create keystore:<\/p>\n

              SQL> ADMINISTER KEY MANAGEMENT CREATE KEYSTORE ‘\/u01\/oracle\/wallet\/’ IDENTIFIED BY Oraclewallet#123 ;
      \n        keystore altered.
      \n        SQL> host ls \/u01\/oracle\/wallet\/
      \n        Oraclewallet.P12<\/em><\/p>\n

      4.  Open the keystore:<\/p>\n

              SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY Oraclewallet#123;
      \n        keystore altered.<\/em><\/p>\n

      5. Activate the key:<\/p>\n

              SQL> SET LINESIZE 100
      \n        SELECT con_id, key_id FROM v$encryption_keys;SQL> <\/em><\/p>\n

              no rows selected
      \n        SQL> ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY Oraclewallet#123 WITH BACKUP;
      \n        keystore altered.
      \n        SQL> SET LINESIZE 100
      \n        SELECT con_id, key_id FROM v$encryption_keys;SQL><\/em><\/p>\n

        CON_ID KEY_ID
      \n        ———- ——————————————————————————
      \n            0 HTDRKP*%GRLOHNRWMrX2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
      \n        SQL> SET LINESIZE 200
      \n        COLUMN wrl_parameter FORMAT A50
      \n        SELECT * FROM v$encryption_wallet;
      \n        SQL> SQL> 
      \n        WRL_TYPE      WRL_PARAMETER                                                     STATUS             
      \n        WALLET_TYPE              WALLET_OR FULLY_BAC     CON_ID
      \n        ——————– ————————————————– —————————— ——————– ——— ——— ———-
      \n        FILE                   
      \n        \/u01\/oracle\/wallet\/                                             OPEN       
      \n        PASSWORD        SINGLE   
      \n        NO                  0<\/em>
      \n <\/p>\n

      6.  SQL> CREATE TABLESPACE ENCRYPTION_TEST <\/strong>
      \n        datafile ‘\/u01\/oracle\/app\/oracle\/oradata\/db\/encrytest.dbf’ size 2G 
      \n        ENCRYPTION USING ‘AES256’
      \n        DEFAULT STORAGE(ENCRYPT);  2   
      \n        3    4  
      \n        Tablespace created.
      \n        SQL> create table ENCRYPTION_EMP(
      \n          empno   Number(3),
      \n          Name     varchar(10)
      \n        ) tablespace ENCRYPTION_TEST;  2   
      \n        3    4  
      \n        Table created.
      \n        SQL> select tablespace_name,encrypted from dba_tablespaces where tablespace_name=’ENCRYPTION_TEST’;
      \n        TABLESPACE_NAME              ENC. <\/p>\n

          —————————— —
      \n        ENCRYPTION_TEST                           YES
      \n <\/p>\n

      7. Create a table with an encrypted column:<\/strong><\/p>\n

              SQL> CREATE TABLE employee (
      \n        first_name VARCHAR2(128),
      \n        last_name VARCHAR2(128),
      \n        empID NUMBER,
      \n        salary NUMBER(6) ENCRYPT
      \n        ); 2 3 4 5 6
      \n        Table created.
      \n        SQL> select owner,table_name,column_name,encryption_alg from dba_encrypted_columns where table_name=’EMPLOYEE’;
      \n        OWNER TABLE_NAME COLUMN_NAME ENCRYPTION_A
      \n        ———- ———— ———— —–
      \n        RAJ EMPLOYEE SALARY AES 192 bits
      \n        key<\/p>\n

      8. Enable Autologin<\/strong><\/p>\n

       SQL> SELECT * FROM v$encryption_wallet;
      \n        WRL_TYPE      WRL_PARAMETER       STATUS       WALLET_TYPE     WALLET_OR     FULLY_BAC     CON_ID
      \n        ———-    ——————- ———— ————— ————- ————- ———-
      \n        FILE          \/u01\/oracle\/wallet\/   OPEN         PASSWORD      SINGLE         NO            0<\/em><\/p>\n

      Here the **wallet_type** is PASSWORD. Every time you restart the database, you need to
      \nopen the key or wallet explicitly. To avoid this, you can enable auto login, which opens
      \nthe wallet automatically when the database restarts. <\/p>\n

      9. Conclusion<\/strong><\/p>\n

      TDE allows you to secure highly sensitive data. Even if the datafile or media storage is
      \nstolen, the data is not available until users have the key to decrypt it.<\/p>\n","protected":false},"excerpt":{"rendered":"

      Transparent Data Encryption<\/p>\n","protected":false},"author":2,"featured_media":7109,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26259","content_type":"blog","created_by":"10130","authored_on":"2023-11-18T17:54:11+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Ruhi Sharma, Oracle Database Administrator, Racskspace Technology","seo_description":"Understand Oracle's comprehensive cloud security practices and the measures they take to protect customer data and systems in the Oracle Cloud.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26259-insights_image-oracle-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Applications","product":"","publisheddate":"2022-11-21T17:54:11","rxt_solutions":"","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Oracle Data Security with TDE | Rackspace Trchnology","field_topics":"","field_slug":"transparent-data-encryption","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7107","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7107"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7107\/revisions"}],"predecessor-version":[{"id":17127,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7107\/revisions\/17127"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7109"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}