Administration

CipherTrust Application Key Management (CAKM) for Oracle Transparent Data Encryption (TDE) provides key management and data encryption capabilities, in conjunction with the CipherTrust Manager, to Oracle TDE.

The advantages of using the CipherTrust Manager are:

• Provides additional security by separation of the administrative access. For example, the system can be set up so that CipherTrust Application Data Protection Security Administrator can access only the keys, and the database administrator can access only the database.

• Helps achieve compliance with PCI security standards.

• Provides centralized storage and management of encryption keys.

The table and tablespace keys are encrypted using the master key. The master key is stored in an External Security Module (ESM) that can be one of the following:

• Oracle Wallet: Provides a secure container outside the database. It is encrypted with a password.

• CipherTrust Mananger: Provides a secure location for storing the TDE master encryption key (MEK). Oracle interfaces with this platform using the CAKM for Oracle TDE library.

The following diagram shows the integration:

Prerequisites

Ensure that:

• The CipherTrust Manager is installed and configured. Refer to the CipherTrust Manager documentation for details.

• Make sure that a user with the permissions CA Admins and Read-Only Admins exists on the CipherTrust Manager. This user is required when installing CAKM for Oracle TDE.

• The NAE-XML interface is configured on the CipherTrust Manager. Refer to the CipherTrust Manager documentation for details.

• The port configured on the NAE-XML interface is accessible from the client machine.

• The connector license is activated on the CiperTrust Manager. Refer to the CipherTrust Manager documentation for details.

• The Oracle Database must be installed on the target machine.

• On the AIX platform, ensure the following libraries and their dependencies are installed:

  • libgcc_s.a

  • libstdc++.a

  To determine the dependencies of a library on the AIX platform, use the dump -Hv <library_file> command. If the command returns the error "file is not valid in the current object file mode," follow these steps:

  1. Determine the libary file's format by running file <library_file>. This command returns the file format, such as 64 or 32.

  2. Set the correct format in the OBJECT_MODE environment variable by using export OBJECT_MODE=<format>. For example, if file <library_file> returned 64, run export OBJECT_MODE=64.

  3. Run the dump -Hv <library_file> command again.

Integrating Oracle TDE with CipherTrust Manager

To integrate Oracle TDE with the CipherTrust Manager:

1. Install and Configure CAKM for Oracle TDE

2. Integrate Oracle TDE with CipherTrust Manager on Oracle 19c