Determining Best Method for Encrypting Disks

A diskgroup can contain one or multiple disks. You must determine if the diskgroup contains enough disks and free space for encryption. If the diskgroup contains only one disk, or multiple disks but not enough free space, then you must use the Offline (backup/restore) method for encryption.

If the diskgroup contains more than one, you can use the Online (rebalancing) method. During rebalancing, additional disks allow for migrating data from the original disk so that it can be encrypted, added back into the diskgroup, and then migrated back to the source disk. Therefore, if the customer does not want to permanently add extra disks, they can add disks temporarily, just for rebalancing.

In general, once you have completed the initial setup for the operating system with which you are working, for both ASM or ASMLib, the high-level process is the same for applying CTE protection to raw devices and using them.

Online Method (No Application / Database Downtime)

Typically, when using the online method, follow these steps:

1. Make an ASM disk available for protection by either removing a disk from an existing diskgroup, or allocating a new disk.

2. Apply CTE encryption to the disk.

3. Add each protected disk to the diskgroup.

4. Restart the nodes and the failover test.

5. Repeat the previous steps for each disk in the diskgroup.

Offline Method (Backup the DB)

Typically, when using the offline method, follow these steps:

1. Backup the database.

2. Make an ASM disk available for protection by either removing a disk from an existing diskgroup, or allocating a new disk.

3. Stop the Oracle database.

4. Delete the diskgroup.

5. Apply CTE encryption to the disk.

6. Recreate the diskgroup.

7. Add the protected disk to the diskgroup.

8. Restart the nodes and the failover test.

9. Repeat the previous steps for each disk in the diskgroup.