In Oracle Data Redaction, the data in a protected table or view. An example of actual data could be the number 123456789, and the redacted data version of this number could be 999996789.

A software keystore that is protected by a system-generated password and does not need to be explicitly opened by a security administrator. Auto-login software keystores are automatically opened when accessed and can be used on any computer that runs an Oracle database. For example, consider an Oracle RAC environment that has four nodes, and each node is on a different computer. This environment uses an auto-login keystore. When a REKEY operation is performed on node 1, the auto-login and password-based keystores must be copied to the computers that host nodes 2, 3, and 4. In this configuration, the auto-login keystores will be opened on all four nodes when required.

See also local auto-login software keystore.

A set of authentication, encryption, and data integrity algorithms used to exchange messages between network nodes using Secure Sockets Layer (SSL). During an SSL handshake, for example, the two nodes negotiate to see which cipher suite they will use when transmitting messages back and forth.

Message text that has been encrypted.

See also encrypted text.

The ability to mask data with different values in real time, that is, at the moment a user tries to access the data. You can mask all of the data, a partial subset of the data, or display random values in place of the data. It does not change the actual data in the database.

The process of converting an encrypted message (the ciphertext), back to its original message (plaintext).

Text that has been encrypted, using an encryption algorithm and an encryption key; the output stream of an encryption process. The text is not readable or decipherable, without decrypting it first. Also called ciphertext.

The process of converting an original message (plaintext) to an encrypted message (ciphertext).

A container that stores a Transparent Data Encryption key for a hardware security module. (The previous term for external keystore was hardware keystore.) An external keystore can be Oracle Key Vault or Oracle Cloud Infrastructure (OCI) key management service (KMS). External keystores provide centralized key management for TDE-enabled databases.

A physical device that provides secure storage for encryption keys. Oracle does not support third-party hardware security modules to provide key management for Transparent Data Encryption-enabled databases. (See My Oracle Support note 2310066.1 for more information.) Oracle Key Vault can provide third-party hardware security modules to provide root-of-trust to Oracle Key Vault. See Oracle Key Vault Root of Trust HSM Configuration Guide.

A query that is designed to find data by repeatedly trying queries. For example, to find the users who earn the highest salaries, an intruder could use the following query:

SELECT FIRST_NAME, LAST_NAME, SALARY FROM HR.EMPLOYEES WHERE SALARY > 16000 ORDER BY SALARY DESC;

FIRST_NAME           LAST_NAME                     SALARY
-------------------- ------------------------- ----------
Steven               King                           24000
Neena                Kochhar                        17000
Lex                  De Haan                        17000

A public key and its associated private key. See public and private key pair.

A general term for any container that stores encryption keys, such as Transparent Data Encryption keys and other encrypted data. In previous releases, this container was referred to as a wallet, which is specific to Oracle. Starting with Oracle Database 12c release 12.1, the term changed to keystore to encompass non-Oracle Database encryption key containers, such as external key managers.

See also auto-login software keystore, external keystore, and local auto-login software keystore.

A software keystore that is local and restricted to the computer on which it was created.

See also auto-login software keystore.

The ability to redact data from a user or an application.

A software keystore that must be opened with a password before it can be accessed.

See also keystore.

Message text that has not been encrypted.

In public-key cryptography, this key is the private key that is known only to its owner. It is primarily used for encrypting message digests used with digital signatures.

See public and private key pair.

One of two keys that are used in public key cryptography, the other key being the private key. In typical public key cryptography usage, the public key is used to encrypt data or verify digital signatures. The the private key is used to decrypt data or generate digital signatures. The public key, unlike the private key, can be made available to anyone whereas the private key must remain secret.

See public and private key pair.

The process where the sender of a message encrypts the encryption key of the recipient. Upon delivery, the message is decrypted by the recipient using its private key.

A set of two related numbers used for encryption and decryption, where one is called the private key and the other is called the public key. Public keys are typically made widely available, while private keys are held by their respective owners. Data encrypted with either a public key or a private key from a key pair can be decrypted with its associated key from the key pair.

Information security technology utilizing the principles of public key cryptography. Public key cryptography involves encrypting and decrypting information using a shared public and private key pair. Provides for secure, private communications within a public network.

Masked data that is displayed to the querying user. For example, if the actual data is 3714-4963-5398-4321, then the redacted data could appear, depending on the Data Redaction policy, as XXXX-XXXX-XXXX-4321.

In cryptography, a way to strengthen the security of encrypted data. Salt is a random string that is added to the data before it is encrypted, making it more difficult for attackers to steal the data by matching patterns of ciphertext to known ciphertext samples. Salt is often also added to passwords, before the passwords are hashed, to avoid dictionary attacks, a method that attackers use to determine sensitive passwords. The addition of salt to a password before hashing makes it more difficult for intruders to match the hash values (sometimes called verifiers) with their dictionary list of common password hash values, because they do not know the salt beforehand.

A container that stores a Transparent Data Encryption a TDE master encryption key for use as an auto-login software keystore, a local auto-login software keystore, or a password-based software keystore.

An encryption key for the encryption of a tablespace. The TDE tablespace encryption key encrypts the tablespace encryption key, which in turn encrypts and decrypts data in the tablespace.

A key that is stored within a software keystore or a external keystore. For table encryption, this key encrypts the TDE table key, and for tablespace encryption, it encrypts the tablespace encryption key.

See also keystore.

An encryption key that is associated with a table whose columns are marked for encryption. The TDE master encryption key encrypts this table encryption key.

A data structure used to store and manage security credentials for an individual entity. Wallets are specific to Oracle Database only. A Wallet Resource Locator (WRL) provides all of the necessary information to locate the wallet. For Transparent Data Encryption in Oracle Database Release 12c and later, the term for wallet is keystore.

The ability to store and access an Oracle wallet without querying the user for a password before access (supports single sign-on (SSO)).

A tool that provides all of the necessary information to locate a wallet. It is a path to an operating system directory that contains a wallet.