About Encryption Keys

Oracle Base Database Cloud@Customer uses Transparent Data Encryption (TDE) to encrypt data at rest and help protect sensitive data stored in tables, tablespaces, and database backups from unauthorized access. TDE uses a master encryption key to protect the encryption keys used to encrypt and decrypt data at the column or tablespace level. The TDE master encryption key is stored in a keystore to prevent unauthorized access.

Oracle Base Database Cloud@Customer supports the following key management solutions for storing and managing TDE master encryption keys.

• Auto login TDE wallet (Oracle-managed)

  The TDE master encryption keys are managed in an auto login software keystore. The auto login wallet is protected by a system-generated password and is automatically opened when the database starts. Oracle manages the lifecycle of the TDE master encryption keys.

• Oracle Key Vault (Customer-managed)

  The TDE master encryption keys are managed in an Oracle Key Vault. Oracle Key Vault is a security-hardened appliance that centralizes the management of encryption keys and other security objects. Oracle Base Database Cloud@Customer integrates with Oracle Key Vault through a keystore that enables databases to use customer-managed TDE master encryption keys. You manage the lifecycle of the TDE master encryption keys.

  For more information, see:

  • Set Up Oracle Key Vault
  • Create a Key Store

• External keystore (Customer-managed)

  The TDE master encryption keys are managed in a supported third-party external keystore that provides a PKCS#11 interface. External keystores require the appropriate vendor software, credentials, and connectivity to be configured before they can be used with Oracle AI Database. You manage the lifecycle of the TDE master encryption keys.

Default Key Management

By default, Oracle Base Database Cloud@Customer configures databases to use Oracle-managed TDE master encryption keys. You can configure a database to use customer-managed keys during database provisioning or switch an existing database from Oracle-managed keys to customer-managed keys. Switching from customer-managed keys to Oracle-managed keys is not supported.

Customer-managed keys require additional Oracle Key Vault and IAM configuration.

Key Versions

A TDE master encryption key can have one or more key versions. A key version represents a specific version of the same TDE master encryption key.

Rotating a key generates a new key version without changing the key itself. Previous key versions are retained so that data encrypted with earlier versions of the key can continue to be decrypted.

When a container database (CDB) is created, the selected TDE master encryption key is associated with both the container database and its Pluggable Databases (PDBs).

If you specify a key version during database creation, that key version is used only for the container database. Each Pluggable Database is assigned a new key version automatically. You cannot specify a key version for a Pluggable Database during database creation.

A container database and its Pluggable Databases always use the same TDE master encryption key, but they can use the same or different key versions.

You can assign any available key version, including the latest version of the selected key.

Key Management Operations

Oracle Base Database Cloud@Customer supports the following key management operations.

Rotate TDE Master Encryption Keys

Rotating a key generates a new key version without changing the key itself. Previous key versions are retained so that data encrypted with earlier versions of the key can continue to be decrypted. Periodically rotating encryption keys helps meet organizational security and compliance requirements by limiting the amount of data encrypted with a single key version.

Container databases and Pluggable Databases manage key versions independently. Rotating the key version for a container database does not rotate key versions for its Pluggable Databases. Similarly, rotating the key version for a Pluggable Database does not affect the container database or other Pluggable Databases.

Assign a Key Version

You can assign a different key version to a container database or a Pluggable Database without changing the TDE master encryption key. Assigning a key version changes only the version of the existing key used by the database.

Change Key Management

You can switch an existing database from Oracle-managed keys to customer-managed keys. When switching to customer-managed keys, the container database and all Pluggable Databases must be open, and all tablespaces must be in read/write mode.

The TDE master encryption key associated with a container database is automatically used by all of its Pluggable Databases. Although container databases and Pluggable Databases always use the same TDE master encryption key, they can use different key versions.

Switching from customer-managed keys to Oracle-managed keys is not supported.

Clone, Remote Clone, and Relocate Pluggable Databases

When cloning a database that uses customer-managed TDE master encryption keys, the cloned database initially uses the same key version as the source database.

For remote clone and relocation operations, the source and target databases must use the same TDE master encryption key, although they can use different key versions. After the operation completes, new key versions are generated for the target Oracle Key Vault.