Use an External Keystore with Oracle Base Database Cloud@Customer

This topic provides an overview of using an external keystore with Oracle Base Database Cloud@Customer. It describes the planning requirements, high-level workflow, and Oracle AI Database concepts that you should understand before configuring Oracle AI Database to use an external keystore for Transparent Data Encryption (TDE) master encryption keys.

About External Keystores

Oracle Transparent Data Encryption (TDE) protects sensitive data stored in Oracle AI Database by encrypting data at rest. TDE uses a master encryption key to protect the encryption keys used by the database.

By default, TDE stores the master encryption key in a software keystore. Alternatively, you can store the master encryption key in an external hardware security module (HSM) that supports the PKCS#11 standard.

Using an external keystore enables centralized key management and helps organizations meet security, compliance, and separation-of-duties requirements. It also allows organizations to continue using their existing HSM infrastructure to manage Oracle AI Database encryption keys.

Planning Your Deployment

Using an external keystore requires configuration of both the external HSM and Oracle AI Database. Before you begin, ensure that:

• A supported external HSM is installed and configured.
• The password format required by the HSM provider is configured.
• Network connectivity is established between the database host and the external HSM.
• The required PKCS#11 client library is installed and configured on the database host.
• Communication between Oracle AI Database and the external keystore has been validated.

The procedures for configuring and administering an external HSM are specific to the HSM vendor. Refer to your HSM vendor documentation for detailed instructions.

High-Level Workflow

Using an external keystore with Oracle Base Database Cloud@Customer typically involves the following activities:

1. Configure and initialize the external HSM.
2. Configure the password format and security objects required by the HSM.
3. Configure network connectivity between Oracle AI Database and the external HSM.
4. Install and configure the PKCS#11 client library.
5. Configure Oracle AI Database to use the external keystore.
6. Create new TDE master encryption keys or migrate existing keys to the external keystore.
7. Verify that Oracle AI Database can successfully access the external keystore.

The detailed procedures for configuring the external HSM, installing the PKCS#11 client library, and configuring Oracle AI Database depend on your HSM vendor and Oracle AI Database configuration. Refer to your HSM vendor documentation for implementation details.

Key Management Options

When you provision a database, you can select one of the following key management solutions:

• Oracle Software Keystore
• Oracle Key Vault (OKV)
• External Keystore

The selected key management solution applies to the entire container database (CDB) and all Pluggable Databases (PDBs) within the CDB. If a CDB uses an external keystore, all associated PDBs use the same external keystore. However, individual PDBs can use different encryption keys.

Other Requirements

Keep the following requirements in mind when using an external keystore:

• Oracle AI Database requires continuous access to the external keystore to perform encryption and decryption operations.
• Validate communication between Oracle AI Database and the external keystore before creating or migrating TDE master encryption keys.
• Review the requirements and limitations documented by your HSM vendor before deploying an external keystore in a production environment.