2 Configuring an HSM for Oracle Key Vault
The HSM can be configured to protect keys, or work in a classic primary-standby configuration or in a multi-master cluster.
- Protecting the Oracle Key Vault TDE Master Key with the HSM
You can use the Oracle Key Vault management console to configure protection for the TDE master encryption key. - Enabling HSM in a High Availability Key Vault Installation
In a primary-standby Oracle Key Vault installation, you must enable the HSM separately on the primary and standby servers. - HSMs in a Multi-Master Cluster
You can configure HSMs in a multi-master cluster with a single node or multiple nodes. - Backup and Restore Operations in an HSM-Enabled Oracle Key Vault Instance
You can back up and restore an HSM-enabled Oracle Key Vault instance. - Reverse Migration Operation
Reverse migrating an HSM-enabled Oracle Key Vault server reverts the Key Vault server to using the recovery passphrase to protect the TDE wallet.
2.1 Protecting the Oracle Key Vault TDE Master Key with the HSM
You can use the Oracle Key Vault management console to configure protection for the TDE master encryption key.
Note:
If you change the HSM credential on the HSM after initialization, then you must also update the HSM credential on the Oracle Key Vault server using the Set Credential command.Parent topic: Configuring an HSM for Oracle Key Vault
2.2 Enabling HSM in a High Availability Key Vault Installation
In a primary-standby Oracle Key Vault installation, you must enable the HSM separately on the primary and standby servers.
You must perform this task before pairing these two servers in a primary-standby configuration. If you have already HSM-enabled either the primary or the standby server, or both, but do not follow these steps and then do a primary-standby pairing, then the configuration will fail. If the servers are already paired but neither are HSM-enabled, then you must unpair them, reinstall the standby server, and the follow these steps.
Related Topics
Parent topic: Configuring an HSM for Oracle Key Vault
2.3 HSMs in a Multi-Master Cluster
You can configure HSMs in a multi-master cluster with a single node or multiple nodes.
- About HSMs in a Multi-Master Cluster
An HSM in Oracle Key Vault stores a top level master encryption key that acts as a Root of Trust (RoT). - Configuring an HSM for a Multi-Master Cluster Starting with Single Node (Recommended)
Oracle recommends that to use an HSM with a multi-master cluster, you start with a single HSM-enabled node and add additional HSM-enabled nodes using the node induction process. - Configuring an HSM for a Multi-Master Cluster with Multiple Nodes
You can configure HSM for multiple nodes by copying a bundle from the first HSM-enabled node to the other nodes in the cluster before configuring HSM for the other nodes.
Parent topic: Configuring an HSM for Oracle Key Vault
2.3.1 About HSMs in a Multi-Master Cluster
An HSM in Oracle Key Vault stores a top level master encryption key that acts as a Root of Trust (RoT).
This RoT protects master encryption keys that Oracle Key Vault uses. HSMs are built with specialized tamper-resistant hardware which is harder to access than normal servers. This protects the RoT and makes it difficult to extract encrypted data, lowering the risk of compromise. In addition, you can use HSMs in FIPS 140-2 level 3 mode, which enables you to meet certain compliance requirements.
Note:
An existing Oracle Key Vault deployment cannot be migrated to use an HSM as a RoT.In a multi-master Oracle Key Vault installation, any Key Vault node in the cluster can use any HSM. The nodes in the multi-master cluster can use different TDE wallet passwords, RoT keys, and HSM credentials.
Note:
To ensure complete security, you must HSM-enable all Oracle Key Vault nodes in the cluster.Parent topic: HSMs in a Multi-Master Cluster
2.3.2 Configuring an HSM for a Multi-Master Cluster Starting with Single Node (Recommended)
Oracle recommends that to use an HSM with a multi-master cluster, you start with a single HSM-enabled node and add additional HSM-enabled nodes using the node induction process.
Oracle recommends the following steps to configure an HSM for a multi-master cluster with a single node:
- Convert an Oracle Key Vault server into the first node of the cluster.
- HSM-enable the first node before adding any new nodes.
- HSM-enable the candidate node before adding it to the cluster.
- Add the HSM-enabled candidate node to the cluster using a controller node that is also HSM-enabled.
Note the following:
- If any node in the cluster is already HSM-enabled, you cannot add a new node that is not HSM-enabled.
- The Add Node to Cluster page will require the controller node's HSM credential.
2.3.3 Configuring an HSM for a Multi-Master Cluster with Multiple Nodes
You can configure HSM for multiple nodes by copying a bundle from the first HSM-enabled node to the other nodes in the cluster before configuring HSM for the other nodes.
- About Configuring an HSM for a Multi-Master Cluster with Multiple Nodes
The general procedure is to perform steps first on the original node, then on the nodes that you want to add to the cluster. - Step 1: Configure the First HSM-Enabled Node
After configuring the HSM on the first node in the multi-master cluster, you must create the bundle and copy it to the other nodes in the cluster. - Step 2: Configure the Remaining Nodes
After you configure the first node, you are ready to install the bundle on the remaining nodes.
Parent topic: HSMs in a Multi-Master Cluster
2.3.3.1 About Configuring an HSM for a Multi-Master Cluster with Multiple Nodes
The general procedure is to perform steps first on the original node, then on the nodes that you want to add to the cluster.
The instructions for configuring an HSM for a multi-master cluster starting with a single node explain how to configure an HSM for a multi-master cluster, starting with a single node of the cluster and is the recommended way to configure a cluster to use HSM(s). However, if you have already configured a multi-master cluster, you can still configure the cluster to use HSMs. However, there are extra steps needed, involving manually copying a bundle from the first HSM-enabled node to all of the other nodes in the cluster and applying it before proceeding to HSM-enable any other node. Note that if the first node that is HSM-enabled has a read-write peer node, then the read-write peer will not be able to decrypt the replicated information from the HSM-enabled node until the bundle is copied and applied successfully to the read-write peer. This could result in data loss if the bundle is not immediately successfully created and applied to the read-write peer.
After you HSM-enable the first node in the cluster, use the following steps to create the bundle on the HSM-enabled node and copy and apply it on all other nodes in the cluster before you proceed to HSM-enable any other node.
2.3.3.2 Step 1: Configure the First HSM-Enabled Node
After configuring the HSM on the first node in the multi-master cluster, you must create the bundle and copy it to the other nodes in the cluster.
Related Topics
2.4 Backup and Restore Operations in an HSM-Enabled Oracle Key Vault Instance
You can back up and restore an HSM-enabled Oracle Key Vault instance.
- Backup Operations in an HSM-Enabled Oracle Key Vault Instance
Backing up Oracle Key Vault data in an HSM-enabled instance is the same as backing up an instance that has not been HSM enabled. - Restore Operations in an HSM-Enabled Oracle Key Vault Instance
Only backups made to an HSM-enabled Oracle Key Vault instance can be restored onto an HSM-enabled Oracle Key Vault instance.
Parent topic: Configuring an HSM for Oracle Key Vault
2.4.1 Backup Operations in an HSM-Enabled Oracle Key Vault Instance
Backing up Oracle Key Vault data in an HSM-enabled instance is the same as backing up an instance that has not been HSM enabled.
Related Topics
2.4.2 Restore Operations in an HSM-Enabled Oracle Key Vault Instance
Only backups made to an HSM-enabled Oracle Key Vault instance can be restored onto an HSM-enabled Oracle Key Vault instance.
Related Topics
2.5 Reverse Migration Operation
Reverse migrating an HSM-enabled Oracle Key Vault server reverts the Key Vault server to using the recovery passphrase to protect the TDE wallet.
This operation is necessary if the HSM that protects Oracle Key Vault must be decommissioned.
- Reverse Migrating a Standalone Deployment
You can reverse migrate a standalone deployment by using the Oracle Key Vault management console. - Reverse Migrating a Primary-Standby Deployment
To reverse migrate a primary-standby deployment, use both the Oracle Key Vault management console and the command line. - Reverse Migrating a Multi-Master Cluster
You can reverse migrate a multi-master cluster by using the Oracle Key Vault management console.
Parent topic: Configuring an HSM for Oracle Key Vault
2.5.1 Reverse Migrating a Standalone Deployment
You can reverse migrate a standalone deployment by using the Oracle Key Vault management console.
Parent topic: Reverse Migration Operation
2.5.2 Reverse Migrating a Primary-Standby Deployment
To reverse migrate a primary-standby deployment, use both the Oracle Key Vault management console and the command line.
Parent topic: Reverse Migration Operation
2.5.3 Reverse Migrating a Multi-Master Cluster
You can reverse migrate a multi-master cluster by using the Oracle Key Vault management console.
Parent topic: Reverse Migration Operation