10 Managing Oracle Key Vault Virtual Wallets and Security Objects
You can create a virtual wallet to store security objects, and then share this wallet with trusted peers at different access levels.
- Managing Virtual Wallets
A virtual wallet is a container for security objects that you can create and then grant access to users. - Managing Access to Virtual Wallets from Keys & Wallets Tab
You can grant virtual wallet access to and revoke virtual wallet access from endpoint by using the Keys & Wallets tab. - Managing Access to Virtual Wallets from User’s Menu
To manage access control on virtual wallets for users, endpoints, and their respective groups, you can use the Users menu or Endpoints menu. - Managing the State of a Key or a Security Object
You can set the date to activate or deactivate keys or security objects, and change the state of some virtual wallet security objects. - Managing Details of Security Objects
You can manage details about security objects, such as find details about these objects and modifying these details.
10.1 Managing Virtual Wallets
A virtual wallet is a container for security objects that you can create and then grant access to users.
- About Virtual Wallets
A virtual wallet is a container for security objects. - Creating a Virtual Wallet
You can create a virtual wallet and add security objects to it at the same time. - Modifying a Virtual Wallet
You can modify a virtual wallet and add security objects to it at the same time. - Adding Security Objects to a Virtual Wallet
You can add new security objects to a virtual wallet at any time as needed. - Removing Security Objects from a Virtual Wallet
You cannot remove security objects from virtual wallets at any time as needed. - Deleting a Virtual Wallet
Deleting a virtual wallet removes the wallet as a container, but does not delete the security objects that were contained in it.
10.1.1 About Virtual Wallets
A virtual wallet is a container for security objects.
These security objects can be public and private encryption keys, including Transparent Data Encryption (TDE) keystores, Oracle wallets, Java keystores, certificates, secret data, and credential files. You can use a virtual wallet to group security objects for sharing with multiple users who need them to access encrypted data.
Any user can create a virtual wallet. After you create a virtual wallet, you can add keys and other security objects to the wallet. You can then grant other users, endpoints, user groups, and endpoint groups access to the virtual wallet at various levels of access. You can modify a virtual wallet and its wallet contents at any time. You can also modify virtual wallet user lists and their respective access level.
Other than the Key Administrator, access to the virtual wallet must be granted explicitly to users. Read, modify, and manage wallet permissions are required to add and remove objects from the wallet, and to grant or modify wallet access to other users and groups.
Parent topic: Managing Virtual Wallets
10.1.2 Creating a Virtual Wallet
You can create a virtual wallet and add security objects to it at the same time.
Related Topics
Parent topic: Managing Virtual Wallets
10.1.3 Modifying a Virtual Wallet
You can modify a virtual wallet and add security objects to it at the same time.
Related Topics
Parent topic: Managing Virtual Wallets
10.1.4 Adding Security Objects to a Virtual Wallet
You can add new security objects to a virtual wallet at any time as needed.
PENDING
state.
Parent topic: Managing Virtual Wallets
10.1.5 Removing Security Objects from a Virtual Wallet
You cannot remove security objects from virtual wallets at any time as needed.
PENDING
state.
Parent topic: Managing Virtual Wallets
10.1.6 Deleting a Virtual Wallet
Deleting a virtual wallet removes the wallet as a container, but does not delete the security objects that were contained in it.
PENDING
state.
Parent topic: Managing Virtual Wallets
10.2 Managing Access to Virtual Wallets from Keys & Wallets Tab
You can grant virtual wallet access to and revoke virtual wallet access from endpoint by using the Keys & Wallets tab.
- About Managing Access to Virtual Wallets from the Keys & Wallets Tab
Access control is deciding which users and endpoints share virtual wallets and security objects, and what operations they can perform on those virtual wallets. - Granting Access to Users, User Groups, Endpoints, and Endpoint Groups
You can grant the Read Only, Read and Modify, and Manage Wallet access levels to users, user groups, endpoints, and endpoint groups. - Modifying Access to Users, User Groups, Endpoints, and Endpoint Groups
You can modify access settings on a virtual wallet for users, user groups, endpoints, and endpoint groups from the Keys & Wallets tab.
10.2.1 About Managing Access to Virtual Wallets from the Keys & Wallets Tab
Access control is deciding which users and endpoints share virtual wallets and security objects, and what operations they can perform on those virtual wallets.
You must have Manage Wallet access to a virtual wallet or be a Key Administrator to manage access control for users, endpoints, and their respective groups.
To manage access to virtual wallets, you can use the Keys & Wallets tab, where you select the wallet, you grant an endpoint, endpoint group, user, or user group access to the wallet.
Related Topics
10.2.2 Granting Access to Users, User Groups, Endpoints, and Endpoint Groups
You can grant the Read Only, Read and Modify, and Manage Wallet access levels to users, user groups, endpoints, and endpoint groups.
PENDING
state.
10.2.3 Modifying Access to Users, User Groups, Endpoints, and Endpoint Groups
You can modify access settings on a virtual wallet for users, user groups, endpoints, and endpoint groups from the Keys & Wallets tab.
PENDING
state.
10.3 Managing Access to Virtual Wallets from User’s Menu
To manage access control on virtual wallets for users, endpoints, and their respective groups, you can use the Users menu or Endpoints menu.
- Granting a User Access to a Virtual Wallet
You can grant access to a virtual wallet by using the Users tab. - Revoking User Access from a Virtual Wallet
You can revoke access to a virtual wallet for a user by using the Users tab. - Granting a User Group Access to a Virtual Wallet
You can grant user group access to a virtual wallet by using the Users tab. - Revoking User Group Access from a Virtual Wallet
You can remove user group access to a virtual wallet by using the Users tab.
Related Topics
10.3.1 Granting a User Access to a Virtual Wallet
You can grant access to a virtual wallet by using the Users tab.
PENDING
state.
Related Topics
Parent topic: Managing Access to Virtual Wallets from User’s Menu
10.3.2 Revoking User Access from a Virtual Wallet
You can revoke access to a virtual wallet for a user by using the Users tab.
PENDING
state.
Parent topic: Managing Access to Virtual Wallets from User’s Menu
10.3.3 Granting a User Group Access to a Virtual Wallet
You can grant user group access to a virtual wallet by using the Users tab.
PENDING
state.
Parent topic: Managing Access to Virtual Wallets from User’s Menu
10.3.4 Revoking User Group Access from a Virtual Wallet
You can remove user group access to a virtual wallet by using the Users tab.
PENDING
state.
Parent topic: Managing Access to Virtual Wallets from User’s Menu
10.4 Managing the State of a Key or a Security Object
You can set the date to activate or deactivate keys or security objects, and change the state of some virtual wallet security objects.
- About Managing the State of a Key or a Security Object
You can control the dates when a key or a security object is active, that is, when it can be used. - How a Multi-Master Cluster Affects Keys and Security Objects
Keys that you create on one node of a multi-master cluster will take some time to appear on other nodes in the cluster. - Activating a Key or Security Object
Keys can be in the Active or Pre-Active state. - Deactivating a Key or Security Object
A key deactivates or expires when it passes the date that has been set for deactivation. - Revoking a Key or Security Object
When you revoke a key, you can set its state to Deactivated or Compromised. - Destroying a Key or Security Object
When a key is no longer used or compromised in some way, then you can destroy it.
10.4.1 About Managing the State of a Key or a Security Object
You can control the dates when a key or a security object is active, that is, when it can be used.
You also can revoke and destroy keys and security objects. Be aware that a multi-master cluster affects the activation or de-activation times of keys and security objects on different nodes, and that naming conflicts can arise.
Related Topics
Parent topic: Managing the State of a Key or a Security Object
10.4.2 How a Multi-Master Cluster Affects Keys and Security Objects
Keys that you create on one node of a multi-master cluster will take some time to appear on other nodes in the cluster.
The time is defined by the replication lag between nodes. The replication lag value is displayed on the Cluster Link State pane of the Monitoring page, which can be accessed by choosing the Cluster tab.
If you add a Transparent Data Encryption (TDE) master encryption key to two different keystores on two different nodes, then it will be shown in both keystores.
Adjusting the activation date, deactivation date, process start date, and protect stop date has restrictions. For these dates, if changes are made to the security object very close to the current time, then state changes can happen because of replication lag.
As with the creation of any object in a multi-master cluster, a security object can have a name conflict with an object created on a different node. If there is a conflict, then Oracle Key Vault will suggest a unique name or allow you to rename it.
Related Topics
Parent topic: Managing the State of a Key or a Security Object
10.4.3 Activating a Key or Security Object
Keys can be in the Active or Pre-Active state.
- Log in to the Oracle Key Vault management console as a user who has read and modify access on this key.
- Select the Keys & Wallets tab, then Keys & Secrets in the left navigation bar.
- In the Keys & Secrets page, click the edit pencil icon under Edit corresponding to the item for which you want to set.
- On the Object Details page for the item, click Activate.
- Click OK to confirm.
Parent topic: Managing the State of a Key or a Security Object
10.4.4 Deactivating a Key or Security Object
A key deactivates or expires when it passes the date that has been set for deactivation.
- Log in to the Oracle Key Vault management console as a user who has read and modify access on this key.
- Select the Keys & Wallets tab, then Keys & Secrets in the left navigation bar.
- In the Keys & Secrets page, click the edit pencil icon under Edit corresponding to the item to be deactivated.
- In the Object Details page for the item, set the Date of Deactivation to the date by which you want the key to be deactivated.
- Click Save.
Parent topic: Managing the State of a Key or a Security Object
10.4.5 Revoking a Key or Security Object
When you revoke a key, you can set its state to Deactivated or Compromised.
- Log in to the Oracle Key Vault management console as a user who has read and modify access on this key.
- Select the Keys & Wallets tab, then Keys & Secrets in the left navigation bar.
- In the Keys & Secrets page, click the edit pencil icon under Edit corresponding to the item that you want to revoke.
- In the Object Details page, click Revoke.
- In the Revoke Object page, from the Revocation Reason drop-down list, select a reason for the revocation.
- Optionally, add more details in Revocation Message
- Click Save.
Parent topic: Managing the State of a Key or a Security Object
10.4.6 Destroying a Key or Security Object
When a key is no longer used or compromised in some way, then you can destroy it.
- Log in to the Oracle Key Vault management console as a user who has read and modify access on this key.
- Select the Keys & Wallets tab, then Keys & Secrets in the left navigation bar.
- In the Keys & Secrets page, click the edit pencil icon under Edit corresponding to the item that you want to destroy.
- On the Object Details page, click Destroy.
- In the confirmation window, click OK.
Parent topic: Managing the State of a Key or a Security Object
10.5 Managing Details of Security Objects
You can manage details about security objects, such as find details about these objects and modifying these details.
- About Managing the Details of Security Objects
You can search for security objects within a virtual wallet, and add, modify, or remove these security objects. - Searching for Security Object Items
You can search for individual security objects if you have privileges to view these objects. - Viewing the Details of a Security Object
An administrative user with the Key Administrator role can view, add, and modify the details of a security object. - Adding or Modifying Details of a Security Object
Only users who have the appropriate privileges can add or modify the details of a security object.
10.5.1 About Managing the Details of Security Objects
You can search for security objects within a virtual wallet, and add, modify, or remove these security objects.
Security objects are managed by Oracle Key Vault administrative users with a clear separation of duties. You must be an administrative user with the Key Administrator role to manage wallet privilege on the virtual wallet containing the security objects. A user with the Audit Manager role can view security objects, but cannot modify them, whereas individual security objects are not even viewable to a user with the System Administrator role.
You can set the deactivation date for security objects and have an alert notify you when the security object will expire. For example, if you configure an alert for an object expiration with a threshold of 7 days, its expiration alert will be raised when object’s deactivation date is within the 7 days of its deactivation date. An email notification will be sent every 24 hours during this threshold period. The alert is raised only when the security object is in the PRE-ACTIVE
or ACTIVE
state. Oracle Key Vault deletes the expiration alerts for the security objects when the security object is revoked or destroyed.
Related Topics
Parent topic: Managing Details of Security Objects
10.5.2 Searching for Security Object Items
You can search for individual security objects if you have privileges to view these objects.
Parent topic: Managing Details of Security Objects
10.5.3 Viewing the Details of a Security Object
An administrative user with the Key Administrator role can view, add, and modify the details of a security object.
The administrative user can perform these actions on the security object from its corresponding Object Details page. Object details are attributes of a specific security object and depend on the type of security object.
-
Log in to the Oracle Key Vault management console as a user with the Key Administrator role or as a user with access to the virtual wallet.
-
Select the Keys & Wallets tab, then Keys & Secrets in the left navigation bar.
-
In the Keys & Secrets page, search for the security object that you want.
The Keys & Secrets page shows a table that displays the security objects in Key Vault.
You can modify the columns in this table to show more information. From the Actions menu, select Select Columns. In the Select Columns dialog box, move the columns that you want to see to the Display in Report list, and then click Apply.
-
Click the pencil icon in the Edit column corresponding to the security object.
The Object Details page appears displaying the attributes of the security object. The following screen shows a partial view of all the activities that you can perform on this object.
Description of the illustration 21_object_details.pngYou can set the dates when the security object should be deactivated or not used on the Object Details page. The attributes shown in Object Details depend on the type of security object. The attributes for a Symmetric Key are different from those of Private Key or Opaque Object.
You can revoke or destroy a security object, and add or remove it to and from a wallet from the Object Details page.
The Wallet Membership pane in the Object Details page enables you to add the security object to a wallet or delete the security object from a wallet.
The Object Details page contains the following attributes:
-
Display Name: A summary description to help identify the item to the user. For example, if the item is a TDE master encryption key, then the Identifier shows the prefix TDE master encryption key followed by the identifier used by the database to identify the key.
-
Unique Identifier: This is a globally unique ID that identifies an item.
-
Type: Indicates the object type of the item. Valid values are Symmetric Key, Public Key, Private Key, Template, Opaque Object, Certificate, and Secret Data.
-
State: Indicates the status of the security objects. Values are as follows:
-
Pre-active: The object exists but is not yet usable for any cryptographic purpose.
-
Active: The object is available for use. Endpoints should examine the Cryptographic Usage Mask attribute to determine which uses are appropriate for this object.
-
Deactivated: The object is no longer active and should not be used to apply cryptographic protection (for example, encryption or signing). It may still be appropriate to use for decrypting or verifying previously protected data.
-
Compromised: The object is believed to be compromised and should not be used.
-
Destroyed: The object is no longer usable for any purpose.
-
Destroyed Compromised: The object was compromised and destroyed. It is no longer usable for any purpose.
-
-
Creator: The endpoint that created the security object.
-
Last Modified: The date last modified.
-
Date of Creation: The date created.
-
Date of Activation: The date of activation.
-
Process Start Date: The date when the key may start to be used to encrypt data. It can be equal or later than the Date of Activation setting but cannot precede it.
-
Protect Stop Date: When this date is passed, the key should not be used to encrypt any more data. It cannot be later than the Date of Deactivation setting.
-
Date of Deactivation: The date of deactivation.
-
-
Click Advanced to view the cryptographic attributes of the security object. The following screen shows a partial view of all the activities that you can perform in Advanced.
Description of the illustration 21_object_details_advanced.pngAttribute information and queries will vary depending on the item type. Examples of attributes are as follows:
-
Cryptographic Algorithms: The encryption algorithm used by the item
-
Key Usage: Operations that the key can be used for. Clients may or may not use these attributes. For example, Transparent Data Encryption does not consult the key usage attributes.
-
Names: Labels attached by a user or endpoint to identify the key
-
Custom Attributes: Additional attributes defined by the endpoint and not interpreted by Oracle Key Vault
-
Cryptographic Parameters: Optional parameters for the encryption algorithm used by the item, such as block cipher mode and padding method
-
Cryptographic Length: The length in bits of the key
-
Retrieved at Least Once: Indicates if the object has been served to the client
-
Contact Information: Used for contact purposes only
-
Digests: Digest values of the security object
-
Link Details: Links to related objects
-
Parent topic: Managing Details of Security Objects
10.5.4 Adding or Modifying Details of a Security Object
Only users who have the appropriate privileges can add or modify the details of a security object.
Parent topic: Managing Details of Security Objects