Securing Data for Oracle AI Database Connections

Configure certificate-authenticated TLS, ezTLS, or native network encryption (NNE) to protect Oracle AI Database connections.

Data in transit runs into unique risks that are not quite the same as those related to data at rest. Some of these risks stem from unsecure public networks, the dynamic nature of the network traffic, and the fuzzy lines of ownership between the client and the server.

To safeguard data while it is in transit, the following security mechanisms are relevant to the discussion:

• Confidentiality through encryption: The process of encryption converts data into an unreadable format that can only be deciphered with a decryption key.

• Authentication through certificate signature verification: Authentication verifies the sender’s and recipient’s identities.

Data integrity protection: TLS integrity mechanisms and NNE checksums detect changes to data in transit.

Network encryption protects data moving over communications networks. The following topics describe the available configuration options:

• Certificate-authenticated TLS: Configuring Transport Layer Security Encryption

  TLS (transport layer security) is the default form of network data protection for Internet communications. Security-savvy organizations go a step beyond their Internet traffic and also protect their internal networks, corporate network infrastructure, and virtual private networks with network-level encryption.

• ezTLS: Configuring ezTLS

  ezTLS uses TLS through NNE algorithm negotiation or TCPS connections.

• Native network encryption (NNE): Configuring Oracle AI Database Native Network Encryption and Data Integrity

The transition from NNE to TLS is a critical initiative to support the contemporary network landscape’s heterogeneous ecosystem. In addition to TLS having a stronger security posture and the ability to go undetected by port scanner tools, TLS also supports PKI certificate-based authentication.

TLS is a standard that is omnipresent in global deployments.

Tip: Oracle’s recommendation is for customers to adopt TLS.

The following table compares the available network protection options. The ezTLS column describes connections without certificate-based identity verification. For NNE without ezTLS, encryption and integrity protection depend on the configured policies and negotiated algorithms.

For a detailed TLS comparison, see Selecting ezTLS, One-Way TLS, or Mutual TLS.

Security mechanism	Certificate-authenticated TLS	ezTLS	NNE without ezTLS
Confidentiality through encryption	Yes	Yes	Yes
Authentication through certificate signature verification	Yes	No	No
Data integrity protection	Yes	Yes	Yes