Oracle encryption vs encryption in servers - dba access to unencrypted data

Hi Guys,
I have an application that consists of ca. 20 java servers and batch programs connecting to an oracle 11g instance. Some of the columns of the database are enrypted. This is achieved via jce (keys stored in HSMs, one can configure specified database columns etc).
I would love to use Oracle encryption instead but I gather there was some requirement from the customer that dbas could not just get access to the unencrypted data.
Is there any way around this requirement ?
Rgds
Peter

Hello,
... there was some requirement from the customer that dbas could not just get access to the unencrypted data.
Is there any way around this requirement ?I'm not sure to understand, for all I know, in 11g you have the possibility to Encrypt data (Data Transparent Encryption) at the Table level or Tablespace level as well.
For that Oracle uses a Master Encryption Key. This is true, the Master Key is stored outside from the Database (for instance by using an Oracle Wallet) so that the Security Administrator responsability can be separated from the Database Administrator one.
So, afterwards, it depends on who has the Security duty. The access to the Master Key is a key question:
"+Security is enhanced because the wallet password can be unknown to the database administrator, requiring the security administrator to provide the password.+"
You'll have much more informations on the link below:
http://download.oracle.com/docs/cd/E11882_01/network.112/e10746/asotrans.htm#g1011122
Hope this help.
Best regards,
Jean-Valentin

Similar Messages

Goldengate 11.1.1.1 Oracle 11.2 Encrypted tablespace

Please advise why this error is showing and help us on this situation
Line: -----
Windows 2008 x64
Oracle 11.2.0.1 x64
Oracle Goldengate 11.1.1.1 x64
++++++++++++SOURCE++++++++++++++
sql>conn / as sysdba
**************CREATE TABLESPACE AND TABLE********************
CREATE TABLESPACE encrypted_ts
DATAFILE 'd:\oradata\test\encrypted_ts01.dbf' SIZE 128K
SIZE 15M
AUTOEXTEND ON NEXT 20M
MAXSIZE UNLIMITED
LOGGING
ENCRYPTION USING 'AES192'
EXTENT MANAGEMENT LOCAL
SEGMENT SPACE MANAGEMENT AUTO
DEFAULT NOCOMPRESS STORAGE(ENCRYPT);
CREATE TABLE TESTA
ID NUMBER,
NAME VARCHAR2(16 CHAR)
LOGGING
NOCOMPRESS
NOCACHE
NOPARALLEL
MONITORING;
cmd> mkstore -wrl d:\test\wallet -createEntry ORACLE.SECURITY.CL.ENCRYPTION.ORACLEGG
Enter <secret> : test
cmd>mkstore -wrl d:\test\wallet -viewEntry ORACLE.SECURITY.CL.ENCRYPTION.ORACLEGG
ORACLE.SECURITY.CL.ENCRYPTION.ORACLEGG = test
sql>ALTER SYSTEM SET ENCRYPTION WALLET CLOSE IDENTIFIED BY 'welcome1';
sql>ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY 'welcome1';
Compile dbms_internal_clkm package.
sql>@prvtclkm.plb
sql>GRANT EXECUTE ON SYS.DBMS_INTERNAL_CLKM TO GGS_OWNER;
**********************************GOLDENGATE******************************************
ggsci>dblogin userid ggs_owner, ggs_owner
ggsci>add extract ext2ts, tranlog, begin now
ggsci>add rmttrail D:\ggs\dirdat\ts, extract ext2ts
ggsci>ENCRYPT PASSWORD test ENCRYPTKEY DEFAULT
Using default key...
Encrypted password: AACAAAAAAAAAAAEAZAMEFCPGPEOHYDHE
ggsci>edit params ext2ts
EXTRACT ext2ts
USERID ggs_owner, PASSWORD ggs_owner
RMTHOST 192.168.0.2, MGRPORT 7809
RMTTRAIL D:\ggs\dirdat\ts
DBOPTIONS DECRYPTPASSWORD AACAAAAAAAAAAAEAZAMEFCPGPEOHYDHE ENCRYPTKEY DEFAULT -- ???
TABLE TESTA;
+++++++++++++TARGET++++++++++++++++
sql> conn / as sysdba
**************CREATE TABLESPACE AND TABLE********************
cmd>
CREATE TABLESPACE ts
LOGGING DATAFILE 'd:\oradata\test\ts.dbf'
SIZE 15M
AUTOEXTEND ON NEXT 20M
EXTENT MANAGEMENT
LOCAL SEGMENT SPACE
MANAGEMENT AUTO;
CREATE TABLE TESTA
ID NUMBER,
NAME VARCHAR2(16 CHAR)
LOGGING
NOCOMPRESS
NOCACHE
NOPARALLEL
MONITORING;
************************************GOLDENGATE*****************************************
ggsci>DBLOGIN USERID ggs_owner, PASSWORD ggs_owner
ggsci>ADD CHECKPOINTTABLE GGS_OWNER.CHKPTAB
ggsci>ADD REPLICAT rep1, EXTTRAIL D:\ggs\dirdat\ts, CHECKPOINTTABLE GGS_OWNER.CHKPTAB
ggsci>EDIT PARAMS rep1
REPLICAT rep1
ASSUMETARGETDEFS
USERID ggs_owner, PASSWORD ggs_owner
MAP GGS_OWNER.TESTA, TARGET GGS_OWNER.TESTA;
+++++++++++++TARGET+++++++++++++++
ggsci>start replicat rep1
+++++++++++++SOURCE+++++++++++++++
ggsci>start extract ext2ts
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!EXTRACT - REPORT!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2011-07-05 11:46:50 ERROR OGG-01028 ORA-06521: PL/SQL: Error mapping function
ORA-06512: at "SYS.DBMS_INTERNAL_CLKM", line 3
ORA-06512: at line 1.
2011-07-05 11:46:50 ERROR OGG-01668 PROCESS ABENDING.
Edited by: Oyunbold on Jul 7, 2011 3:25 AM
Edited by: Oyunbold on Jul 19, 2011 6:09 PM

Yesterday, I met the same problem. How do you solve it ? Plz, help me.
OS : AIX 5.3
DB : Oracle 11.1.0.7
OGG : 11.1.1.1
2011-09-06 15:26:56 INFO OGG-01515 Oracle GoldenGate Capture for Oracle, eora01.prm: Positioning to begin time Sep 2, 2011 6:50:49 PM.
2011-09-06 15:26:56 ERROR OGG-01028 Oracle GoldenGate Capture for Oracle, eora01.prm: ORA-12427: invalid input value for FLAGS parameter ORA-06512: at "SYS.DBMS_INTERNAL_CLKM", line 3 ORA-06512: at line 1.
2011-09-06 15:26:56 ERROR OGG-01668 Oracle GoldenGate Capture for Oracle, eora01.prm: PROCESS ABENDING.
Our Extract configuration is below :
EXTRACT EORA01
USERID ogg, PASSWORD AACAAAAAAAAAAADAHBMDHBECUCZBPIYE, encryptkey XKEY
DBOPTIONS DECRYPTPASSWORD AACAAAAAAAAAAAIARIXFKCQBMFIGFARA ENCRYPTKEY DEFAULT
ENCRYPTTRAIL
exttrail ./dirdat/ea
EOFDELAYCSECS 50
FLUSHCSECS 50
DISCARDFILE ./dirrpt/EORA01.DSC, APPEND, MEGABYTES 500
DISCARDROLLOVER AT 07:30
TABLE TVANBT.TLF_BUYS_MISS;
...

Oracle user'd encrypted password (Oracle 10g)

Hi Guys,
Which table can I check for oracle user's encrypted password. I need to use the same password on the application's configuration file for connection to the database.
Thank you.

SQL> desc user$
Name                            Null?    Type
USER#                            NOT NULL NUMBER
NAME                            NOT NULL VARCHAR2(30)
TYPE#                            NOT NULL NUMBER
PASSWORD                             VARCHAR2(30)
DATATS#                       NOT NULL NUMBER
TEMPTS#                       NOT NULL NUMBER
CTIME                            NOT NULL DATE
PTIME                                  DATE
EXPTIME                             DATE
LTIME                                  DATE
RESOURCE$                       NOT NULL NUMBER
AUDIT$                              VARCHAR2(38)
DEFROLE                       NOT NULL NUMBER
DEFGRP#                             NUMBER
DEFGRP_SEQ#                             NUMBER
ASTATUS                       NOT NULL NUMBER
LCOUNT                        NOT NULL NUMBER
DEFSCHCLASS                             VARCHAR2(30)
EXT_USERNAME                             VARCHAR2(4000)
SPARE1                              NUMBER
SPARE2                              NUMBER
SPARE3                              NUMBER
SPARE4                              VARCHAR2(1000)
SPARE5                              VARCHAR2(1000)
SPARE6                              DATE

Securing data from dba access , like Credit Card Details

Hello ,
is there any way of hiding CC details from all users in db level except specifc users
enrypting cc data like oracle hashed passwords
for ex,
case (1)
user 1 ( has access to these details )
select acc#,customer_name from cc_details
output : it will show all the details decrypted
case (2)
user 2 : ( doesnt have access )
select acc#,customer_name from cc_details
output : it will show all the details encrypted
both in db level , like using sqlplus or toad
any idea!
thanks and regards,

Hi, Peter,
You wrote:
Can you please document the problems you mention for Patch Sets/ CPU?
What are the vulnerabilities? Search Alex's Web site but didn't find anything in regards to >DBVault.I've told about these
http://dms.aladdin.ru/file.php?id=d7eb03f7f47ec3c68f4b1f1fe3317119
http://dms.aladdin.ru/file.php?id=88cf1d7a962eddf7e57e2447d1e5b207
and may be this
http://dms.aladdin.ru/file.php?id=232eb8ed58d04295bb3920dbe805358d
(Note: The link will be valid until 26 Jun 2008 GMT).
In reg's to reading data from datafile, that's where TDE comes into the picture; then no-one can read from data file directly.
There is no user who owns TDE; TDE is enabled on a database-wide level. So the >normal data owner (who is the only who should have full access to his own data with >DBVault) can use TDE to encrypt; no extra privileges needed.I’ve told about the user who is the owner of the database wallet (usually SYS). He can temporary disable encryption, takes the data, then restore encryption.
DBVault and TDE should be the perfect match for 'securing data from dba access , like >Credit Card Details'In other words we have yet another administrator (DV owner) instead of the good old SYS :)
And I have a question: in case the protection with DV of some tables was made from the SYS, can he make (in example) full backup or full export of the data (his ordinary administrative tasks)? If yes, then it isn't protection, if no, then...what?
The solution is somewhere else, I think

Access SQL-Server Data from Oracle 10gXE

Hello,
I want to access sql-server data from oracle 10g XE. I need the same functionality provided by Sql-server by Linked Servers, by which we can query on any data source(oracle, Excel, Access).
do, Oracle 10gXE provide us with same functionality ???
any pointers ???

Yes, it does work with Express Edition.
Here is a thread from the XE forum with examples.
Re: Database Link to MS Access
They refer to a MS Access database, but the procedure is the same.
Doug

Are Profiles and DBA Access to users required after MRCA is installed ?

Customer has installed oracle B2B through MRCA .
There are 4 questions that need to be answered.
Question 1
===========
We would like to know if the profiles and DBA access to users are required after MRCA is installed ?
Question 2
==========
If we remove these privileges will there be any impact to future Application Server upgrades, applying of patches ?
Question 3
============
There is a schema called BASEDEF with the two roles BASEAPP_ADMIN and BASEAPP_INSTANCE_ADMIN .
Please could you let us know the purpose of this schema and its usage ?
Question 4
============
Does the schema BASEDEF affects b2b in any manner ?
Regards,
Suresh

Hi Suresh,
Please find below answer of your questions-
1. Profiles are created automatically during installation and they are required for maintaining the functionality of B2B. DBA access to these profiles are not required.
2. If you revoke DBA access from the profiles, then it should not affect the functionality of B2B. Generally Patch scripts are run on account "b2b" and this account does not have dba access so there should be no problem due to access revoke.
Any DBA can answer your 3rd and 4th question.
Regards,
Anuj

How to identify the locks in oracle db objects? i dont have access to check

How to identify the locks in oracle db objects? i dont have access to check the v$lock or v$ objects. i dont have dba access. what are the symptoms for table, row or objects lock? how v guess it would be lock?
Thanks in advance friends..

I believe you will have to call your DBA on the phone in that case.
You can query something with a select ... for update nowait.
If it raises an exception you can handle it within a when section.
-- Running in one session
SQL> create table t1 as select 1 col1 from dual;
Table created
SQL> select * from t1 for update nowait;
      COL1
         1
SQL>
-- now running in a different session
SQL> select * from t1 for update nowait;
select * from t1 for update nowait
ORA-00054: resource busy and acquire with NOWAIT specified
SQL> set serveroutput on
SQL>
SQL> DECLARE
2    CURSOR cur1 IS
3      SELECT col1 FROM t1 FOR UPDATE NOWAIT;
4    v_col1 NUMBER;
5    locking_error EXCEPTION;
6    PRAGMA EXCEPTION_INIT(locking_error, -00054);
7 BEGIN
8    OPEN cur1;
9 EXCEPTION
10    WHEN locking_error THEN
11      dbms_output.put_line('Busted locking my rows!');
12 END;
13 /
Busted locking my rows!
PL/SQL procedure successfully completed
SQL> Now, surely you won't be able to tell anything else other than there was something locked there.
But none of the details you would find in the views.

Block users from dba access

Hi all,
I am currently using a oracle 10.2.0.1.0. when i create user i want to block user from dba access how can i do that

connect test/test as sysdba;The problem isn't here with user/password, see below :
SQL> conn userdoesntexist/fake as sysdba
Connected.
SQL> show user
USER is "SYS"
SQL> conn / as sysdba
Connected.
SQL> show user
USER is "SYS"
SQL>As it already said above, the problem is with the usage of password file on the server connection. Try to disable this one.
Nicolas.

Loading MS Access Table and Data into Oracle

Hi,
I have few tables in MS Access. I want to create same layout of tables in Oracle and want to populate data from MS Access tables to Oracle tables.
Please let me know if there is a way by which I can create tables and load data automatically (thru some option or script)?
I have Oracle 10g database and its clients.
Thanks in advance,
Rajeev.

You can use Oracle migration workbench
Loading MS Access Table and Data into Oracle
It´s very easy to use and good to import
regards,
Felipe

ORACLE ODBC 8.1.7.6 and Access 2000 (RAMDAC 2.7)

I wanted to use a Pass-through query in microsoft access 2000 and got some inexplicable results.
I Use
- Oracle ODBC 8.1.7.6
- Microsoft Access 2000
- RAMDAC 2.7
Server Oracle-Version = 7.3.4
Server NLS_LANG = AMERICAN_AMERICA.WE8HP
Server Language = ENGLISH
Local Client oracle-Version= 8.1.7
Local NLS_LANG = GERMAN_GERMANY.WE8HP
Local Language = GERMANY
I use a field called 'STOK' and the value is 10.5
ORACLE-Driver | MICROSOFT ODBC for ORACLE
If I only want to display the value, I get 105 <- not OK | 10.5
If I use NVL(STOK,0), I get 10.5 | 10 <- not OK
If I use SUM(STOK), I get 10.5 | 10 <- not OK
If I use STOK*STOK, I get 110.25 | 110 <- not OK
If I use STOK*5, I get 52.5 | 52 <- not OK
Direct link (not pass through 105 <- not OK | 10.5
Is there a possibility, that I can use direct link and pass through with the same driver. I couldn't manage it

Most of our applications use Oracle server versions 7.3, 8.0 and 8.1.
The clients are written in Microsoft Access, Versions 97 and 2000.
Our experience using ODBC is that it only runs correct when on the client the parameter NLS_LANG is set to AMERICAN_AMERICA.WE8... (we use WE8ISO8859P1)!
Be sure to set the right NLS_LANG parameter, there are more than one. If in doubt set them all to the same value.
Kind regards,
Ralf L|thke

Integrate other directory servers with access manager

How to integrate other directory servers with access manager ?

Please read the Access Manager admin guide at http://docs.sun.com/app/docs/doc/819-4670/6n6qardvq
Any further questions regarding this integration, post them to the AM forum at http://forums.sun.com/forum.jspa?forumID=770

Oracle.jbo.DeadEntityAccessException: JBO-27101: Attempt to access dead-ADF

Hi,
I have a table which has a selection radio buttons with all the records. I have a 'Delete' button on the header part of the table. When I try to delete a record I am getting the following exception.
oracle.jbo.DeadEntityAccessException: JBO-27101: Attempt to access dead entity in RebillAttachDocument, key=oracle.jbo.Key[381 ] at oracle.jbo.server.EntityCache.add(EntityCache.java:487) at oracle.jbo.server.ViewRowStorage.entityCacheAdd(ViewRowStorage.java:1762) at oracle.jbo.server.ViewRowImpl.entityCacheAdd(ViewRowImpl.java:2151) at oracle.jbo.server.QueryCollection.populateRow(QueryCollection.java:2247) at oracle.jbo.server.QueryCollection.fetch(QueryCollection.java:2127) at oracle.jbo.server.QueryCollection.get(QueryCollection.java:1501) at oracle.jbo.server.ViewRowSetImpl.getRow(ViewRowSetImpl.java:3650) at oracle.jbo.server.ViewRowSetIteratorImpl.doFetch(ViewRowSetIteratorImpl.java:2818) at oracle.jbo.server.ViewRowSetIteratorImpl.ensureRefreshed(ViewRowSetIteratorImpl.java:2674) at oracle.jbo.server.ViewRowSetIteratorImpl.ensureRefreshed(ViewRowSetIteratorImpl.java:2634) at oracle.jbo.server.ViewRowSetIteratorImpl.getRowAtRangeIndex(ViewRowSetIteratorImpl.java:722) at oracle.jbo.server.ViewRowSetImpl.getRowAtRangeIndex(ViewRowSetImpl.java:3672) at oracle.jbo.server.ViewObjectImpl.getRowAtRangeIndex(ViewObjectImpl.java:6288)
Here is the code for the delete button.
<af:tableSelectOne text="Select and"
binding="#{CRDCF002.tableSelectOne1}"
id="tableSelectOne1"
inlineStyle="font-family:times new roman; font-size:large;">
<af:commandButton text="Delete"
binding="#{CRDCF002.commandButton3}"
id="commandButton3"
actionListener="#{bindings.Delete.execute}"
disabled="#{!bindings.Delete.enabled}"
inlineStyle="font-family:times new roman; font-size:large;"/>
</af:tableSelectOne>
I could see the same record that I want to delete in the DB, but getting this message. I have a form also in the same page to add a new record and refresh the table with the new record. Can anyone please help me with this?
Thanks,
Priya

Hi,
I have a table which has a selection radio buttons with all the records. I have a 'Delete' button on the header part of the table. When I try to delete a record I am getting the following exception.
oracle.jbo.DeadEntityAccessException: JBO-27101: Attempt to access dead entity in RebillAttachDocument, key=oracle.jbo.Key[381 ] at oracle.jbo.server.EntityCache.add(EntityCache.java:487) at oracle.jbo.server.ViewRowStorage.entityCacheAdd(ViewRowStorage.java:1762) at oracle.jbo.server.ViewRowImpl.entityCacheAdd(ViewRowImpl.java:2151) at oracle.jbo.server.QueryCollection.populateRow(QueryCollection.java:2247) at oracle.jbo.server.QueryCollection.fetch(QueryCollection.java:2127) at oracle.jbo.server.QueryCollection.get(QueryCollection.java:1501) at oracle.jbo.server.ViewRowSetImpl.getRow(ViewRowSetImpl.java:3650) at oracle.jbo.server.ViewRowSetIteratorImpl.doFetch(ViewRowSetIteratorImpl.java:2818) at oracle.jbo.server.ViewRowSetIteratorImpl.ensureRefreshed(ViewRowSetIteratorImpl.java:2674) at oracle.jbo.server.ViewRowSetIteratorImpl.ensureRefreshed(ViewRowSetIteratorImpl.java:2634) at oracle.jbo.server.ViewRowSetIteratorImpl.getRowAtRangeIndex(ViewRowSetIteratorImpl.java:722) at oracle.jbo.server.ViewRowSetImpl.getRowAtRangeIndex(ViewRowSetImpl.java:3672) at oracle.jbo.server.ViewObjectImpl.getRowAtRangeIndex(ViewObjectImpl.java:6288)
Here is the code for the delete button.
<af:tableSelectOne text="Select and"
binding="#{CRDCF002.tableSelectOne1}"
id="tableSelectOne1"
inlineStyle="font-family:times new roman; font-size:large;">
<af:commandButton text="Delete"
binding="#{CRDCF002.commandButton3}"
id="commandButton3"
actionListener="#{bindings.Delete.execute}"
disabled="#{!bindings.Delete.enabled}"
inlineStyle="font-family:times new roman; font-size:large;"/>
</af:tableSelectOne>
I could see the same record that I want to delete in the DB, but getting this message. I have a form also in the same page to add a new record and refresh the table with the new record. Can anyone please help me with this?
Thanks,
Priya

What is the difference between Hardware Encryption & On-Board Encryption & Device Encryption

Hi
Can anyone explain me, What is the difference between Hardware Encryption & On-Board Encryption & Device Encryption.
Thanks

http://images.apple.com/iphone/business/docs/iOS_Security_Oct12.pdf

Monitoring Oracle Virtual Machine for Solaris servers and LDOMs

Hi all,
could anyone tell me if we can monitor Oracle Virtual Machine for Solaris servers and LDOMs with only Oracle Enterprise Manager Cloud Control 12c, or shall we need to install Ops Center ?
Thank you in advance.

I had the same issue. Upgrading Virtual box from 4.1.16 to 4.1.20 solved the problem.

Why we are creartinng uid=500(oracle) gid=500(oinstall) groups=501(dba),

why we are creartinng uid=500(oracle) gid=500(oinstall) groups=501(dba), UID is 500
any reason for this . please answer oracle gurus.
i important that the UID and the GID of user oracle are identical to that of the other RAC nodes. This information can be obtained using the following command:
[oracle@oradb1 oracle]$ id oracle
uid=500(oracle) gid=500(oinstall) groups=501(dba), 502(oper)

user8680248 wrote:
why we are creartinng uid=500(oracle) gid=500(oinstall) groups=501(dba), UID is 500
any reason for this . please answer oracle gurus.Because. Literally ... just because.
By convention, it should be above 100. By Red Hat community decision, the starting UID/GID has been moved from 100 to 500, to avoid accidental overlaps with 'system admin' accounts.
BUT, the Oracle owner is a system-like account. It could legitimately be under 500.
There is no magic to the number, other than the auto-increment tool that is provided in many of the commercial Linux variants start there. There is no Oracle dependency. There is only convention.
You should discuss this with your system administrator and come up with a number that is comfortable. If that means talking to yourself, all the easier.

Oracle encryption vs encryption in servers - dba access to unencrypted data

Similar Messages

Maybe you are looking for