Validate and test - Futurex Documentation

After setting up and opening the encryption wallet, it’s important to verify that Transparent Data Encryption (TDE) is functioning correctly. Validation ensures that the wallet is active and properly associated with your database, while testing confirms that encryption works as expected when applied to database objects. In this section, we will:

Confirm the wallet status from both the CDB and PDB.
Verify that the wallet key is available for encryption operations.
Test TDE functionality by closing the wallet and trying to access the data.

These steps assure that your wallet configuration is successful and that TDE is ready for secure use in your Oracle environment.

Validate Wallet is open

To validate that the wallet is open, run the following command:

Sql

SQL> SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;

If the wallet is configured properly, STATUS of HSM will show as OPEN as shown below:

Sql

WRLTYPE | WRLPARAMETER               | WALLETTYPE | STATUS
---------+-----------------------------+-------------+---------------------
FILE     | /etc/ORACLE/WALLETS/tde/    | AUTOLOGIN   | OPENNOMASTERKEY
HSM      |                             | HSM         | OPEN

Validate if TDE is active

Connect to the Oracle database, and make sure that the database instance is running.

Shell

$ sqlplus / as sysdba

Sql

SQL> STARTUP;

Switch to a preferred PDB container

SQL

  SQL> ALTER SESSION SET CONTAINER = <PDB_CONTAINER>;

Check if the PDB container has a HSM keystore set up:

Sql

SQL> SELECT WRL_TYPE, STATUS, WALLET_TYPE FROM V$ENCRYPTION_WALLET;

ImportantEach PDB must have its own keystore opened and a TDE master key generated. This process should be performed only after the CDB’s keystore has been opened and its TDE master key created. Repeat the steps from the previous page for every PDB requiring TDE encryption.

Create a test user

SQL

  SQL> CREATE USER test_user IDENTIFIED BY "<USER_PASSWORD>";

Grant basic privileges to the user

SQL

  SQL> GRANT CONNECT, RESOURCE TO test_user;

Grant quota unlimited to the user

Sql

SQL> ALTER USER test_user QUOTA UNLIMITED ON USERS;

In a separate terminal, connect to the newly created user

Shell

sqlplus test_user/<USER_PASSWORD>@<HOSTNAME>:<PORT>/<PDB_NAME>

ImportantTo check which hostname and port the PDB is connected to, check the listener.ora or tnsnames.ora files

Shell

cat $ORACLEHOME/network/admin/listener.ora
cat $ORACLEHOME/network/admin/tnsnames.ora

Create a table

Sql

SQL> CREATE TABLE CUSTOMERS (ID NUMBER(5), NAME VARCHAR2(42), CREDIT_LIMIT NUMBER(10));

Insert test data into the table

Sql

SQL> INSERT INTO CUSTOMERS VALUES (1, 'Test User', 1000);
SQL> INSERT INTO CUSTOMERS VALUES (2, 'Test User 2', 2000);

Encrypt a column using the TDE key on CryptoHub

Sql

SQL> ALTER TABLE CUSTOMERS MODIFY (CREDIT_LIMIT ENCRYPT);

Check if the column is encrypted

Sql

SQL> SELECT TABLE_NAME, COLUMN_NAME, ENCRYPTION_ALG
FROM USER_ENCRYPTED_COLUMNS
WHERE TABLE_NAME = 'CUSTOMERS';

A successful output will look similar to the output below

None

TABLENAME	     COLUMNNAME	ENCRYPTIONALG
--------------- --------------- -----------------------------
CUSTOMERS	     CREDITLIMIT	AES 192 bits key

Test if TDE is active

In the terminal that is logged in as the newly created user, run the following command to see the data in the CREDIT_LIMIT column in the table

Sql

SQL> SELECT CREDIT_LIMIT FROM CUSTOMERS;

Output should look similar to

None

CREDIT_LIMIT
------------
	1000
	2000

In another terminal that is logged in as SYS, close the PDB wallet.

Sql

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY "CryptoHub_Identity_Password";

In the terminal that is logged in as the newly created user, try to view the data in the CREDIT_LIMIT column

Sql

SQL> SELECT CREDIT_LIMIT FROM CUSTOMERS;

A successful TDE output will look similar to below

None

ERROR at line 1:
ORA-28365: wallet is not open

​Validate Wallet is open

​Validate if TDE is active

​Test if TDE is active

Validate Wallet is open

Validate if TDE is active

Test if TDE is active