Verify the integration - Futurex Documentation

Encrypt test data, and then confirm that the database cannot read it without CryptoHub.

Oracle Database does not encrypt objects that SYS owns (ORA-28336: cannot encrypt SYS owned objects). Create the test objects under a separate user.

In the commands on this page, replace TEST_USER_PASSWORD with a password for the test user, and replace CRYPTOHUB_ENDPOINT_PIN with the CryptoHub endpoint PIN.

Create a test user

In sqlplus / as sysdba, create the test user:

CREATE USER tdetest IDENTIFIED BY "TEST_USER_PASSWORD";
GRANT CREATE SESSION, CREATE TABLE, UNLIMITED TABLESPACE TO tdetest;

Encrypt a column

Connect as the test user, and then create a table with an encrypted column:

CONNECT tdetest/"TEST_USER_PASSWORD"
CREATE TABLE tde_test (
  id    NUMBER,
  name  VARCHAR2(50),
  ssn   VARCHAR2(11) ENCRYPT
);
INSERT INTO tde_test VALUES (1, 'Test User', '123-45-6789');
COMMIT;
SELECT * FROM tde_test;

The query returns the row with the ssn value in plain text.

Connect as SYSDBA, and then confirm that the column is encrypted:

CONNECT / AS SYSDBA
SELECT owner, table_name, column_name, encryption_alg FROM dba_encrypted_columns;

The output shows the SSN column of TDETEST.TDE_TEST. The default algorithm is AES 192 bits key.

Encrypt a tablespace

As SYSDBA, create an encrypted tablespace:

CREATE TABLESPACE tde_tbs
  DATAFILE '/u01/app/oracle/oradata/ORCL/tde_tbs01.dbf' SIZE 50M
  ENCRYPTION USING 'AES256'
  DEFAULT STORAGE (ENCRYPT);

SELECT tablespace_name, encrypted FROM dba_tablespaces WHERE tablespace_name = 'TDE_TBS';

The output shows TDE_TBS with ENCRYPTED set to YES.

Create a table in the encrypted tablespace:

CREATE TABLE tdetest.tbs_test (id NUMBER, secret VARCHAR2(40)) TABLESPACE tde_tbs;
INSERT INTO tdetest.tbs_test VALUES (1, 'tablespace-secret');
COMMIT;

Confirm that access depends on CryptoHub

Close the HSM key store, and then confirm that the encrypted data is unreadable.

As SYSDBA, close the HSM key store:

ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY "CRYPTOHUB_ENDPOINT_PIN";
SELECT WRL_TYPE, STATUS FROM v$encryption_wallet WHERE WRL_TYPE = 'HSM';

The HSM key store STATUS is CLOSED.

As the test user, try to read the encrypted data:

CONNECT tdetest/"TEST_USER_PASSWORD"
SELECT * FROM tde_test;
SELECT * FROM tbs_test;

Both queries fail with ORA-28365: wallet is not open.

As SYSDBA, open the HSM key store again:

CONNECT / AS SYSDBA
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "CRYPTOHUB_ENDPOINT_PIN";

As the test user, read the encrypted data again:

CONNECT tdetest/"TEST_USER_PASSWORD"
SELECT * FROM tde_test;
SELECT * FROM tbs_test;

Both queries return their rows in plain text.

Confirm the key store opens after a restart

If you configured auto-login, restart the database, and then confirm that the encrypted data is readable without a manual open:

CONNECT / AS SYSDBA
SHUTDOWN IMMEDIATE;
STARTUP;
SELECT WRL_TYPE, STATUS, WALLET_TYPE FROM v$encryption_wallet;
SELECT * FROM tdetest.tde_test;
SELECT * FROM tdetest.tbs_test;

The HSM key store STATUS is OPEN, and both queries return their rows.

If you did not configure auto-login, the HSM key store STATUS is CLOSED after the restart. Open it with ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN, and then run the queries.

Confirm the master encryption key in CryptoHub

In CryptoHub, find the keys in the Oracle Database TDE service key group. Confirm that a key has a label that starts with ORACLE.TDE.HSM.MK.06 followed by the masterkeyid value that you recorded when you created the master encryption key. CryptoHub adds a numeric suffix to the label.

Remove the test objects

After you finish the verification, remove the test objects:

CONNECT / AS SYSDBA
DROP USER tdetest CASCADE;
DROP TABLESPACE tde_tbs INCLUDING CONTENTS AND DATAFILES;

If any check fails, see Troubleshooting.

​Create a test user

​Encrypt a column

​Encrypt a tablespace

​Confirm that access depends on CryptoHub

​Confirm the key store opens after a restart

​Confirm the master encryption key in CryptoHub

​Remove the test objects

Create a test user

Encrypt a column

Encrypt a tablespace

Confirm that access depends on CryptoHub

Confirm the key store opens after a restart

Confirm the master encryption key in CryptoHub

Remove the test objects