Oracle英文版培训课件之Security：les-18

ApplyingFileEncryptionObjectivesAftercompletingthislesson,youshouldbeabletodothefollowing:UseRMANencryptedbackupsOracleSecureBackupUseDataPumpexportencryptionRMANEncryptedBackupsRMANPasswordEncryptedtoDiskEncryptedtoTape(ASO)(OSB)DatafilesOracleSecureBackupEncryptionOSBDataFilesEncryptedOSFilesOSBWalletTapeDeviceEncryptedBackupstoTapeRMANbackupencryption:EncryptionkeystransparentlymanagedbythedatabaseBackupencryptionatthedatabaseortablespacelevelEncryptionalgorithmsupto256-bitAESSecuretransportationoverthenetwork:DatabasebackupswithRMANencryptionFile-systembackupswithSSLRMANencryptedbackupsontapeisonlyavailablewithOracleSecureBackup.CreatingRMANEncryptedBackupsRMANoffersthreeencryptionmodes:Transparentmode:UsestheOraclekeymanagementinfrastructureRequiresthatyoufirstconfigureOracleEncryptionWalletPasswordmode:RequirestheuseoftheSET

ENCRYPTION

ON

IDENTIFIED

BY

password

ONLYcommandinyourRMANscriptsDualmode:RequirestheuseoftheSET

ENCRYPTION

ON

IDENTIFIED

BY

passwordcommandinyourRMANscriptsUsingTransparentModeEncryptionPerformthefollowingsteps:CreateawalletusingOracleWalletManager:Openthewallet:Setthemasterkey:ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/opt/oracle/product/10.2.0/db_1/)))ALTERSYSTEMSETENCRYPTIONWALLETOPENIDENTIFIEDBY<password>;ALTERSYSTEMSETENCRYPTIONKEYIDENTIFIEDBY<password>;UsingTransparentModeEncryptionConfigureRMANencryptionlevel(database,tablespace,ordatabaseexcludingtablespaces):Setencryptionalgorithm,ifneeded:SETENCRYPTIONALGORITHM'algorithmname'CONFIGUREENCRYPTIONFORDATABASEONCONFIGUREENCRYPTIONFORTABLESPACE<tablespace_name>ONUsingPasswordModeEncryptionEnablepasswordmodeencryptioninyourRMANsession:SETENCRYPTIONONIDENTIFIEDBY<password>ONLYUsingDualModeEncryptionDual-modeencryptedbackupscanberestoredtransparentlyorbyspecifyingapassword.EnablepasswordmodeencryptioninyourRMANsession:SETENCRYPTIONONIDENTIFIEDBY'password'RestoringEncryptedBackupsBeforerestoration,settheRMANsessiontodecryptbackups.SpecifyallrequiredpasswordswiththeSETDECRYPTIONcommandwhenrestoringfromasetofbackupsthatwerecreatedwithdifferentpasswords.SETDECRYPTIONIDENTIFIEDBY'<password_1>'{,'<password_2>',…,'<password_n>}RMANEncryptedBackups:ConsiderationsImagecopybackupscannotbeencrypted.V$RMAN_ENCRYPTION_ALGORITHMScontainsthelistofpossibleencryptionalgorithms.Onenewencryptionkeyisusedforeachnewencryptedbackup.Youcanincreasediskperformancebyusingmultiplechannels.Youcanchangethemasterkeyanytimewithoutaffectingyourtransparentencryptedbackups.SETENCRYPTIONALGORITHM'algorithmname'CONFIGUREENCRYPTIONALGORITHM'algorithmname'ProtectingDumpFilesProblem:DataPumpexportcancreatedumpfilesfromtableswithencryptedcolumns.Solution:UseENCRYPTION_PASSWORDparameter:PlacetheENCRYPTION_PASSWORDinaPARFILEexpdpoe/oracleTABLES=cust_payment_info\DIRECTORY=data_pump_dirDUMPFILE=dpcd2be1.dmp\

ENCRYPTION_PASSWORD=123456ENCRYPTION_PASSWORDDataPumpencryptionis:EnabledwithENCRYPTION_PASSWORD="password"

AppliedonlytoENCRYPTcolumndataOnlyavailablewithTDENotsupportedwithnetworkexportsofexternaltablesPractice18Overview:

UsingFileBasedEncryptionThispracticecoversthefollowingtopics:UsingRecoveryManagertocreateencryptedbackupsetsCreatingandrecoveringtransparentmodebackupsCreatingandrecoveringdualmodebackupsCreatingandrecoveringpasswordmodebackupsUsingDataPumpexporttocreateaexportdump