Call now: 252-767-6166  
Oracle Training Oracle Support Development Oracle Apps

 E-mail Us
 Oracle Articles
New Oracle Articles

 Oracle Training
 Oracle Tips

 Oracle Forum
 Class Catalog

 Remote DBA
 Oracle Tuning
 Emergency 911
 RAC Support
 Apps Support
 Oracle Support

 SQL Tuning

 Oracle UNIX
 Oracle Linux
 Remote s
 Remote plans
 Application Server

 Oracle Forms
 Oracle Portal
 App Upgrades
 SQL Server
 Oracle Concepts
 Software Support

 Remote S


 Consulting Staff
 Consulting Prices
 Help Wanted!


 Oracle Posters
 Oracle Books

 Oracle Scripts

Don Burleson Blog 









Transparent Data Encryption (TDE) New Features in 11g

Oracle 11g New Features Tips by Donald BurlesonJune 29, 2015

Oracle 11g New Features Tips

External Master Key Storage using Hardware Security Module

Transparent Data Encryption (TDE) was introduced in release 10g. It can be used to encrypt column data inside the database. 

A wallet is used to store an encryption master key which is used to encrypt the keys which again are used to encrypt the actual data in columns. The wallet can be located in a secure location on disk and Oracle Net Services can be used to determine the location of the wallet on disk. This configuration is secure enough for most environments.

But the master key must be kept in memory for the cryptographic operations such as encrypting and decrypting.

A potential hacker could use various methods to dump the memory buffers with the master key and retrieve the master key from the dump file.

In order to further improve protection of the master key Oracle has introduce the possibility to store the master key on an external hardware module called Hardware Security Module (HSM). This is a special hardware which is attached to the database server. The hardware vendor ships a shared library which functions as a plug-in and must be copied to the database server. The database uses a dedicated user account to communicate with the hardware module.

The HSM provide storage for the master key as well as memory for cryptographic operations (encryption, decryption).

% The use of Hardware Security Modules needs the extra cost Advanced            Security Option to be installed!

In order to configure the usage of an HSM you need to issue the following command:


Here user_id is the identifier for an already existing (before manually created!) Oracle user account which is especially used for the communication between the database and the HSM.

If you already have an existing wallet you must add the

MIGRATE USING <wallet_password> syntax in order to decrypt the existing column keys and re-encrypt them with the newly created HSM related master key:


 All cryptographic operations are performed in the external hardware based storage and the master key is never located in the database server's memory.

The HSM is only used to encrypt the column keys which are passed to the database afterwards.

Oracle recommends using the Advanced Security Network Encryption Option to encrypt the traffic between the database server and the HSM.

% The use of a Hardware Security Module makes it possible to use the same            master key for multiple databases as well as for multiple instances in a Real            Application Cluster (RAC).
% A Hardware Security Module cannot be used for tablespace encryption,            encrypted exports and encrypted RMAN backups. These functionalities            need access to the software wallet!

This is an excerpt from the new book Oracle 11g New Features: Expert Guide to the Important New Features by John Garmany, Steve Karam, Lutz Hartmann, V. J. Jain, Brian Carr.

You can buy it direct from the publisher for 30% off.


Oracle Training at Sea
oracle dba poster

Follow us on Twitter 
Oracle performance tuning software 
Oracle Linux poster


Burleson is the American Team

Note: This Oracle documentation was created as a support and Oracle training reference for use by our DBA performance tuning consulting professionals.  Feel free to ask questions on our Oracle forum.

Verify experience! Anyone considering using the services of an Oracle support expert should independently investigate their credentials and experience, and not rely on advertisements and self-proclaimed expertise. All legitimate Oracle experts publish their Oracle qualifications.

Errata?  Oracle technology is changing and we strive to update our BC Oracle support information.  If you find an error or have a suggestion for improving our content, we would appreciate your feedback.  Just  e-mail:  

and include the URL for the page.


Burleson Consulting

The Oracle of Database Support

Oracle Performance Tuning

Remote DBA Services


Copyright © 1996 -  2020

All rights reserved by Burleson

Oracle ® is the registered trademark of Oracle Corporation.