码迷,mamicode.com
首页 > 数据库 > 详细

oracle加密--wallet

时间:2017-03-19 13:28:35      阅读:1423      评论:0      收藏:0      [点我收藏+]

标签:cat   表空间   lte   过程   parent   word   查看   text   arch   

TDE(Transparent Data Encryption ),通过使用wallet 对数据加密,物理上对数据文件中的数据进行加密。


工作过程


当用户插入数据到需要加密的列中的时候,Oracle 10g从钱夹中获取master密钥,用master密钥解密数据字典中的表密钥,然后用解密后的表密钥加密输入数据,再将加密后的数据保存在数据库中。


当用户查询一个加密列的时候,Oracle 将加密的表密钥从数据字典中取出,再取出master密钥,然后解密表密钥,再用解密后的表密钥来解密磁盘上加密的数据,最后返回明文给用户。


所有操作对用户而言是透明的。


技术分享
1.  创建钱包

sqlplus中查看,文件路径和查询中的一致

  1. SQL> SELECT * FROM V$ENCRYPTION_WALLET;
  2. WRL_TYPE WRL_PARAMETER STATUS
  3. -------------------- ------------------------------------------------------------ ------------------
  4. file /oracle/app/oracle/admin/PROD/wallet CLOSED

默认是关闭的,修改sqlnet.ora文件,wallet不存在,创建一下

  1. mkdir -p /oracle/app/oracle/admin/PROD/wallet

  1. ENCRYPTION_WALLET_LOCATION=
  2. (SOURCE=
  3. (METHOD=FILE)
  4. (METHOD_DATA=
  5. (DIRECTORY=/oracle/app/oracle/admin/wallet)))


 创建wallet

  1. SQL> ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "oracle";
  2. System altered.
  3. SQL> col WRL_PARAMETER for a60
  4. SQL> set line 200
  5. SQL> SELECT * FROM V$ENCRYPTION_WALLET;
  6. WRL_TYPE WRL_PARAMETER STATUS
  7. -------------------- ------------------------------------------------------------ ------------------
  8. file /oracle/app/oracle/admin/PROD/wallet OPEN

  1. PROD@localhost.localdomain /oracle/app/oracle/admin/PROD/wallet$ ll
  2. total 4
  3. -rw-r--r-- 1 oracle oinstall 2845 Jul 9 06:43 ewallet.p12
  4. PROD@localhost.localdomain /oracle/app/oracle/admin/PROD/wallet$


2.透明列级加密

  1. -- 不能对 sys用户的表加密
  2. SQL> conn hxy/hxy Connected.

  3. CREATE TABLE cust_payment_info
  4. (first_name VARCHAR2(11),
  5. last_name VARCHAR2(10),
  6. order_number NUMBER(5),
  7. credit_card_number VARCHAR2(16) ENCRYPT NO SALT,
  8. active_card VARCHAR2(3));

  1. INSERT INTO cust_payment_info VALUES
  2. (‘Jon‘, ‘Oldfield‘, 10001, ‘5446959708812985‘,‘YES‘);
  3. INSERT INTO cust_payment_info VALUES
  4. (‘Chris‘, ‘White‘, 10002, ‘5122358046082560‘,‘YES‘);
  5. INSERT INTO cust_payment_info VALUES
  6. (‘Alan‘, ‘Squire‘, 10003, ‘5595968943757920‘,‘YES‘);
  7. INSERT INTO cust_payment_info VALUES
  8. (‘Mike‘, ‘Anderson‘, 10004, ‘4929889576357400‘,‘YES‘);
  9. INSERT INTO cust_payment_info VALUES
  10. (‘Annie‘, ‘Schmidt‘, 10005, ‘4556988708236902‘,‘YES‘);
  11. INSERT INTO cust_payment_info VALUES
  12. (‘Elliott‘, ‘Meyer‘, 10006, ‘374366599711820‘,‘YES‘);
  13. INSERT INTO cust_payment_info VALUES
  14. (‘Celine‘, ‘Smith‘, 10007, ‘4716898533036‘,‘YES‘);
  15. INSERT INTO cust_payment_info VALUES
  16. (‘Steve‘, ‘Haslam‘, 10008, ‘340975900376858‘,‘YES‘);
  17. INSERT INTO cust_payment_info VALUES
  18. (‘Albert‘, ‘Einstein‘, 10009, ‘310654305412389‘,‘YES‘);

  1. SQL> select * from cust_payment_info
  2. 2 ;
  3. FIRST_NAME LAST_NAME ORDER_NUMBER CREDIT_CARD_NUMB ACT
  4. ----------- ---------- ------------ ---------------- ---
  5. Chris White 10002 5122358046082560 YES
  6. Alan Squire 10003 5595968943757920 YES
  7. Mike Anderson 10004 4929889576357400 YES
  8. Annie Schmidt 10005 4556988708236902 YES
  9. Elliott Meyer 10006 374366599711820 YES
  10. Celine Smith 10007 4716898533036 YES
  11. Steve Haslam 10008 340975900376858 YES
  12. Albert Einstein 10009 310654305412389 YES
  13. 8 rows selected.


关闭钱包,则无法访问

  1. SQL> ALTER SYSTEM SET ENCRYPTION WALLET close identified by oracle;
  2. System altered.
  3. SQL> conn hxy/hxy
  4. Connected.
  5. SQL> select * from cust_payment_info;
  6. select * from cust_payment_info
  7. *
  8. ERROR at line 1:
  9. ORA-28365: wallet is not open


3. 透明表空间加密 (表空间上所有的数据都加密)

  1. SQL> CREATE TABLESPACE securespace
  2. 2 DATAFILE ‘/home/oracle/oracle3/product/11.1.0/db_1/secure01.dbf‘
  3. 3 SIZE 150M
  4. 4 ENCRYPTION
  5. 5 DEFAULT STORAGE(ENCRYPT);
  6. Tablespace created.

  1. SQL> CREATE TABLE customer_payment_info
  2. 2 (first_name VARCHAR2(11),
  3. 3 last_name VARCHAR2(10),
  4. 4 order_number NUMBER(5),
  5. 5 credit_card_number VARCHAR2(16),
  6. 6 active_card VARCHAR2(3))TABLESPACE securespace;
  7. Table created.

4. 删除了操作系统的加密文件

执行下面的命令,输入原来的密码会生成一个.p12文件

  1. PROD@localhost.localdomain /oracle/app/oracle/product/11.2.0/network/admin$ mkstore -wrl /oracle/app/oracle/product/11.2.0/network/admin/wallet/ -list
  2. Oracle Secret Store Tool : Version 11.2.0.4.0 - Production
  3. Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.
  4. Enter wallet password:
  5. Oracle Secret Store entries:
  6. ORACLE.SECURITY.DB.ENCRYPTION.ARMxdklw5k9zv9UpvDKPCDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
  7. ORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY

  8. PROD@localhost.localdomain /oracle/app/oracle/product/11.2.0/network/admin/wallet$ ll
  9. total 4
  10. -rw-r--r-- 1 oracle oinstall 2581 Jul 9 08:35 ewallet.p12

参考:





oracle加密--wallet

标签:cat   表空间   lte   过程   parent   word   查看   text   arch   

原文地址:http://www.cnblogs.com/haoxiaoyu/p/46ab50177dc0997eb2d411f2529b0f4b.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!