DELL EMC DATA DOMAIN WITH RMAN USING ENCRYPTION FOR ORACLE DATABASES

Transcription

1 DELL EMC DATA DOMAIN WITH RMAN USING ENCRYPTION FOR ORACLE DATABASES A Technical Review ABSTRACT With the threat of security breaches, customers are putting in place defenses from these security breaches. One defense mechanism is to encrypt their data. This white paper describes the different ways an Oracle database is encrypted and how it affects Data Domain deduplication and backup time of Oracle databases. June 2017 WHITE PAPER

2 The information in this publication is provided as is. Dell EMC makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Use, copying, and distribution of any Dell EMC software described in this publication requires an applicable software license. EMC 2, EMC, the EMC logo, are registered trademarks or trademarks of Dell EMC in the United States and other countries. All other trademarks used herein are the property of their respective owners. Copyright 2017 Dell EMC. All rights reserved. Published in the USA., 06/17, White Paper, H16288 Dell EMC believes the information in this document is accurate as of its publication date. The information is subject to change without notice. EMC is now part of the Dell group of companies. 2

3 TABLE OF CONTENTS EXECUTIVE SUMMARY...4 Introduction... 4 Audience... 4 DELL EMC DATA DOMAIN SYSTEMS...4 Technical overview... 4 THE ORACLE ENCRYPTION PROCESS...5 Introduction... 5 RMAN encryption... 5 Oracle TDE encryption... 5 Vormetric Transparent encryption... 6 ORACLE ENCRYPTION TEST SCENARIOS AND RESULTS...7 CPU utilization... 7 Deduplication impact HOW DATA DOMAIN ORACLE OPTIMIZED DEDUPLICATION IMPROVES TDE DEDUPLICATION...12 CONCLUSION...12 ACKNOWLEDGEMENTS

4 EXECUTIVE SUMMARY INTRODUCTION As more data breaches are reported in the news, enterprises are finding ways to defend against those breaches. One tactic is to encrypt their valuable data stored in databases. This white paper describes in detail the different approaches to encrypting Oracle data and how the different encryption approaches affect deduplication on Dell EMC Data Domain systems as well as backup times. AUDIENCE This white paper is intended for Oracle database administrators, systems engineers, Dell EMC partners and members of the Dell EMC and partner professional services community who are looking to understand the implications of encrypting an Oracle database and the impacts on backup times and deduplication with Dell EMC Data Domain systems. DELL EMC DATA DOMAIN SYSTEMS TECHNICAL OVERVIEW The Data Domain deduplication engine is designed to be data agnostic. It has the ability to ingest data of all types (file, Oracle, SQL Server, Exchange, SharePoint), segment the stream along natural breakpoints and deduplicate the segments if the identical segment was found to exist on the Data Domain system. The key is that the segments have to be exactly identical to be deduplicated. In this white paper, we will review how the Data Domain system handles deduplication with encrypted Oracle RMAN data. 4

5 THE ORACLE ENCRYPTION PROCESS INTRODUCTION When you talk about encrypting an Oracle database, there are multiple points on where encryption can take place depending on what encryption is used. Below is an illustration of where encryption can be introduced into the data stream. RMAN ENCRYPTION When Oracle RMAN backs up the database, encryption takes place after RMAN reads the Oracle block and before it sends it to the backup media. If RMAN backs up the identical database twice with absolutely no changes to the database with RMAN encryption enabled for backups, the resulting two backups will be encrypted. RMAN backup encryption is encryption in real time. The encryption algorithm is random. It applies different values every time the backup runs. So even with the same database, the backup data of one backup is totally different from the next backup after RMAN encryption is applied. Since there is no identical segment between each backup, the deduplication benefit of Data Domain systems is totally diminished. Unfortunately, the Data Domain system relies on finding identical segments in the stream to deduplicate backups to economize space used on the Data Domain system. RMAN will be able to stream the backup to the Data Domain system and the backup will be successful, but the deduplication ratio will suffer. No further discussion is needed with RMAN encryption since it clearly degrades deduplication effectiveness and provides no benefit to shortening the backup time since all segments of the backup need to be transferred to the Data Domain system. Dell EMC s best practice is to disable RMAN encryption. If there are concerns about transmitting clear text backup data across the network, DD Boost for RMAN encryption can be enabled so that RMAN backup data can be encrypted after deduplication at the Oracle server and before transmitting across the network. Since the encryption happens after deduplication and before the segment leaves the Oracle server (in other words, it is in-flight encryption), deduplication ratios will not suffer on the Data Domain system. ORACLE TDE ENCRYPTION Transparent Data Encryption (often abbreviated to TDE) is a technology employed by Oracle to encrypt database files. TDE offers encryption at file level. TDE solves the problem of protecting data-at-rest, encrypting databases both on the hard drive and consequently on backup media. Enterprises typically employ TDE to solve compliance issues such as PCI DSS which requires the protection of data-at-rest. Oracle requires the Oracle Advanced Security option for Oracle 10g and 11g to enable TDE. Oracle TDE addresses encryption requirements associated with public and private privacy and security mandates such as PCI and California SB Oracle Advanced Security TDE column encryption was introduced in Oracle Database 10g Release 2. Oracle Advanced Security TDE tablespace encryption and support for Hardware Security Modules (HSMs) were introduced with Oracle Database 11gR1. Keys for TDE can be stored in an HSM to manage keys across servers, protect keys with hardware, and introduce a separation of duties. The same key is used to encrypt columns in a table, regardless of the number of columns to be encrypted. These encryption keys are encrypted using the database server master key and are stored in a dictionary table in the database. 5

6 VORMETRIC TRANSPARENT ENCRYPTION Vormetric Transparent Encryption enables data-at-rest encryption without re-engineering applications, databases or infrastructure. Vormetric Transparent Encryption Agents are installed above the file system on servers or virtual machines to enforce data security and compliance policies. With Vormetric encryption, since data is transparent when RMAN receives it from the database, Data Domain inflight encryption can ensure end to end encryption. User Application Database Vormetric Transparent Encryption Filesystem and Volume Managers Storage No application changes are required for Vormetric Transparent Encryption software to deliver data encryption, privileged user access control and security intelligence 6

7 ORACLE ENCRYPTION TEST SCENARIOS AND RESULTS CPU UTILIZATION As a baseline, we see the CPU utilization of an unencrypted backup for both the initial and subsequent backup using Data Domain Boost. The key observation noted for this graph is that the subsequent backup CPU utilization drops to no significant load considerably earlier than the initial backup. This can be accounted for because DD Boost found more duplicate segments in the subsequent backup as compared to the initial backup. DD Boost Backup Initial Second Time (min) 23:05 23:21 23:37 23:53 24:09 24:25 24:41 24:57 25:13 25:29 25:45 26:01 26:17 26:33 26:49 27:05 27:21 27:37 27:53 28:09 28:25 28:41 28:57 29:13 29:29 29:45 30:01 30:17 30:33 30:49 7

8 Below are test results comparing TDE CPU utilization as compared to an unencrypted database. Note that the CPU utilization for the TDE database backup is on par with the unencrypted database backup. The TDE database takes an additional minute to complete, about 14% longer than the unencrypted database Initial DD Boost Backup TDE Baseline 22:51 23:07 23:23 23:39 23:55 24:11 24:27 24:43 24:59 25:15 25:31 25:47 26:03 26:19 26:35 26:51 27:07 27:23 27:39 27:55 28:11 28:27 28:43 28:59 29:15 29:31 29:47 30:03 30:19 30:35 30:51 8

9 The second TDE database backup has the same CPU utilization as the unencrypted database while the TDE database backup is taking about 30% longer than the unencrypted database. 100 Subsequent DD Boost Backup TDE Baseline Time (min) 23:05 23:21 23:37 23:53 24:09 24:25 24:41 24:57 25:13 25:29 25:45 26:01 26:17 26:33 26:49 27:05 27:21 27:37 27:53 28:09 28:25 28:41 28:57 29:13 29:29 29:45 30:01 30:17 30:33 30:49 9

10 The Vormetric backup CPU utilization is quite similar to the unencrypted database. However, as in the TDE database backup, the duration for the Vormetric database backup is about 16% longer than the unencrypted database backup time. This is very close to the 14% longer backup time associated with the TDE database backup time Initial DD Boost Backup Vormetric Baseline Time (min) 23:05 23:21 23:37 23:53 24:09 24:25 24:41 24:57 25:13 25:29 25:45 26:01 26:17 26:33 26:49 27:05 27:21 27:37 27:53 28:09 28:25 28:41 28:57 29:13 29:29 29:45 30:01 30:17 30:33 30:49 10

11 With the subsequent backup of the Vormetric database, the CPU utilization is again similar to the unencrypted database and it takes about 12% longer to finish Subsequent DD Boost Backup Vormetric Baseline Time (min) 23:05 23:21 23:37 23:53 24:09 24:25 24:41 24:57 25:13 25:29 25:45 26:01 26:17 26:33 26:49 27:05 27:21 27:37 27:53 28:09 28:25 28:41 28:57 29:13 29:29 29:45 30:01 30:17 30:33 30:49 11

12 DEDUPLICATION IMPACT Considering the three encryption methods introduced at the beginning of this whitepaper, RMAN encryption is not an interesting candidate to investigate when used with a deduplication solution since the encryption process happens dynamically at backup time and the output of RMAN will always result in poor deduplication ratios. With Vormetric encryption, the data is decrypted above the filesystem layer, just before it is passed to Oracle, so the actual backup is not encrypted by Vormetric. The interesting case is with TDE databases since the data is transferred to the Data Domain system in an encrypted format. Below are results from backing up an unencrypted database and a TDE database. Based on the deduplication results between the two database backups, TDE affects the deduplication ratio by a factor of 2.1x using a 5% daily change rate. Unencrypted backups with 5% daily change rate Full Backup Pre-comp (GiB) Post-comp(GiB) Total-Comp Factor Initial Full x Day x Day x Day x Day x Day x TDE backups with 5% daily change rate Full Backup Pre-comp (GiB) Post-comp(GiB) Total-Comp Factor Initial Full x Day x Day x Day x Day x Day x HOW DATA DOMAIN ORACLE OPTIMIZED DEDUPLICATION IMPROVES TDE DEDUPLICATION There is a special feature that changes the default behavior of Data Domain systems to be more sensitive to Oracle RMAN backup streams (see whitepaper for full details: In a Proof Of Concept, a customer tested out an Oracle TDE database with 132 GB in size with no changes. The results are shown below with the Data Domain Oracle Optimized Deduplication feature enabled. 1 st Full 1.3 X 2 nd Full X 3 rd Full X CONCLUSION The CPU utilization of both TDE and Vormetric ranges from 12% to 30% more time as compared to an unencrypted database, but does not utilize the CPU more than an unencrypted database. TDE encryption does affect the deduplication ratio as compared to a database that is not encrypted as we have seen with a 5% daily change rate of the database reducing the deduplication ratio by a factor of 2.1x. With Data Domain Oracle Optimized Deduplication enabled on the Data Domain system mtree, customers will achieve significantly improved deduplication of TDE RMAN backups. 12

13 ACKNOWLEDGEMENTS The author would like to Allen Yen, Rick Rasmussen and Diana Yang for providing the test results featured in this paper. 13