Transparent Data Encryption

Transcription

1

2 <Insert Picture Here> Transparent Data Encryption DOAG SID SAP & Oracle June 2007 Andreas Becker Senior Member Technical Staff Oracle Server Technologies - SAP Development

3 Agenda Transparent Data Encrytion Technical Overview Demo Technical Restrictions/Recommendations Configuration and Support in SAP Environments Alternatives RMAN Backup Encryption Oracle Secure Backup <Insert Picture Here>

4 Encryption Network Encryption Encryption of data in motion Transparent Data Encryption Encryption of data at rest <Insert Picture Here>

5 <Insert Picture Here> JP Morgan Client Data Loss The Wall Street Journal, May 2007 JP Morgan Chase has alerted thousands of its Chicago-area millionaire clients, as well as some of its own employees, that it cannot locate a computer tape containing their account information and Social Security numbers.

6 The Need for Encryption Worldwide privacy, security laws and regulations Sarbanes-Oxley PCI (Payment Card Industrie) California SB 1386 (Nationwide soon?) Country-specific laws Customer Credit Card Numbers Disks replaced for maintenance Data worthless if encrypted Laptops stolen Backups lost

7 Database Encryption Release < 10.2 Oracle8i, Oracle9i and Oracle Database 10g provided a PL/SQL API for encrypting data in the Enterprise Edition DBMS_OBFUSCATION_TOOLKIT in Oracle9i, Oracle10g DBMS_CRYPTO in Oracle Database 10g Application calls PL/SQL API to perform encryption Typically requires database triggers, database Views No automated key management Note that most 3 rd party solutions today create triggers and views to make their encryption solution look transparent Oracle encryption API s are used by customers today to encrypt credit card numbers

8 What our customers wanted Privacy / regulatory compliance (SB 1386, CISP/PCI) Protection for data on backup tapes Additional protection against operating system / data file theft Media theft / disk replacement Let the database handle all aspects of encryption, not the application Make it easy and secure

9 Transparent Data Encryption Integrated with the Oracle database for simplicity Alter table encrypt column Provides application transparency No API calls, database triggers or views required Media protection of PII data Social security numbers Credit Card Numbers Performance Works with existing indexes for equality searches

10 TDE Key Features Encryption/Decryption inside of the database Simple SQL Syntax: SQL> ALTER TABLE customers MODIFY (creditcardno ENCRYPT); Requires Advanced Security Option! Only with Oracle Enterprise Edition TDE Keys are managed by Oracle Protects unauthorized access to database on file system level/ OS level

11 TDE Key Features Simply and easy encryption of sensitive data views or triggers are NOT needed Protects confidential data without the overhead of key management Data on disk is encrypted, but decryption is transparent for the application

12 Overview the Big Picture Oracle Advanced Security Strong Authentication Data Automatically Decrypted Through SQL Interface Oracle Advanced Security Network Encryption Data Written To Disk Automatically Encrypted Oracle Advanced Security Transparent Data Encryption Data Encrypted On Backup Files

13 Separation of duties DBA starts up Database Wallet password is separate from System or DBA password No access to wallet Security DBA opens wallet containing master key

14 Master key and column keys Column keys encrypted by master key Master key stored in PKCS#12 wallet Security DBA opens wallet containing master key Column keys encrypt data in columns

15 Transparent Data Encryption Configuration steps 5 steps to setup TDE: 1. Identify tables and columns containing sensitive data 2. Does TDE support the datatype of the column? 3. Is column part of a foreign key? (should not be relevant in SAP environments) 4. Setup and initialize Wallet and Master Key 5. Encrypt existing data and new data in encrypted table column

16 D E M O N S T R A T I O N Transparent Data Encryption (TDE)

17 Prepare the Database Create a wallet and generate the master key alter system set key identified by e3car61 Open the wallet: alter system set wallet open identified by e3car61

18 Encrypting columns Encrypt a column in an existing table: alter table credit_rating modify (person_id encrypt); Create a new table with an encrypted column: create table orders ( order_id number(12), customer_id number(12), credit_card varchar2(16) encrypt);

19 Which algorithms are used? Default: AES with 192 bits: alter table credit_rating modify (person_id encrypt) Example with other algorithms: create table employee ( first_name varchar2(64), last_name varchar2(64), empid NUMBER encrypt using AES256, salary NUMBER(6) encrypt using AES256 )

20 TDE Available Algorithms Triple DES (Data Encryption Standard) 3DES168 AES (Advanced Encryption Standard) AES128 AES192 (default) AES256

21 Performance? Equality searches possible when not salted Alter table credit_rating modify (person_id encrypt no salt) Encrypt person_id Create index person_id_idx on credit_rating (PERSON_ID) Select score from credit_rating where PERSON_ID='235901';

22 Performance? Equality searches possible when not salted Alter table credit_rating modify (person_id encrypt no salt) Create index over encrypted column Create index person_id_idx on credit_rating (PERSON_ID) Select score from credit_rating where PERSON_ID='235901';

23 Performance? Equality searches possible when not salted Alter table credit_rating modify (person_id encrypt no salt) Create index person_id_idx on credit_rating (PERSON_ID) Select score from credit_rating where PERSON_ID='235901'; Application remains unchanged

24 Transparent Data Encryption Overhead Storage Bytes per row per encrypted column Performance ~5% Very customer/system specific Depends on # tables Size of tables How tables are accessed

25 Transparent Data Encryption SALT vs. NO SALT SALT A random string is added to clear text before it is encrypted Multiple occurences of same clear text appear different when encrypted with salt Increased security Against pattern matching attack from hackers But: encrypted columns which are part of an index must be encrypted with NO SALT

26 Transparent Data Encryption Change Wallet Password Wallet password is independent from master key Column keys SYSTEM password SYS password Wallet manager supports password policy At least 8 characters Must contain number or special characters

27 Transparent Data Encryption Export of table data Export of encrypted data is only supported with data pump: Using exp utility: EXP-00107: Feature (string) of column string in table string.string is not supported. The table will not be exported. Using expdp data pump without encryption password: ORA-39173: Encrypted data has been stored unencrypted in dump file set. Using expdp data pump with encryption password: OK

28 TDE Administration SQL> desc dba_encrypted_columns Name Null? Type OWNER NOT NULL VARCHAR2(30) TABLE_NAME NOT NULL VARCHAR2(30) COLUMN_NAME NOT NULL VARCHAR2(30) ENCRYPTION_ALG VARCHAR2(29) SALT VARCHAR2(3)

29 Transparent Data Encryption When you loose your wallet Loosing your wallet is the most secure way to delete your data A wallet can not be recovered (even with the same wallet password) Wallet password and master key are not related Recommendation: backup your wallet frequently After change of wallet password After change of master key After column rekey Perform change of master key (master rekey) offline

30 Re-key the master key Security policy might require periodic update Command: alter system set key identified by 2naf1sh Password and master key are independent Re-encrypts all column keys

31 Re-keying the column keys Without changing the encryption algorithm: ALTER TABLE employee REKEY; Re-key the column key and change the algorithm: ALTER TABLE employee REKEY USING 'AES256'; Change the algorithm, without re-keying the column keys: ALTER TABLE employee ENCRYPT USING 'AES128';

32 TDE and Data Guard Production Database Physical Standby Data Encrypted On Backup Files Redo apply redo logs contain encrypted data

33 Supported data types varchar2 nvarchar2 number date binary_float (*) binary_double (*) timestamp raw char nchar interval day to second interval year to month

34 TDE - Unsupported data types LONG/LONG RAW LOB/BLOB SQL> create table test (c1 long encrypt) * ORA-28330: encryption is not allowed for this data type

35 TDE - Unsupported database features Materialized View logs Streams Sync and async CDC (Change Data Capture) Direct path insert LOBs Transportable Tablespaces

36 TDE - restrictions Transparent Data Encryption does not work with the following database features Index types other than B-tree Range scan search through an index Large object datatypes such as BLOB and CLOB Original import/export utilities Other database tools and utilities that directly access data files

37 How Oracle Advanced Security helps with CISP/PCI Section 3.4: Render sensitive cardholder information unreadable anywhere it is stored Transparent Data Encryption, part of the Oracle Advanced Security Option, encrypts any column with 3DES 128 bit or AES256, as required. Both TDE and Network Encryption, part of the Oracle Advanced Security Option, provide SHA-1 for hashing

38 How Oracle Advanced Security helps with CISP/PCI Section 3.5 (incl and ): Protect encryption keys against both disclosure and misuse, restrict access and store securely. Transparent Data Encryption stores the master key in the Oracle Wallet, and the encrypted column keys in the database Intruder would need access to OS file to get to wallet and database access to get to encrypted column keys.

39 How Oracle Advanced Security helps with CISP/PCI Section 4: Encrypt transmission of cardholder and sensitive information across public networks: Network Encryption, part of ASO, provides encryption of all traffic between Oracle Database and Oracle Application Server

40 Transparent Data Encryption Recommendations Do not misuse TDE as an authorization methode Do not encrypt all your data only data which needs to be protected

41 Transparent Data Encryption Recommendations (cont d) NEVER LOOSE YOUR WALLET!! WITHOUT WALLET DATA LOSS BACKUP YOUR WALLET!! WITHOUT CURRENT WALLET DATA LOSS NEVER FORGET YOUR WALLET PASSWORD! WITHOUT WALLET PASSWORD DATA LOSS

42 Transparent Data Encryption Recommendations (cont d) Rekey Operations Rekey master key: how often? Depends on regulations (SB1386, Sarbanes-Oxley) Regularly, but not too often (~once a year) Maximum number of TDE master keys is limited due to limited wallet size : max wallet size=64k (~240 master keys) : max wallet size=4m (>15M ) Rekey column Key: depending on your regulations Full table update

43 Transparent Data Encryption Recommendations (cont d) Wallet Management One Encryption Wallet per Database Do not use autologin wallet No support for multiple encryption_wallet_location Only one wallet location in sqlnet.ora

44 TDE in an SAP environment TDE Candidates Do NOT encrypt tables belonging to SAP core application SAP system should be startable without wallet Do not encrypt tables used by BR*Tools Do not encrypt all tables (~100 should be enough) When column is used in an index non-salted

45 TDE Support in SAP BR*TOOLS ENCRYPTION_WALLET_LOCATION parameter must be configured in sqlnet.ora to override Oracle default path Location of encryption wallet in SAP environment: $ORACLE_HOME/dbs (Unix) %ORACLE_HOME%\database (Windows) BR*Tools support backup and restore of Encryption wallet ewallet.p12 Prerequisite: encryption wallet exists in $ORACLE_HOME/dbs resp. %ORACLE_HOME%\database Auto-Login encryption wallet (cwallet.sso, if exist) will not get backed up by BR*Tools

46 TDE Support in SAP Dictionary No support for TDE in SAP dictionary at the moment

47 Alternate Solutions Instead of using TDE encryption you could also use one of the following options: RMAN Backup Encryption (ASO required) currently under evaluation RMAN now creates encrypted backups that cannot be restored by unauthorized people Oracle Secure Backup (OSB) OSB provides an optimized, highly efficient tape backup solution for the Oracle Database. OSB can store data on tape in encrypted form, providing protection against theft of backup tapes.

48 Oracle Secure Backup Integrated tape backup: Oracle Database Operating system files Encryption of data to tape Data at-rest protection Tape data protection at the lowest cost Oracle Databases RMAN File System Data UNIX Windows Linux NAS Oracle Secure Backup Centralized Tape Backup Management

49 Why Oracle Secure Backup? Encryption of data to tape Protects against misuse of business data Oracle Database manages encryption keys Certificate based authentication Outside parties cannot impersonate host Reduces cost of secure tape backups Only $3,000 per tape device Runs on Linux, Windows & UNIX Supports over 200 tape devices

50 RMAN Backup Encryption Oracle Recovery Manager (RMAN) Oracle Default Tool for Database Backups To Disk or Tape (MML) Encryption of Backup Advanced Encryption Standard (AES) Authentication: via userdefined password or via Oracle Wallet ASO required RMAN Database Area Media Management Layer Flash Recovery Area DIGITAL DATA STORAGE DIGITAL DATA STORAGE DIGITAL DATA STORAGE

51 TDE OSB RMAN Backup Encryption TDE Encryption of sensible data in database files on OS/file system level Encryption of sensible data in backups (disk and tape) Encryption of sensible data in archive logs (LogMiner) ASO license required Oracle Secure Backup (OSB) Encryption of backups to tape only (not backup to disk) No encryption of sensible data in database files No encryption of sensible data in archive logs Requires separate OSB license RMAN Backup Encryption (ASO required) Encryption of backups to disk and to tape No encryption of sensible data in database files No encryption of sensible data in archive logs ASO license required

52 For More Information Transparent Data Encryption Advanced Security Oracle Database Security Checklist or

53 SAP Notes : Transparent Data Encryption : Network Encryption

54 Oracle Metalink Notes Note : 10g R2 New Feature TDE: Transparent Data Encryption Note : How to Export/Import with Data Encrypted with Transparent Data Encryption (TDE)

55 Oracle Technology Network Oracle Database 10g index.html Oracle Database Security Oracle Advanced Security Oracle Advanced Security Transparent Data Encryption TDE

56 Oracle Technology Network TDE Frequently Asked Questions (FAQ) ASO Data Sheet df Oracle Secure Backup Oracle Security Checklist twp_security_checklist_db_database.pdf

57 DOAG e.v. Server Deutsche ORACLE-Anwendergruppe e.v. Special Interest Days: Oracle + SAP

58 TDE Pilot Customers Wanted

59

60