Database Encryption with DataSecure. Appendix: Demo. Professional Services EMEA Insert Date Sept. 2011

Transcription

1 Database Encryption with DataSecure Appendix: Demo Insert Andreas Your Gatz Name Principal Insert Your Consultant Title Professional Services EMEA Insert Date Sept. 2011

2 Agenda Demo Oracle customer table with CCnum, unencrypted Some relevant DataSecure GUI slides Encrypt column CCnum in table customer Display results in Oracle SQL Developer Check dbuser seeing CCnums in clear Check user sys not seeing CCnums any more Rotate key Logging Cluster Configuration Administrator Configuration Backup / Restore Menus 2

3 Customer Table Columns (as dbuser) 3

4 Customer Table Data 4

5 User Configuration 5

6 Key Configuration 6

7 Database Definitions 7

8 Database Configuration 8

9 User Mapping 9

10 Select a Table 10

11 Select a Column 11

12 Define Column Properties 12

13 Data Migration 13

14 Data Migration 14

15 Data Migration 15

16 Data Migration 16

17 Data Migration 17

18 Column encrypted 18

19 Delete Old Data 19

20 Delete Old Data 20

21 Delete Old Data 21

22 Delete Old Data done 22

23 Customer Table in DataSecure Metadata 23

24 User Mapping in DataSecure Metadata 24

25 As dbuser: select * from dbuser.customer; 25

26 As sys: select * from dbuser.customer; Not allowed as user sys is not a mapped user 26

27 Some DML SQL for Table customer INSERT INTO customer (first,last,ccnum) VALUES ('Charly','Chaplin',' ') SELECT * FROM CUSTOMER WHERE last = 'Chaplin'; delete from CUSTOMER where CUSTOMER.last = 'Chaplin'; SELECT * FROM CUSTOMER WHERE CCNUM = ' '; 27

28 For like Queries Oracle Domain Index 28

29 Generate a Rotate Key 29

30 Rotate Encryption Key 30

31 Rotate Encryption Key 31

32 Generated SQL statement SELECT ING_ROW_ID, "CCNUM_NEW" FROM "DBUSER"."CUSTOMER_NEW" WHERE ( CCNUM_NEW IS NOT NULL ) ORDER BY ING_ROW_ID UPDATE "DBUSER"."CUSTOMER_NEW" SET "CCNUM_ROTATE" =? where ING_ROW_ID =? ALTER TABLE "DBUSER"."CUSTOMER_NEW" ADD ( CCNUM_ROTATE RAW(32) DEFAULT NULL) CREATE OR REPLACE TRIGGER "DBUSER"."CUSTOMER_INS_TRIG" INSTEAD OF INSERT ON "DBUSER"."CUSTOMER_IDV" REFERENCING NEW AS NEW OLD AS OLD FOR EACH ROW DECLARE CHECK_2 NCHAR(32); BEGIN SELECT :NEW."CCNUM" INTO CHECK_2 FROM DUAL; INSERT INTO "DBUSER"."CUSTOMER_NEW" ("FIRST","LAST","CCNUM","CCNUM_NEW","CCNUM_ROTATE","ING_ROW_ID" ) VALUES ( :NEW."FIRST",:NEW."LAST",' ',ingrian.ingfastencryptrawbyname(ingrian.ingnstringtoraw(:new."ccnum"), 'DBUSER', 'CUSTOMER:4', 'CCNUM', '9849E1563DEF82AEB7C46E64A82FACCF', HEXTORAW('0'), HEXTORAW('0')),ingrian.ING_E_NCR_Cl430(:NEW."CCNUM", 'dbkey_rotate', 'AES/CBC/NoPadding','9849E1563DEF82AEB7C46E64A82FACCF'),"DBUSER".ING_SEQ_2.NEXTVAL ); END; CREATE OR REPLACE TRIGGER "DBUSER"."CUSTOMER_UPD_TRIG" INSTEAD OF UPDATE ON "DBUSER"."CUSTOMER_IDV" REFERENCING NEW AS NEW OLD AS OLD FOR EACH ROW DECLARE CHECK_2 NCHAR(32); BEGIN SELECT :NEW."CCNUM" INTO CHECK_2 FROM DUAL; UPDATE "DBUSER"."CUSTOMER_NEW" SET "FIRST" = :NEW."FIRST", "LAST" = :NEW."LAST", "CCNUM_NEW" = decode (:NEW."CCNUM", :OLD."CCNUM", "CCNUM_NEW", ingrian.ingfastencryptrawbyname(ingrian.ingnstringtoraw(:new."ccnum"), 'DBUSER', 'CUSTOMER:4', 'CCNUM', '9849E1563DEF82AEB7C46E64A82FACCF', HEXTORAW('0'), HEXTORAW('0')) ), "CCNUM_ROTATE" = decode (:NEW."CCNUM", :OLD."CCNUM", "CCNUM_ROTATE", ingrian.ing_e_ncr_cl430(:new."ccnum", 'dbkey_rotate', 'AES/CBC/NoPadding','9849E1563DEF82AEB7C46E64A82FACCF') ) WHERE ING_ROW_ID = :OLD.ING_ROW_ID; END; SELECT ING_ROW_ID, "CCNUM_NEW" FROM "DBUSER"."CUSTOMER_NEW" WHERE ( CCNUM_NEW IS NOT NULL ) ORDER BY ING_ROW_ID UPDATE "DBUSER"."CUSTOMER_NEW" SET "CCNUM_ROTATE" =? where ING_ROW_ID =? LOCK TABLE "DBUSER"."CUSTOMER_NEW" IN EXCLUSIVE MODE ALTER TABLE "DBUSER"."CUSTOMER_NEW" DROP ( CCNUM_NEW ) LOCK TABLE "DBUSER"."CUSTOMER_NEW" IN EXCLUSIVE MODE ALTER TABLE "DBUSER"."CUSTOMER_NEW" RENAME COLUMN CCNUM_ROTATE TO CCNUM_NEW CREATE OR REPLACE VIEW "DBUSER"."CUSTOMER_IDV" AS SELECT "FIRST", "LAST", CAST (ingrian.ingfastdecryptop("ccnum_new", 'DBUSER', 'CUSTOMER_NEW:5', 'CCNUM_NEW', '9849E1563DEF82AEB7C46E64A82FACCF', hextoraw('0'), hextoraw('0')) AS NCHAR(16)) "CCNUM", "ING_ROW_ID" FROM "DBUSER"."CUSTOMER_NEW" CREATE OR REPLACE TRIGGER "DBUSER"."CUSTOMER_INS_TRIG" INSTEAD OF INSERT ON "DBUSER"."CUSTOMER_IDV" REFERENCING NEW AS NEW OLD AS OLD FOR EACH ROW DECLARE CHECK_2 NCHAR(32); BEGIN SELECT :NEW."CCNUM" INTO CHECK_2 FROM DUAL; INSERT INTO "DBUSER"."CUSTOMER_NEW" ("FIRST","LAST","CCNUM","CCNUM_NEW","ING_ROW_ID" ) VALUES ( :NEW."FIRST",:NEW."LAST",'',ingrian.IngFastEncryptRawByName(ingrian.IngNStringToRaw(:NEW."CCNUM"), 'DBUSER', 'CUSTOMER:5', 'CCNUM', '9849E1563DEF82AEB7C46E64A82FACCF', HEXTORAW('0'), HEXTORAW('0')),"DBUSER".ING_SEQ_2.NEXTVAL ); END; CREATE OR REPLACE TRIGGER "DBUSER"."CUSTOMER_UPD_TRIG" INSTEAD OF UPDATE ON "DBUSER"."CUSTOMER_IDV" REFERENCING NEW AS NEW OLD AS OLD FOR EACH ROW DECLARE CHECK_2 NCHAR(32); BEGIN SELECT :NEW."CCNUM" INTO CHECK_2 FROM DUAL; UPDATE "DBUSER"."CUSTOMER_NEW" SET "FIRST" = :NEW."FIRST", "LAST" = :NEW."LAST", "CCNUM_NEW" = decode (:NEW."CCNUM", :OLD."CCNUM", "CCNUM_NEW", ingrian.ingfastencryptrawbyname(ingrian.ingnstringtoraw(:new."ccnum"), 'DBUSER', 'CUSTOMER:5', 'CCNUM', '9849E1563DEF82AEB7C46E64A82FACCF', HEXTORAW('0'), HEXTORAW('0')) ) WHERE ING_ROW_ID = :OLD.ING_ROW_ID; END; 32

33 Rotate Encryption Key done 33

34 Logging 34

35 Logging 35

36 Logging 36

37 Logging 37

38 Logging 38

39 Logging 39

40 Create Cluster 40

41 Admin Config 41

42 Backup 42

43 Backup 2 43

44 Backup 3 44

45 Backup 4 45

46 Restore 46

47 FIPS 47

48 eof 48