Oracle 透明数据加密未解密访问
我能否以以下所有陈述都成立的方式设置 Oracle 数据库
a) 某些列（可能是所有列）都已加密，以便对数据库文件的直接文件访问不会允许攻击者检索任何记录
b)加密列对于授权用户透明地解密，其中授权发生，例如通过具有一定的角色或权限
c) 具有执行“正常”管理任务的适当权限的管理员（调整、创建/删除模式对象、重新启动数据库、从数据字典）可以选择表，但只能看到加密列中的加密数据。
如果这是可能的，我该怎么做。如果不可能，我必须采取哪些选择才能至少“接近”这些要求？
a)+b) 似乎可以使用 Oracle 透明数据加密，但我不确定 c)
Can I set up an Oracle Database in a way that all of the following statements are true
a) certain columns, potentially all columns are encrypted, so that direct file access to the database file wouldn't allow an attacker to retrieve any records
b) the encrypted columns are transparently decrypted for authorized user, where authorization happens e.g. by having a certain role or privilege
c) an admin who has suiteable privileges for doing 'normal' admin tasks (tuning, creating/droping schema objects, restarting database, selecting from data dictionary) can select the tables but will see only encrypted data in the encrypted columns.
If this is possible, how do I do it. If it is not possible, what are the options I have to at least get 'close' to these requirements?
a)+b) seem to be possible with Oracle Transparent Data Encryption, but I am not sure about c)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
透明数据加密仅执行 (a)。它是为了防止由于有人窃取硬盘或备份或针对 DBF 文件运行
字符串而发生数据泄露。这仍然很有用，因为它可以防止您的系统管理员使用其特权操作系统访问来绕过所有数据库安全性。如果您想强制实施类似 (b) 的技术，则适当的技术是虚拟专用数据库 - DBMS_RLS< /a> 与企业版或 Oracle Label Security（如果您有额外的）执照。
如果您想实现 (c)，您将需要 Oracle 的 Database Vault 产品，这又是企业许可证之外的额外收费。
由于 TDE 需要高级安全选项，这些选项相当于 EE 许可证的 75%(*) 附加费。在这种情况下，您不妨孤注一掷，购买 Audit Vault
(*) 如果您购买 Label Security，则只需 50%。
Transparent Data Encryption only does (a). It is about preventing data breaches occuring because somebody stole the hard drive or backups, or ran
stringsagainst the DBF files. That's still useful, because it prevents your sysadmins using their privileged OS access to bypass all your database security.If you want to enforce something like (b) the appropriate technology is the virtual private database - either DBMS_RLS with the Enterprise Edition or Oracle Label Security if you have the additional license.
If you want to implement (c) you will need Oracle's Database Vault product, which is again a chargeable extra on top of the Enterprise License.
As TDE requires the Advanced Security Option these options amount to a 75%(*) surcharge on the EE license. In which case you might as well go for broke and buy Audit Vault as well!
(*) Only 50% if you buy Label Security.