tablespace Encryption Convert Default 表空间加密 数据文件并行加密

 三个命令一样，其实加密就是加密的datafile 头

 CREATE TABLESPACE tps_sec ENCRYPTION DEFAULT STORAGE (ENCRYPT);
 create tablespace test  encryption   using 'AES256' DEFAULT STORAGE (ENCRYPT);
  create tablespace test  encryption   using 'AES256'  ENCRYPT ;
 

To check tablespaces which are in 'Encrypting' status:
SQL>SELECT t.name, e.encryptedts, e.status FROM v$tablespace t, v$encrypted_tablespaces e WHERE t.ts#=e.ts# ;

To check the encryption status of data files in a tablespace:
SQL>select tablespace_name,name,encrypted from v$datafile_header where tablespace_name like '%%';

2) Encrypt any unencrypted datafiles for the affected tablespace on the standby side.
SQL> alter database datafile '/xxxx.dbf' encrypt;

------tablespace加密就是datafile 加密

SQL>  alter database datafile 'AFD49375AE0530B15D70A74FE/DATAFILE/test.47817.1207269161' encrypt;
alter database datafile 

ORA-28440: cannot offline encrypt or decrypt data file 4174 - file is in use or recovery
 

SQL>  alter tablespace test OFFLINE;

SQL> alter database datafile 'AAFD49375AE0530B15D70A74FE/DATAFILE/test.47817.1207269161' encrypt;

Database altered

SQL>  select tablespace_name,name,encrypted from v$datafile_header where tablespace_name like 'TEST';

TABLESPACE_NAME                NAME                                                                             ENCRYPTED
------------------------------ -------------------------------------------------------------------------------- ---------

SQL>  alter tablespace test  online;

SQL> SELECT NAME, ENCRYPTIONALG ENCRYPTEDTS ,status FROM V$ENCRYPTED_TABLESPACES, V$TABLESPACE WHERE V$ENCRYPTED_TABLESPACES.TS# = V$TABLESPACE.TS#;

TEST                           AES128      ENCRYPTING
 

------可以一半加密，一半未加密

SQL>  alter tablespace test OFFLINE;

SQL>  alter database datafile '49375AE0530B15D70A74FE/DATAFILE/test.81688.1207269189' encrypt;

SQL> SELECT NAME, ENCRYPTIONALG ENCRYPTEDTS ,status FROM V$ENCRYPTED_TABLESPACES, V$TABLESPACE WHERE V$ENCRYPTED_TABLESPACES.TS# = V$TABLESPACE.TS#  and name='TEST';

NAME                           ENCRYPTEDTS STATUS
------------------------------ ----------- ----------

SQL>  alter tablespace test  online;

SQL> SELECT NAME, ENCRYPTIONALG ENCRYPTEDTS ,status FROM V$ENCRYPTED_TABLESPACES, V$TABLESPACE WHERE V$ENCRYPTED_TABLESPACES.TS# = V$TABLESPACE.TS#  and name='TEST';

NAME                           ENCRYPTEDTS STATUS
------------------------------ ----------- ----------
TEST                           AES128      NORMAL

------tablespace加密就是datafile 加密

create tablespace test ;
create tablespace test  encryption   using 'AES256' ENCRYpt;
drop tablespace test including contents and datafiles;

 
SQL> ALTER SYSTEM SET "_TABLESPACE_ENCRYPTION_DEFAULT_ALGORITHM"='AES256' SCOPE=BOTH;
SQL> create tablespace test  encryption encrypt;
SQL> SELECT NAME, ENCRYPTIONALG ENCRYPTEDTS FROM V$ENCRYPTED_TABLESPACES, V$TABLESPACE WHERE V$ENCRYPTED_TABLESPACES.TS# = V$TABLESPACE.TS#;
SQL> alter tablespace test OFFLINE;
SQL> ALTER TABLESPACE test ENCRYPTION OFFLINE USING 'AES256' ENCRYPT;

SQL> ALTER TABLESPACE test ONLINE;

SQL> SELECT NAME, ENCRYPTIONALG ENCRYPTEDTS FROM V$ENCRYPTED_TABLESPACES, V$TABLESPACE WHERE V$ENCRYPTED_TABLESPACES.TS# = V$TABLESPACE.TS#;

NAME ENCRYPT
------------------------------ -------
test AES256
TBS256 AES256

ALTER TABLESPACE test ENCRYPTION OFFLINE USING 'AES256' ENCRYPT;---need to offline first
ALTER TABLESPACE test ENCRYPTION online USING 'AES256' ENCRYPT; 

没有online 也是online，毕竟没有offline tablespace

-----online can not monitot

alter session set nls_date_format='yyyy-mm-dd hh24:mi:ss';
alter session set nls_timestamp_format='yyyy-mm-dd hh24:mi:ss';
SELECT sid, serial#, start_time, timestamp, message
FROM V$SESSION_LONGOPS WHERE OPNAME like 'TDE%'
order by timestamp;

-----
 

ALTER TABLESPACE test ENCRYPTION ONLINE FINISH ENCRYPT;

SQL> select ts#,ENCRYPTIONALG,KEY_VERSION,STATUS from v$encrypted_tablespaces;

       TS# ENCRYPT KEY_VERSION STATUS
---------- ------- ----------- ----------
         8 AES256            1 ENCRYPTING<<<<<<<<<<<<<<<<<<<
         6 AES256            1 NORMAL
         4 AES256            1 NORMAL

SQL> select name,TS# from V$tablespace;

NAME                                                                                                        TS#
---------------------------------------------------------------------------------------------------- ----------
SYSAUX                                                                                                        1
SYSTEM                                                                                                        0

SQL> ALTER TABLESPACE test ENCRYPTION ONLINE FINISH ENCRYPT;

 

----parallel

Therefore if a tablespace is successfully online and show encrypted, all datafiles in this tablespace are encrypted.

For example:

SQL> create tablespace tbs1 datafile 'tbs11.f' size 10m;

Tablespace created.

SQL> alter tablespace tbs1 add datafile 'tbs12.f' size 10m;

Tablespace altered.

SQL> alter tablespace tbs1 offline;

Tablespace altered.

SQL> alter database datafile 'tbs11.f' encrypt;

Database altered.

SQL> alter tablespace tbs1 online;
alter tablespace tbs1 online
*
ERROR at line 1:
ORA-28433: mismatched encryption property between data file
/xxx/b/xxxxxxx/xxxxx/dbs/tbs12.f and tablespace TBS1

In alert log:

alter tablespace tbs1 online
Wed Oct 03 11:27:50 2018
Verifying datafile and tablespace encryption: tablespace TBS1 should be encrypted, but found datafile /xx/b/xxxxxxx/xxxxx/dbs/tbs12.f to be unencrypted. Please encrypt this datafile.
ORA-28433 signalled during: alter tablespace tbs1 online...

SQL> alter database datafile 'tbs12.f' encrypt;

--------------多个datafile 可以并行encrypt-------------------------

Database altered.

SQL> alter tablespace tbs1 online;

Tablespace altered.

SQL> select tablespace_name, status, encrypted from dba_tablespaces where tablespace_name='TBS1';

TABLESPACE_NAME STATUS ENC
------------------------------ --------- ---
TBS1 ONLINE YES

--------------------

Goal

According to the documentation

Configuring Transparent Data Encryption

The TABLESPACE_ENCRYPTION_DEFAULT_ALGORITHM applies to specific encryption scenarios.

These scenarios are as follows:

• Encryption commands that do not allow to specify the encryption algorithm
• New tablespaces that are created without the encryption syntax
• The encryption algorithm for the SYSTEM tablespace

 

Solution

• For new tablespaces :

Example:

SQL> ALTER SYSTEM SET "_TABLESPACE_ENCRYPTION_DEFAULT_ALGORITHM"='AES256' SCOPE=BOTH;

System altered.

SQL> create tablespace tbs256 datafile '/u01/.../tbs256.dbf' size 10m encryption encrypt;

Tablespace created.

SQL> SELECT NAME, ENCRYPTIONALG ENCRYPTEDTS FROM V$ENCRYPTED_TABLESPACES, V$TABLESPACE WHERE V$ENCRYPTED_TABLESPACES.TS# = V$TABLESPACE.TS#;

NAME ENCRYPT
------------------------------ -------
TBS256 AES256

• For existing tablespaces :

SQL> alter tablespace TDE_DATA OFFLINE;

Tablespace altered.


SQL> ALTER TABLESPACE TDE_DATA ENCRYPTION OFFLINE USING 'AES256' ENCRYPT;

Tablespace altered.

SQL> ALTER TABLESPACE TDE_DATA ONLINE;

Tablespace altered.


SQL> SELECT NAME, ENCRYPTIONALG ENCRYPTEDTS FROM V$ENCRYPTED_TABLESPACES, V$TABLESPACE WHERE V$ENCRYPTED_TABLESPACES.TS# = V$TABLESPACE.TS#;

NAME ENCRYPT
------------------------------ -------
TDE_DATA AES256
TBS256 AES256

How To Monitor The Progress Of Offline Tablespace Encryption (Doc ID 2933664.1)

Goal

This document describes how to monitor the progress of offline tablespace encryption, for example:

ALTER TABLESPACE users ENCRYPTION OFFLINE USING 'AES256' ENCRYPT;

 

Solution

To monitor the progress of offline tablespace encryption, check v$session_longops.message column.

Message like below is updated with the progress of encryption.

TDE data file conversion: data file 5: 879755264 out of 1426980864 bytes done

Here is a sample query:

alter session set nls_date_format='yyyy-mm-dd hh24:mi:ss';
alter session set nls_timestamp_format='yyyy-mm-dd hh24:mi:ss';
SELECT sid, serial#, start_time, timestamp, message
FROM V$SESSION_LONGOPS WHERE OPNAME like 'TDE%'
order by timestamp;

-----

The goal of this document to startover or finish the terminated online OMF managed tablespace encryption command.

Solution

File system full or abnormal database process(pmon) termination will terminate the in-progress online tablespace encryption. We can start the encryption again using alter tablespace tsname encryption online finish encrypt post fixing the file system space issue.

Example Encryption command:
##########################

ALTER TABLESPACE APP_TS ENCRYPTION ONLINE FINISH ENCRYPT;



############## completion of encryption tablespace command ###########

SQL>
SQL> select ts#,ENCRYPTIONALG,KEY_VERSION,STATUS from v$encrypted_tablespaces;

       TS# ENCRYPT KEY_VERSION STATUS
---------- ------- ----------- ----------
         8 AES256            1 ENCRYPTING<<<<<<<<<<<<<<<<<<<
         6 AES256            1 NORMAL
         4 AES256            1 NORMAL

SQL>
SQL>
SQL> select name,TS# from V$tablespace;

NAME                                                                                                        TS#
---------------------------------------------------------------------------------------------------- ----------
SYSAUX                                                                                                        1
SYSTEM                                                                                                        0
UNDOTBS1                                                                                                      2
USERS                                                                                                         4
TEMP                                                                                                          3
PART_PROFILE_TBS02                                                                                            6
APP_TS                                                                                                        8

7 rows selected.

SQL>

SQL>
SQL> ALTER TABLESPACE APP_TS ENCRYPTION ONLINE FINISH ENCRYPT;

Tablespace altered.

SQL>
SQL>
SQL> select ts#,ENCRYPTIONALG,KEY_VERSION,STATUS from v$encrypted_tablespaces;

       TS# ENCRYPT KEY_VERSION STATUS
---------- ------- ----------- ----------
         8 AES256            1 NORMAL
         6 AES256            1 NORMAL
         4 AES256            1 NORMAL

SQL>
SQL>


Review alert.log for detailed review of background processing of above command.