Encrypting Individual Table Columns

The decisions that you make when you identify columns to be encrypted are determined by governmental security regulations, such as California Senate Bill 1386, or by industry standards such as the . Credit card numbers, Social Security numbers, and other personally identifiable information (PII) fall under this category. Another need for encryption is defined by your own internal security policies — trade secrets, research results, or employee salaries and bonuses. See "When Should You Encrypt Data?" for guidelines about when and when not to encrypt data.

Follow these guidelines when you select columns to encrypt:

• Check the data types of the columns you plan to encrypt. Transparent data encryption supports the following data types:

  	BINARY_FLOAT	NUMBER
  	BINARY_DOUBLE	NVARCHAR2
  	CHAR	RAW
  	DATE	TIMESTAMP
  	NCHAR	VARCHAR2

  
  

• Ensure that the columns you select are not part of a foreign key. With transparent data encryption, each table has its own encryption key, which is stored in the database data dictionary and encrypted with the external master key. Encrypted columns cannot be used as foreign keys.

To encrypt a column in a table:  

1. Ensure that you have created and opened a wallet key.

   "Step 2: Create the Wallet" explains how to create a wallet key. To open an existing wallet key, see "Step 3: Open (or Close) the Wallet".

2. Start Database Control.

   See Accessing the Database Home Page for instructions about how to start Database Control.

3. Enter an administrator user name (for example, SYSTEM, or the name of a security administrator) and password, and then click Login.

   The Database Home page appears.

4. Click Schema to display the Schema subpage.

5. Under Database Objects, select Tables.

   The Tables page appears.

6. Do one of the following:

   • To create a new table, click Create, and then answer the questions in the subsequent page to start creating the table.

   • To modify an existing table, search for the table name by entering its schema name into the Schema field and the table name in the Object Name field. (You can use the percent sign (%) wildcard character to search for a group of tables, for example O% to find all tables beginning with the letter O.) When the table is listed in the Tables page, select the table, and then click Edit.

   In the Create Table or Edit Table page, you can set its encryption options.

7. In the Create Table (or Edit Table) page, do the following:

   1. Select the column that you want to encrypt.

      Do not select columns that are part of a foreign key constraint (primary or unique key columns). You cannot encrypt these columns. These columns are indicated with a key or check mark icon to the left of their names.

   2. Click Encryption Options to display the Encryption Options for the Table page.

   3. From the Encryption Algorithm list, select from the following options:

      • AES192: Sets the key length to 192 bits. AES is the abbreviation for Advanced Encryption Standard.

      • 3DES168: Sets the key length to 168 bits. 3DES is the abbreviation for Triple Data Encryption Standard.

      • AES128: Sets the key length to 128 bits. This option is the default.

      • AES256: Sets the key length to 256 bits.

   4. Under Key Generation, select either Generate Key Randomly or Specify Key. If you select Specify Key, enter characters for the seed values in the Enter Key and Confirm Key fields.

      The Generate Key Randomly setting enables salt. Salt is a way to strengthen the security of encrypted data. It is a random string added to the data before it is encrypted, causing the same text to appear different when encrypted. Salt removes one method attackers use to steal data, namely, matching patterns of encrypted text.

   5. Click Continue to return to the Create Table (or Edit Table) page.

   6. Enable encryption for the column by selecting its box under Encrypted.

8. Click Continue.

   The Create Table (or Edit Table) page appears.

While a table is being updated, read access is still possible. Afterward, existing and future data in the column is encrypted when it is written to the database file, and it is decrypted when an authorized user selects it. If data manipulation language (DML) statements are needed, you can use online redefinition statements.