Configuring the WALLET_ROOT and TDE_CONFIGURATION parameters for the CDB environment is similar to the procedure used for united mode.

The difference is that rather than using the RESET clause of the ALTER SYSTEM statement, you use the SET clause. You can perform the configuration by adding the WALLET_ROOT and TDE_CONFIGURATION parameters to the initialization parameter file. To configure a PDB in isolated mode, you must set a value for the TDE_CONFIGURATION parameter of the PDB, which you can do either by using the ALTER SYSTEM statement or by issuing the ADMINISTER KEY MANAGEMENT ISOLATE KEYSTORE statement. This section focuses on the use of the ALTER SYSTEM statement.

Depending on whether your system uses pfile or spfile, you must set the SCOPE clause in the ALTER SYSTEM statement appropriately when setting the value of the TDE_CONFIGURATION parameter for the PDB. The value of the TDE_CONFIGURATION parameter is a list of attribute-value pairs, and it is the value of the KEYSTORE_CONFIGURATION attribute that specifies the type of the keystore, as follows:

• FILE specifies a software keystore

• OKV specifies an Oracle Key Vault external keystore)

• HSM specifies a hardware security module keystore

• FILE|OKV specifies a reverse-migration from the OKV keystore type to the FILE keystore type has occurred

• FILE|HSM specifies a reverse-migration from the HSM keystore type to the FILE keystore type has occurred

• OKV|FILE specifies a migration from the FILE keystore type to the OKV keystore type has occurred

• HSM|FILE specifies a migration from the FILE keystore type to the HSM keystore type has occurred. HSM|FILE has two meanings: it either means that you are migrating from FILE to HSM, or it means that the configuration started out as using an HSM but is now using an auto-login HSM configuration, where the credentials of the HSM reside in a cwallet.sso file on the file system.

After you have used ALTER SYSTEM to configure the TDE_CONFIGURATION value for the selected PDB, the PDB in the CDB environment is in isolated mode. The steps in this procedure explain in detail how to configure an individual PDB to be in isolated mode, using its own keystore type.

You can configure isolated mode by setting WALLET_ROOT in the initialization parameter file in the CDB root and TDE_CONFIGURATION in the PDB you want to isolate.

1. In the root, ensure that the WALLET_ROOT is set in the initialization parameter file, which by default is located in the $ORACLE_HOME/dbs directory. This directory must also be empty.
   For example:

   wallet_root=$ORACLE_BASE/admin/orcl/wallet

2. Connect to the isolated mode PDB as a user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
   For example:

   CONNECT sec_admin@pdb_name AS SYSKM

3. Run the ALTER SYSTEM statement to configure the TDE_CONFIGURATION parameter for the CDB environment.
   • If the CDB root and the PDB are open, then set SCOPE to both:

     ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=keystore_type" SCOPE=BOTH;

   • If the CDB root is open and the PDB is in the mount state, then set scope to spfile:

     ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=keystore_type" SCOPE=SPFILE;

   Oracle Database will create the TDE (FILE) and Oracle Key Vault (OKV) keystores in the following locations, based on the keystore type you choose:

   • FILE: $ORACLE_BASE/admin/orcl/wallet/pdb_guid/tde
   • OKV: $ORACLE_BASE/admin/orcl/wallet/pdb_guid/okv
4. Check the configuration.
   • To check the TDE_CONFIGURATION parameter setting:

     SHOW PARAMETER TDE_CONFIGURATION
     

     The output should reflect the keystore configuration that you set for the current PDB. If it shows a different keystore configuration (for example, FILE if you had set it to OKV), then the setting may be showing the keystore configuration that was set for the CDB root, in united mode.

   • To check the keystore mode:

     SELECT KEYSTORE_MODE FROM V$ENCRYPTION_WALLET;

     The output should be ISOLATED.

You can set TDE_CONFIGURATION if you have an older version of a control file that must be restored and only a few PDBs were configured in isolated mode.

When the CDB root and the PDB are both in the mount state, then you can only change the PDB’s keystore configuration from the CDB root.

1. Log in to the CDB root as a user who was granted the SYSDBA administrative privilege.

2. For each PDB that you want to change, use the following syntax:

   ALTER SYSTEM SET TDE_CONFIGURATION="CONTAINER=pdb_name;KEYSTORE_CONFIGURATION=keystore_type" SCOPE=memory;
   

   For example, for the hrpdb and salespdb PDBs using FILE (for software keystores) as the keystore type:

   ALTER SYSTEM SET TDE_CONFIGURATION="CONTAINER=hrpdb;KEYSTORE_CONFIGURATION=FILE" SCOPE=memory;
   ALTER SYSTEM SET TDE_CONFIGURATION="CONTAINER=salespdb;KEYSTORE_CONFIGURATION=FILE" SCOPE=memory;
   

3. After you set the TDE_CONFIGURATION parameter for each PDB, log in to the CDB root and then set TDE_CONFIGURATION for the CDB root itself.

   ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=FILE";

   At this stage, CDB root is in the mounted state. The value of the TDE_CONFIGURATION parameter that was set using ALTER SYSTEM with the CONTAINER attribute is only present in the memory of the CDB root. To ensure that the configuration is properly applied to each PDB, you must close and then reopen the PDB. When an isolated mode PDB is opened, the configuration set by the ALTER SYSTEM statement that was issued in the CDB root is read from the control file and then is automatically applied to the PDB.

4. Connect to each PDB and then close and reopen the PDB.

   ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
   ALTER PLUGGABLE DATABASE pdb_name OPEN;

You can address the problem of a lost control file by using the ALTER SYSTEM statement.

Running these statements with SCOPE set to memory will store the CONTAINER value in memory. When you open the isolated PDB, this configuration will automatically be updated for the PDB.

If you are using an Oracle Data Guard environment, then to correct the control file, run these statements on both the primary and the standby databases.

1. Log in to the CDB root as a user who was granted the SYSDBA administrative privilege.

2. If you are unsure of the exact state of the system, then you should run ALTER SYSTEM with RESET.

   For example:

   ALTER SYSTEM RESET TDE_CONFIGURATION SCOPE=memory;

3. For each PDB that you want to change, use the following syntax:

   ALTER SYSTEM SET TDE_CONFIGURATION="CONTAINER=pdb_name;KEYSTORE_CONFIGURATION=FILE" SCOPE=memory; 
   

   For example, for the hrpdb and salespdb PDBs with FILE (for software keystores) as the keystore type:

   ALTER SYSTEM SET TDE_CONFIGURATION="CONTAINER=hrpdb;KEYSTORE_CONFIGURATION=FILE" SCOPE=memory; 
   ALTER SYSTEM SET TDE_CONFIGURATION="CONTAINER=salespdb;KEYSTORE_CONFIGURATION=FILE" SCOPE=memory; 
   

4. After you set the TDE_CONFIGURATION parameter for each PDB, log in to the CDB root and then set TDE_CONFIGURATION for the CDB root itself.

   ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=FILE";

   At this stage, CDB root is in the mounted state. The value of the TDE_CONFIGURATION parameter that was set using ALTER SYSTEM with the CONTAINER attribute is only present in the memory of the CDB root. To ensure that the configuration is properly applied to each PDB, you must close and then reopen the PDB. When an isolated mode PDB is opened, the configuration set by the ALTER SYSTEM statement that was issued in the CDB root is read from the control file and then is automatically applied to the PDB.

5. Connect to each PDB and then close and reopen the PDB.

   ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
   ALTER PLUGGABLE DATABASE pdb_name OPEN;

You can use ALTER SYSTEM to configure isolated mode in an Oracle Real Application Clusters (Oracle RAC) environment.

• To ensure that the effect of the ALTER SYSTEM statement is applied on each Oracle RAC node, specify the wildcard (*) in the SID clause of the ALTER SYSTEM statement, as follows. You can run this statement from either the CDB root or a PDB.

  ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=keystore_type" SID='*';

You can create all types of software keystores in isolated mode: password-protected, password protected with the credential provided from an external store, auto-login, local auto-login.

To enable encryption in the PDB after it is configured in isolated mode with the KEYSTORE_CONFIGURATION attribute set to FILE (that is, to use a software keystore), you must create a software keystore, open the software keystore, and then set a TDE master encryption key in the software keystore. Afterward, you can begin to encrypt data for tables and tablespaces that will be accessible in the PDB.

In a multitenant environment, you can create a secure external store to hold the credentials of the software keystore. This feature enables you to hide the keystore password: it removes the need for storing the keystore password in any script or tool that accesses the database without user intervention, such as an overnight batch script. When the WALLET_ROOT parameter is specified, the location of the external store for the CDB root is WALLET_ROOT/tde_seps and for the PDB it is WALLET_ROOT/PDB-GUID/tde_seps. When the WALLET_ROOT parameter is set, there is no longer a single central external store, so when a keystore password is updated, the corresponding external store must be updated as well. When the WALLET_ROOT parameter is not specified, then the location of the external store is the same for both the CDB root and for every PDB. The external store location must then be set by the EXTERNAL_KEYSTORE_CREDENTIAL_LOCATION initialization parameter. When the WALLET_ROOT parameter is not specified, then there is a single central external store, so when you update the keystore password, only the central external store at the EXTERNAL_KEYSTORE_CREDENTIAL_LOCATION must be updated.

In a multitenant environment, different PDBs can access this external store location when you run the ADMINISTER KEY MANAGEMENT statement using the IDENTIFIED BY EXTERNAL STORE clause. This way, you can centrally locate the password and then update it only once in the external store.

A password-protected software keystore requires a password to protect the keystore keys and credentials.

1. Connect to the isolated mode PDB as a user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
   For example:

   CONNNECT sec_admin@pdb_name AS SYSKM

2. Use the SHOW PARAMETER command to confirm that WALLET_ROOT is set, and TDE_CONFIGURATION is set to KEYSTORE_CONFIGURATION=FILE.
3. Run the ADMINISTER KEY MANAGEMENT SQL statement to create the keystore using the following syntax:

   ADMINISTER KEY MANAGEMENT CREATE KEYSTORE IDENTIFIED BY software_keystore_password;
   

   This command creates the /tde directory under WALLET_ROOT (unless it already exists), and creates a password-protected wallet in this directory. If WALLET_ROOT points to a shared directory in ASM, then the /tde subdirectory is not auto-created and must exist before you can execute the CREATE KEYSTORE statement.

   In this specification, software_keystore_password is the password of the keystore that you, the security administrator, creates.

   For example, to create the keystore in the WALLET_ROOT/tde directory:

   ADMINISTER KEY MANAGEMENT CREATE KEYSTORE IDENTIFIED BY password;
   
   keystore altered.
   

To open a software keystore in isolated mode, you must use the ADMINISTER KEY MANAGEMENT statement with the SET KEYSTORE OPEN clause.

1. Connect to the isolated mode PDB as a user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
   For example:

   CONNNECT sec_admin@pdb_name AS SYSKM

2. Run the ADMINISTER KEY MANAGEMENT statement to open the keystore.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN 
   IDENTIFIED BY password;
   keystore altered.

   To switch over to opening the password-protected software keystore when an auto-login keystore is configured and is currently open, specify the FORCE KEYSTORE clause as follows.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN 
   FORCE KEYSTORE 
   IDENTIFIED BY EXTERNAL STORE;
   keystore altered.

   Here, the IDENTIFIED BY EXTERNAL STORE clause is included in the statement because the keystore credentials exist in an external store. This enables the password-protected keystore to be opened without specifying the keystore password within the statement itself.

   If the WALLET_ROOT parameter has been set, then Oracle Database finds the external store by searching in this path: WALLET_ROOT/PDB_GUID/tde_seps.

3. Confirm that the keystore is open.

   SELECT STATUS FROM V$ENCRYPTION_WALLET;

To set the TDE master encryption key in a software keystore in an isolated mode PDB, use the ADMINISTER KEY MANAGEMENT statement with the SET KEY clause.

1. Connect to the isolated mode PDB as a user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
   For example:

   CONNNECT sec_admin@pdb_name AS SYSKM

2. Ensure that the database is open in READ WRITE mode.
   To find the status, run the show pdbs command.
3. Run the ADMINISTER KEY MANAGEMENT SQL statement to set the key in the software keystore.
   For example, if the keystore of the PDB is password-protected, the PDB is open, and the keystore of the PDB is open:

   ADMINISTER KEY MANAGEMENT SET KEY 
   IDENTIFIED BY keystore_password 
   WITH BACKUP USING 'emp_key_backup';
   
   keystore altered.

   If the keystore is closed:

   ADMINISTER KEY MANAGEMENT SET KEY 
   FORCE KEYSTORE 
   IDENTIFIED BY keystore_password 
   WITH BACKUP USING 'emp_key_backup';
   
   keystore altered.

   In this specification:

   • FORCE KEYSTORE should be included if the keystore is closed. This automatically opens the keystore before setting the TDE master encryption key. The FORCE KEYSTORE clause also switches over to opening the password-protected software keystore when an auto-login keystore is configured and is currently open.

   • IDENTIFIED BY specifies the keystore password. Alternatively, if the keystore password is in an external store, you can use the IDENTIFIED BY EXTERNAL STORE clause.

4. Confirm that the TDE master encryption key is set.

   SELECT MASTERKEY_ACTIVATED FROM V$DATABASE_KEY_INFO;

   The output should be YES.

Now that you have completed the keystore configuration and the PDB is configured in isolated mode, you can begin to encrypt data in the PDB.

You can configure an external keystore for a PDB when the PDB is configured in isolated mode.

To configure an external keystore for a PDB in isolated mode, you first must set the WALLET_ROOT parameter. This is necessary for two reasons: first, to have support for migrating to a software keystore in the future, and second, because the configuration file for Oracle Key Vault is retrieved from a location under WALLET_ROOT. Afterwards, you must set the KEYSTORE_CONFIGURATION attribute of the TDE_CONFIGURATION parameter to HSM or OKV, open the configured external keystore, and then set the TDE master encryption key for the PDB. After you complete these tasks, you can begin to encrypt data in the PDB.

How you specify the IDENTIFIED BY clause when you run the ADMINISTER KEY MANAGEMENT statement depends on the type of external keystore. For a hardware security module (HSM), you use the following syntax:

IDENTIFIED BY "user_name:password"

For an Oracle Key Vault keystore, you can omit the user_name and colon, but you must enclose the password in quotation marks:

IDENTIFIED BY "password"

To configure a third-party hardware security module, you must copy your vendor’s PKCS#11 library to the correct location and follow your vendor's instructions.

To open an external keystore in an isolated mode PDB, you must use the ADMINISTER KEY MANAGEMENT statement with the SET KEYSTORE OPEN clause.

1. Connect to the isolated mode PDB as a user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
   For example:

   CONNECT sec_admin@pdb_name AS SYSKM

2. Open the external keystore by using the following syntax:

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN 
   IDENTIFIED BY "external_keystore_credentials";
   

   The type of external keystore determines how you specify the external keystore password. For hardware security modules, you must use the user_name:password syntax. For example:

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN 
   IDENTIFIED BY "psmith:password";
   
   keystore altered.

   For an Oracle Key Vault keystore, you can only provide the password. No user name is allowed in the IDENTIFIED BY clause. Enclose the password in double quotation marks.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN 
   IDENTIFIED BY "password";

3. Repeat this procedure each time you restart the database instance.
   You must open the keystore of the CDB root first.

After you have opened the external keystore in an isolated mode PDB, you are ready to set the TDE master encryption key for the PDB.

• Setting the TDE Master Encryption Key in the Isolated Mode External Keystore
  You should complete this procedure if you have not previously configured an external keystore for Transparent Data Encryption.
• Migration of a Previously Configured Encryption Key in Isolated Mode
  You must migrate the previously configured master encryption key if you previously configured a software keystore.

Now that you have completed the keystore configuration and the PDB is configured in isolated mode, you can begin to encrypt data in the PDB.