Discussion:
Database Encryption
Arun Chugh
2018-06-07 03:51:05 UTC
Permalink
All,

We have encrypted almost all the datafiles of the database, post that the
performance of the database degraded to almost 40-50%

Could anyone suggest what is the other alternative method that we can use
in order to secure data with bit performance impact.

Regards,
Arun
Stefan Koehler
2018-06-07 07:27:37 UTC
Permalink
Hello Arun,
two things came to my mind.

1) CPU increase due to execution plan change
You can have execution plan changes as you had to move (e.g. with dbms_redefinition) the data to encrypt it after enabling TDE and this can lead to a CPU increase.

2) CPU type
Your current used CPU type does not support hardware cryptographic acceleration or you are using TDE column encryption. For more details please check this white paper on page 3: http://www.oracle.com/technetwork/database/security/twp-transparent-data-encryption-bes-130696.pdf

P.S.: Despite all that there may be cases where TDE really has a performance impact (had some nice discussion about that at Hotsos last year).

Best Regards
Stefan Koehler

Independent Oracle performance consultant and researcher
Website: http://www.soocs.de
All, 
 
We have encrypted almost all the datafiles of the database,  post that the performance of the database degraded to almost 40-50%
 
Could anyone suggest what is the other alternative method that we can use in order to secure data with bit performance impact. 
 
Regards, 
Arun
--
http://www.freelists.org/webpage/oracle-l
Gus Spier
2018-06-07 10:20:48 UTC
Permalink
I don't get to play with database encryption, so I speak entirely
theoretically.
Databases I get to work with all have extensive indexes (?indices?). All of
the indexes are supported by data files. If the data file supporting an
index is encrypted, does the index automatically get rebuilt? Are
statistics automatically regenerated?

Regards,
Gus
Post by Stefan Koehler
Hello Arun,
two things came to my mind.
1) CPU increase due to execution plan change
You can have execution plan changes as you had to move (e.g. with
dbms_redefinition) the data to encrypt it after enabling TDE and this can
lead to a CPU increase.
2) CPU type
Your current used CPU type does not support hardware cryptographic
acceleration or you are using TDE column encryption. For more details
http://www.oracle.com/technetwork/database/security/twp-transparent-data-encryption-bes-130696.pdf
P.S.: Despite all that there may be cases where TDE really has a
performance impact (had some nice discussion about that at Hotsos last
year).
Best Regards
Stefan Koehler
Independent Oracle performance consultant and researcher
Website: http://www.soocs.de
Post by Arun Chugh
All,
We have encrypted almost all the datafiles of the database, post that
the performance of the database degraded to almost 40-50%
Post by Arun Chugh
Could anyone suggest what is the other alternative method that we can
use in order to secure data with bit performance impact.
Post by Arun Chugh
Regards,
Arun
--
http://www.freelists.org/webpage/oracle-l
Arun Chugh
2018-06-07 04:36:54 UTC
Permalink
We are using TDE for encryption and also getting the wait event "CPU+wait
for CPU" ... As an evidence we decrypt the database and it behaviour back
to normal as it was prior to encryption.
What evidence do you have that TDE has affected performance 40-50%?
Can you prove that there has not been a change in execution plans?
All,
We have encrypted almost all the datafiles of the database, post that the
performance of the database degraded to almost 40-50%
Could anyone suggest what is the other alternative method that we can use
in order to secure data with bit performance impact.
Regards,
Arun
Noveljic Nenad
2018-06-07 05:45:38 UTC
Permalink
Arun,

Which encryption algorithm are you using?

Best regards,

Nenad

http://nenadnoveljic.com/blog




From: oracle-l-***@freelists.org [mailto:oracle-l-***@freelists.org] On Behalf Of ***@gmail.com
Sent: Donnerstag, 7. Juni 2018 07:40
To: ***@gmail.com
Cc: Givens, Steven; ***@gmail.com; Oracle Mailing List
Subject: Re: Database Encryption

TDE is encryption. Adding encryption means that a step is added, which means response time will increase.

As Tim said, gather statistics from execution on a SQL basis to first be sure what you are talking about, and to make sure plans haven’t changed.

TDE encryption specifically is special in the sense that data on disk is encrypted but lives unencrypted in the buffer cache. This means that if you can get your active data set to remain in the buffer cache, you don’t get the en/decryption penalty.

The hard part of diagnostics is that there are no wait events capturing encryption time, nor is cpu time as being en/decryption time.

You could create a perf report or flame graph to see in which functions time is spend, and see if these are used with en/de cryption to prove that that is responsible for the time increase.

Just remember that nothing ever comes for free.
Verstuurd vanaf mijn iPhone

Op 7 jun. 2018 om 07:21 heeft Arun Chugh <***@gmail.com<mailto:***@gmail.com>> het volgende geschreven:
Local wallet is being used for storing the key.

Regards,
Arun
On Thu, Jun 7, 2018, 10:43 Givens, Steven <***@fnni.com<mailto:***@fnni.com>> wrote:
Also are you using an HSM to store the encryption key or local wallet? Just curious whether you might be having latency issues with an external key store.

________________________________

From: Arun Chugh <***@gmail.com<mailto:***@gmail.com>>
Date: June 6, 2018 at 11:38:05 PM CDT
To: ***@gmail.com<mailto:***@gmail.com> <***@gmail.com<mailto:***@gmail.com>>
Cc: Oracle Mailing List <oracle-***@freelists.org<mailto:oracle-***@freelists.org>>
Subject: [External] Re: Database Encryption

We are using TDE for encryption and also getting the wait event "CPU+wait for CPU" ... As an evidence we decrypt the database and it behaviour back to normal as it was prior to encryption.

On Thu, Jun 7, 2018, 09:31 Tim Gorman <***@gmail.com<mailto:***@gmail.com><mailto:***@gmail.com<mailto:***@gmail.com>>> wrote:
What evidence do you have that TDE has affected performance 40-50%?

Can you prove that there has not been a change in execution plans?



On 6/6/18 21:51, Arun Chugh wrote:
All,

We have encrypted almost all the datafiles of the database, post that the performance of the database degraded to almost 40-50%

Could anyone suggest what is the other alternative method that we can use in order to secure data with bit performance impact.

Regards,
Arun
____________________________________________________
Please consider the environment before printing this e-mail.
Bitte denken Sie an die Umwelt, bevor Sie dieses E-Mail drucken.

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css">p { font-family: Arial;font-size:9pt }</style>
</head>
<body>
<p>
<br>Important Notice</br>
<br />
This message is intended only for the individual named. It may contain confidential or privileged information. If you are not the named addressee you should in particular not disseminate, distribute, modify or copy this e-mail. Please notify the sender immediately by e-mail, if you have received this message by mistake and delete it from your system.<br />
Without prejudice to any contractual agreements between you and us which shall prevail in any case, we take it as your authorization to correspond with you by e-mail if you send us messages by e-mail. However, we reserve the right not to execute orders and instructions transmitted by e-mail at any time and without further explanation.<br />
E-mail transmission may not be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete. Also processing of incoming e-mails cannot be guaranteed. All liability of Vontobel Holding Ltd. and any of its affiliates (hereinafter collectively referred to as "Vontobel Group") for any damages resulting from e-mail use is excluded. You are advised that urgent and time sensitive messages should not be sent by e-mail and if verification is required please request a printed version.</br>
Please note that all e-mail communications to and from the Vontobel Group are subject to electronic storage and review by Vontobel Group. Unless stated to the contrary and without prejudice to any contractual agreements between you and Vontobel Group which shall prevail in any case, e-mail-communication is for informational purposes only and is not intended as an offer or solicitation for the purchase or sale of any financial instrument or as an official confirmation of any transaction.<br />
The legal basis for the processing of your personal data is the legitimate interest to develop a commercial relationship with you, as well as your consent to forward you commercial communications. You can exercise, at any time and under the terms established under current regulation, your rights. If you prefer not to receive any further communications, please contact your client relationship manager if you are a client of Vontobel Group or notify the sender.
Please note for an exact reference to the affected group entity the corporate e-mail signature.
For further information about data privacy at Vontobel Group please consult <a href="https://www.vontobel.com">www.vontobel.com</a>.<br />
</p>
</body>
</html>
Jonathan Lewis
2018-06-07 10:43:51 UTC
Permalink
Quick and dirty check which may confirm it's purely the CPU impact of TDE.

AWR (or statspack) reports for matching time periods / batch runs with and without TDE
a) Is there little change at the report level in buffer gets, and pl/sql CPU time but a significant increase in CPU time. (check osstats, time model, as well as Top 10 for this)
b) Does the content of the Top SQL by CPU stay pretty much the same (SQL and execution count) with increased CPU (per execution)
c) Track the Top SQL by CPU to the TOP SQL by buffer gets, and Top SQL by physical reads are the gets/reads (per execution) consistent.
d) For "same SQL, significantly different costs per execution" check execution plans. (awrsqrpt.sql or equivalent).

Regards
Jonathan Lewis

________________________________________
From: oracle-l-***@freelists.org <oracle-l-***@freelists.org> on behalf of Arun Chugh <***@gmail.com>
Sent: 07 June 2018 05:36
To: ***@gmail.com
Cc: Oracle Mailing List
Subject: Re: Database Encryption

We are using TDE for encryption and also getting the wait event "CPU+wait for CPU" ... As an evidence we decrypt the database and it behaviour back to normal as it was prior to encryption.

On Thu, Jun 7, 2018, 09:31 Tim Gorman <***@gmail.com<mailto:***@gmail.com>> wrote:
What evidence do you have that TDE has affected performance 40-50%?

Can you prove that there has not been a change in execution plans?



On 6/6/18 21:51, Arun Chugh wrote:
All,

We have encrypted almost all the datafiles of the database, post that the performance of the database degraded to almost 40-50%

Could anyone suggest what is the other alternative method that we can use in order to secure data with bit performance impact.

Regards,
Arun

--
http://www.freelists.org/webpage/oracle-l
Arun Chugh
2018-06-07 05:08:21 UTC
Permalink
Yes we have the CPU statistics with us.

Regards,
Arun
Do you have statistics on your cpu usage and runqueue prior to encryption?
Post by Arun Chugh
We are using TDE for encryption and also getting the wait event "CPU+wait
for CPU" ... As an evidence we decrypt the database and it behaviour back
to normal as it was prior to encryption.
What evidence do you have that TDE has affected performance 40-50%?
Can you prove that there has not been a change in execution plans?
All,
We have encrypted almost all the datafiles of the database, post that
the performance of the database degraded to almost 40-50%
Could anyone suggest what is the other alternative method that we can
use in order to secure data with bit performance impact.
Regards,
Arun
--
//
zztat - The Next-Gen Oracle Performance Monitoring and Reaction Framework!
Stefan Knecht
2018-06-07 04:05:22 UTC
Permalink
How did you encrypt the datafiles? Filesystem encryption? Storage
encryption? TDE? Something else?
Post by Arun Chugh
All,
We have encrypted almost all the datafiles of the database, post that the
performance of the database degraded to almost 40-50%
Could anyone suggest what is the other alternative method that we can use
in order to secure data with bit performance impact.
Regards,
Arun
--
//
zztat - The Next-Gen Oracle Performance Monitoring and Reaction Framework!
Visit us at zztat.net | @zztat_oracle | fb.me/zztat | zztat.net/blog/
Arun Chugh
2018-06-07 17:45:10 UTC
Permalink
Yes right... Did not encrypt the system sysaux undo n temp..
You say “almost all the datafiles of the database”. I assume you mean
tablespaces rather than datafiles but just wanted to confirm that you
didn’t encrypt SYSTEM, SYSAUX, UNDO or TEMP?
Jay Miller
Sr. Oracle DBA
201.369.8355
*Sent:* Wednesday, June 06, 2018 11:51 PM
*To:* Oracle Mailing List
*Subject:* Database Encryption
All,
We have encrypted almost all the datafiles of the database, post that the
performance of the database degraded to almost 40-50%
Could anyone suggest what is the other alternative method that we can use
in order to secure data with bit performance impact.
Regards,
Arun
Robert Freeman
2018-06-11 23:27:06 UTC
Permalink
What version of the database are we talking about here? Always helpful knowledge.

If it’s a supported version, I’d open an SR with Oracle, to be honest. You should not be seeing this kind of impact from encryption unless your server was already sitting on the edge.
Depending on your version, there are known bugs (and – yes – bug fixes) for problems related to encryption and performance.
Where are you seeing your biggest impacts? CPU, IO response times, changed execution plans? What was the command you used to do the encryption? Did you encrypt with or without salt? In other words, what have you done to quantify the problem you are seeing?

Stay the course and figure out this problem would be my suggestion. Don’t just jump ship because you’re taking on a little water.

Cheers

Robert G. Freeman
Deliverer of Enterprise Data®
Businessolver
Cell: 801-703-3405

“Greater than the death of flesh is the death of hope. The death of dreams. Against this peril we can never surrender. The future is all around us, waiting in moments of transition, to be born in moments of revelation. No one knows the shape of that future, or where it will take us. We know only that it is always born in pain.”

From: oracle-l-***@freelists.org [mailto:oracle-l-***@freelists.org] On Behalf Of Arun Chugh
Sent: Thursday, June 07, 2018 12:45 PM
To: ***@tdameritrade.com
Cc: Oracle Mailing List <oracle-***@freelists.org>
Subject: Re: Database Encryption

Yes right... Did not encrypt the system sysaux undo n temp..

On Thu, Jun 7, 2018, 22:53 <***@tdameritrade.com<mailto:***@tdameritrade.com>> wrote:
You say “almost all the datafiles of the database”. I assume you mean tablespaces rather than datafiles but just wanted to confirm that you didn’t encrypt SYSTEM, SYSAUX, UNDO or TEMP?

Jay Miller
Sr. Oracle DBA
201.369.8355

From: oracle-l-***@freelists.org<mailto:oracle-l-***@freelists.org> [mailto:oracle-l-***@freelists.org<mailto:oracle-l-***@freelists.org>] On Behalf Of Arun Chugh
Sent: Wednesday, June 06, 2018 11:51 PM
To: Oracle Mailing List
Subject: Database Encryption

All,

We have encrypted almost all the datafiles of the database, post that the performance of the database degraded to almost 40-50%

Could anyone suggest what is the other alternative method that we can use in order to secure data with bit performance impact.

Regards,
Arun
Tefft, Michael J
2018-06-13 11:30:19 UTC
Permalink
I noticed that our AWR report (on a 12.2 database with encrypted tablespaces) specifically itemizes elapsed-time and CPU-time spent on tablespace encryption. It is in the ‘Time Model Statistics’ section.

If your 40%-50% impact is not showing up here – perhaps you have plans changing or other factors that are causing the issue.

Mike Tefft

From: oracle-l-***@freelists.org [mailto:oracle-l-***@freelists.org] On Behalf Of Robert Freeman
Sent: Monday, June 11, 2018 7:27 PM
To: ***@gmail.com; ***@tdameritrade.com
Cc: Oracle Mailing List <oracle-***@freelists.org>
Subject: RE: Database Encryption

What version of the database are we talking about here? Always helpful knowledge.

If it’s a supported version, I’d open an SR with Oracle, to be honest. You should not be seeing this kind of impact from encryption unless your server was already sitting on the edge.
Depending on your version, there are known bugs (and – yes – bug fixes) for problems related to encryption and performance.
Where are you seeing your biggest impacts? CPU, IO response times, changed execution plans? What was the command you used to do the encryption? Did you encrypt with or without salt? In other words, what have you done to quantify the problem you are seeing?

Stay the course and figure out this problem would be my suggestion. Don’t just jump ship because you’re taking on a little water.

Cheers

Robert G. Freeman
Deliverer of Enterprise Data®
Businessolver
Cell: 801-703-3405

“Greater than the death of flesh is the death of hope. The death of dreams. Against this peril we can never surrender. The future is all around us, waiting in moments of transition, to be born in moments of revelation. No one knows the shape of that future, or where it will take us. We know only that it is always born in pain.”

From: oracle-l-***@freelists.org<mailto:oracle-l-***@freelists.org> [mailto:oracle-l-***@freelists.org] On Behalf Of Arun Chugh
Sent: Thursday, June 07, 2018 12:45 PM
To: ***@tdameritrade.com<mailto:***@tdameritrade.com>
Cc: Oracle Mailing List <oracle-***@freelists.org<mailto:oracle-***@freelists.org>>
Subject: Re: Database Encryption

Yes right... Did not encrypt the system sysaux undo n temp..

On Thu, Jun 7, 2018, 22:53 <***@tdameritrade.com<mailto:***@tdameritrade.com>> wrote:
You say “almost all the datafiles of the database”. I assume you mean tablespaces rather than datafiles but just wanted to confirm that you didn’t encrypt SYSTEM, SYSAUX, UNDO or TEMP?

Jay Miller
Sr. Oracle DBA
201.369.8355

From: oracle-l-***@freelists.org<mailto:oracle-l-***@freelists.org> [mailto:oracle-l-***@freelists.org<mailto:oracle-l-***@freelists.org>] On Behalf Of Arun Chugh
Sent: Wednesday, June 06, 2018 11:51 PM
To: Oracle Mailing List
Subject: Database Encryption

All,

We have encrypted almost all the datafiles of the database, post that the performance of the database degraded to almost 40-50%

Could anyone suggest what is the other alternative method that we can use in order to secure data with bit performance impact.

Regards,
Arun
DRCDBA (Gmail)
2018-06-19 18:34:47 UTC
Permalink
Arun,

Just checking to see if you have any updates on this.

Thanks!

-Devin
Post by Tefft, Michael J
I noticed that our AWR report (on a 12.2 database with encrypted tablespaces) specifically itemizes elapsed-time and CPU-time spent on tablespace encryption. It is in the ‘Time Model Statistics’ section.
If your 40%-50% impact is not showing up here – perhaps you have plans changing or other factors that are causing the issue.
Mike Tefft
Sent: Monday, June 11, 2018 7:27 PM
Subject: RE: Database Encryption
What version of the database are we talking about here? Always helpful knowledge.
If it’s a supported version, I’d open an SR with Oracle, to be honest. You should not be seeing this kind of impact from encryption unless your server was already sitting on the edge.
Depending on your version, there are known bugs (and – yes – bug fixes) for problems related to encryption and performance.
Where are you seeing your biggest impacts? CPU, IO response times, changed execution plans? What was the command you used to do the encryption? Did you encrypt with or without salt? In other words, what have you done to quantify the problem you are seeing?
Stay the course and figure out this problem would be my suggestion. Don’t just jump ship because you’re taking on a little water.
Cheers
Robert G. Freeman
Deliverer of Enterprise Data®
Businessolver
Cell: 801-703-3405
“Greater than the death of flesh is the death of hope. The death of dreams. Against this peril we can never surrender. The future is all around us, waiting in moments of transition, to be born in moments of revelation. No one knows the shape of that future, or where it will take us. We know only that it is always born in pain.”
Sent: Thursday, June 07, 2018 12:45 PM
Subject: Re: Database Encryption
Yes right... Did not encrypt the system sysaux undo n temp..
You say “almost all the datafiles of the database”. I assume you mean tablespaces rather than datafiles but just wanted to confirm that you didn’t encrypt SYSTEM, SYSAUX, UNDO or TEMP?
Jay Miller
Sr. Oracle DBA
201.369.8355
Sent: Wednesday, June 06, 2018 11:51 PM
To: Oracle Mailing List
Subject: Database Encryption
All,
We have encrypted almost all the datafiles of the database, post that the performance of the database degraded to almost 40-50%
Could anyone suggest what is the other alternative method that we can use in order to secure data with bit performance impact.
Regards,
Arun
Mike Killough
2018-06-12 14:42:29 UTC
Permalink
I did encrypt all of those datafiles. All the datafiles are encrypted. For us CPU went up about 10%. It is a 12.2 database.

Sent from my iPhone

On Jun 7, 2018, at 12:45 PM, Arun Chugh <***@gmail.com<mailto:***@gmail.com>> wrote:

Yes right... Did not encrypt the system sysaux undo n temp..

On Thu, Jun 7, 2018, 22:53 <***@tdameritrade.com<mailto:***@tdameritrade.com>> wrote:
You say “almost all the datafiles of the database”. I assume you mean tablespaces rather than datafiles but just wanted to confirm that you didn’t encrypt SYSTEM, SYSAUX, UNDO or TEMP?

Jay Miller
Sr. Oracle DBA
201.369.8355

From: oracle-l-***@freelists.org<mailto:oracle-l-***@freelists.org> [mailto:oracle-l-***@freelists.org<mailto:oracle-l-***@freelists.org>] On Behalf Of Arun Chugh
Sent: Wednesday, June 06, 2018 11:51 PM
To: Oracle Mailing List
Subject: Database Encryption

All,

We have encrypted almost all the datafiles of the database, post that the performance of the database degraded to almost 40-50%

Could anyone suggest what is the other alternative method that we can use in order to secure data with bit performance impact.

Regards,
Arun
"Reen, Elizabeth " (Redacted sender "elizabeth.reen" for DMARC)
2018-06-07 18:50:27 UTC
Permalink
Does all the data need to be encrypted? I really doubt. Things like dates and amounts do not have to be encrypted. Assuming that this is for something like GDPR, you would only need to encrypt the Personally Identifiable Information.


Liz

Elizabeth Reen
CPB Database Group Manager
718.248.9930 (Office)
Service Now Group: CPB-ORACLE-DB-SUPPORT


From: oracle-l-***@freelists.org [mailto:oracle-l-***@freelists.org] On Behalf Of Arun Chugh
Sent: Wednesday, June 06, 2018 11:51 PM
To: Oracle Mailing List
Subject: Database Encryption

All,

We have encrypted almost all the datafiles of the database, post that the performance of the database degraded to almost 40-50%

Could anyone suggest what is the other alternative method that we can use in order to secure data with bit performance impact.

Regards,
Arun
Loading...