Transparent Data Encryption (TDE) for PeopleSoft & Banner Databases: Keystore Sizing & Performance Runbook

Executive Summary: Securing ERP Data at Rest with TDE

Enterprise Resource Planning (ERP) databases powering higher education and enterprise operations—such as PeopleSoft Enterprise (HCM, FIN, CS) and Ellucian Banner 9—contain highly sensitive Personally Identifiable Information (PII), student records, payroll data, and financial transactions.

Compliance frameworks like FERPA, HIPAA, PCI-DSS, and state privacy statutes mandate strict data-at-rest encryption. Oracle Transparent Data Encryption (TDE) encrypts application data stored in database tablespaces and datafiles transparently to application code, preventing unauthorized access via stolen database backups, compromised SAN storage, or direct disk extraction.

This guide provides a comprehensive production runbook for deploying TDE on Oracle 19c and 23ai CDB/PDB architectures supporting PeopleSoft and Ellucian Banner workloads.

🔄 High-Level Process Flow

---

Technical Prerequisites & Key Architecture Concepts

1. Unified Keystore (WALLET_ROOT) vs. Legacy Wallets

In modern Oracle Multitenant architectures (Oracle 19c / 23ai), keystore management is centralized using the WALLET_ROOT initialization parameter. Each Pluggable Database (PDB) maintains its own isolated master encryption key within a unified wallet structure:

/u01/app/oracle/admin/ERPPROD/wallet/
├── tde/
│   ├── ewallet.p12          (Primary Software Wallet - Password Protected)
│   └── cwallet.sso          (Auto-Login Wallet - Process Readable)
└── tde_seps/                (Secret Store for External Password Store)

2. Hardware-Accelerated Encryption Performance

Modern x86_64 CPUs support AES-NI (Advanced Encryption Standard New Instructions). Oracle Database automatically detects AES-NI CPU capabilities, reducing TDE encryption/decryption overhead to < 2% CPU overhead for typical OLTP transactions in Banner and PeopleSoft environments.

---

Pre-Check Diagnostic Checklist

Before initializing wallets or altering tablespaces, execute the following SQL checks in SQL*Plus or SQLcl connected as SYSDBA:

-- Check current TDE wallet location and status across all PDBs
SELECT con_id, wrl_parameter, status, wallet_type 
FROM v$encryption_wallet;

-- Verify AES-NI CPU hardware acceleration support
SELECT value FROM v$parameter WHERE name = 'cpu_count';

-- Check tablespace encryption status
SELECT tablespace_name, encrypted 
FROM dba_tablespaces;

-- Verify current undo and temp tablespace configurations
SELECT tablespace_name, contents, status 
FROM dba_tablespaces 
WHERE contents IN ('UNDO', 'TEMPORARY');

⚠️ IMPORTANT: Always verify full RMAN database backups before altering keystores or initiating online tablespace encryption operations.

---

Step-by-Step TDE Deployment Runbook

Step 0: Initial Safety Checks & Parameter Configuration

Set the WALLET_ROOT parameter in SPFILE at the CDB level:

-- Connect to CDB$ROOT as SYSDBA
ALTER SYSTEM SET WALLET_ROOT='/u01/app/oracle/admin/ERPPROD/wallet' SCOPE=SPFILE;
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=FILE' SCOPE=BOTH;

-- Bounce the CDB instance to apply WALLET_ROOT changes
SHUTDOWN IMMEDIATE;
STARTUP;

Create the directory structure on the filesystem with strict oracle:oinstall permissions:

mkdir -p /u01/app/oracle/admin/ERPPROD/wallet/tde
chmod 700 /u01/app/oracle/admin/ERPPROD/wallet

---

Step 1: Create CDB Master Software Keystore & Master Key

Set up the primary software keystore password in CDB$ROOT:

-- Create software keystore in CDB$ROOT
ADMINISTER KEY MANAGEMENT CREATE KEYSTORE IDENTIFIED BY "ComplexWalletPass123#";

-- Open the keystore in CDB$ROOT
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "ComplexWalletPass123#";

-- Set the Master Encryption Key for CDB$ROOT
ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY "ComplexWalletPass123#" WITH BACKUP;

---

Step 2: Provision PDB Master Encryption Keys for ERP Schemas

Switch to the ERP target PDB (e.g., BANNERPDB or CSPRODPDB) and create its isolated master encryption key:

-- Switch container to ERP PDB
ALTER SESSION SET CONTAINER = BANNERPDB;

-- Open keystore in PDB container
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "ComplexWalletPass123#";

-- Set PDB Master Encryption Key
ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY "ComplexWalletPass123#" WITH BACKUP;

---

Step 3: Configure Auto-Login Wallet (cwallet.sso) for Unattended Restarts

To ensure database instances restart automatically after host reboot or Oracle Clusterware failover without requiring manual password entry, create an Auto-Login Wallet:

-- Create Local Auto-Login Wallet in CDB$ROOT
ALTER SESSION SET CONTAINER = CDB$ROOT;

ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE 
FROM KEYSTORE '/u01/app/oracle/admin/ERPPROD/wallet/tde' 
IDENTIFIED BY "ComplexWalletPass123#";

Verify wallet status reflects AUTOLOGIN:

SELECT con_id, status, wallet_type FROM v$encryption_wallet;

---

Step 4: Online Tablespace Encryption (Zero-Downtime Migration)

Oracle 19c and 23ai support online tablespace encryption without taking ERP application schemas offline. Execute online encryption for core Banner/PeopleSoft data tablespaces:

-- Connect to target PDB (BANNERPDB)
ALTER SESSION SET CONTAINER = BANNERPDB;

-- Convert existing unencrypted tablespaces online
ALTER TABLESPACE BANNER_DATA ENCRYPTION ONLINE USING 'AES256' ENCRYPT;
ALTER TABLESPACE BANNER_INDEX ENCRYPTION ONLINE USING 'AES256' ENCRYPT;
ALTER TABLESPACE PSDEFAULT ENCRYPTION ONLINE USING 'AES256' ENCRYPT;

Monitor online encryption progress:

SELECT tablespace_name, status, encrypted, encrypt_in_backup 
FROM dba_tablespaces;

SELECT ts#, encryptionalg, blocks_encrypted, blocks_decrypted 
FROM v$encrypted_tablespaces;

---

Step 5: Encrypt Temporary & Undo Tablespaces

To prevent unencrypted sensitive data fragments from spilling into Temp or Undo logs during sorting or undo generation, encrypt TEMP and UNDO tablespaces:

-- Enable Tablespace Encryption for UNDO and TEMP
ALTER SYSTEM SET ENCRYPT_NEW_TABLESPACES = ALWAYS SCOPE=BOTH;

-- Create encrypted UNDO and TEMP tablespaces
CREATE UNDO TABLESPACE UNDO_TDE DATAFILE SIZE 10G ENCRYPTION USING 'AES256' DEFAULT STORAGE(ENCRYPT);
CREATE TEMPORARY TABLESPACE TEMP_TDE TEMPFILE SIZE 10G ENCRYPTION USING 'AES256' DEFAULT STORAGE(ENCRYPT);

-- Switch active UNDO tablespace
ALTER SYSTEM SET UNDO_TABLESPACE = UNDO_TDE SCOPE=BOTH;

---

Troubleshooting Common TDE Errors

Error Code	Root Cause	Remediation Procedure
ORA-28374	Typed master key not found in wallet or wallet closed during query execution.	Verify wallet status in v$encryption_wallet. Re-open wallet using ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN.
ORA-28353	Failed to open wallet due to invalid password or corrupted ewallet.p12.	Check permissions on /u01/app/oracle/admin/ERPPROD/wallet/tde. Restore wallet file from latest backup if corrupted.
ORA-28368	Cannot auto-create wallet file in target directory.	Ensure WALLET_ROOT directory exists and has 700 permissions owned by oracle:oinstall.
ORA-28365	Wallet not open when attempting to access encrypted tablespace data.	Create/refresh auto-login wallet (cwallet.sso) using ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE.

---

Interplay with RMAN Backups & ASM Storage

1. RMAN Backup Compression & Deduplication: Encrypted tablespace blocks present high data entropy, rendering standard OS-level compression inefficient. When backing up TDE-encrypted databases, use RMAN’s built-in algorithm (SET ALGORITHM 'HIGH' or 'MEDIUM') or rely on TDE’s transparent encryption during RMAN streaming.
2. Oracle ASM Diskgroup Security: TDE operates above the storage layer at the Oracle database block level. ASM diskgroups retain standard block structure, meaning ASM disk group rebalancing, kfed operations, and SAN replication function seamlessly without requiring storage-level key management.

---

📚 Official Documentation & Technical References

• Oracle Database 19c Transparent Data Encryption (TDE) Guide
• Oracle Database 23ai TDE & Keystore Administration Guide
• ORACLE-BASE: Multitenant Transparent Data Encryption (TDE)
• Oracle Security: Transparent Data Encryption Overview

---

Need assistance implementing TDE or auditing security compliance across your PeopleSoft or Ellucian Banner databases? Schedule a Security Audit or Contact our Database Security Specialists.