本地Oracle数据库的TDE加密KEK托管在云服务上？

嗨，

我们想加密一些本地Oracle数据库。
如果可能，我们希望避免使用物理HSM或与第三方HSM云提供商签约。
这是否可以将KEK存储在GCP或Azure中，并将我们的本地数据库与之接口？
我还不需要技术细节，只需要关于可能性的信息。

谢谢!

奥利维尔

这是来自这里托管的TDE常见问题:

https://www.oracle.com/database/technologies/faq-tde.html

Can TDE store its master encryption key in an external device using the PKSC11 interface?

Starting in Oracle Database 11g Release 2, customers of Oracle Advanced Security Transparent Data Encryption (TDE) optionally may store the TDE master encryption key in an external device using the PKCS11 interface. In this setup, the master key is stored directly in the third-party device rather than in the included Oracle Wallet (note: the Oracle Wallet is a PKCS12 file-based keystore which is used by most TDE customers).

When using PKCS11, the third-party vendor provides the storage device, PKCS11 software client library, secure communication from the device to the PKCS11 client (running on the database server), authentication, auditing, and other related functionality. The vendor also is responsible for testing and ensuring high-availability of the TDE master encryption key in diverse database server environments and configurations. Customers should contact the device vendor to receive assistance for any related issues.

因此，只要您的提供商支持这一点，它就应该是可能的。