RMAN decrypted backup of Oracle TDE encrypted table

Question

I have a Database with Transparent Data Encryption enabled across tablespaces. We have a storage appliance we're using RMAN to backup to which has native encryption, deduplication and compression enabled by default. Since the backup sets are currently encrypted, we lose out on the compression and dedup features of the appliance, costing us MUCH more in disk than expected.

Is it possible to create a non-encrypted backup a TDE-encrypted tablespace using RMAN?

I've been reading through the RMAN docs, Oracle support site, and as many other web articles I have been able to find but have yet to find anything helpful.

Thanks for any assistance or advice!

Answer 1

RMAN makes binary copies of the files, so you can't really not include the TDE, though you can do incremental backups with block change tracking to keep them as small as possible. See here: https://docs.oracle.com/en/database/oracle/oracle-database/19/bradv/rman-backup-concepts.html#GUID-16069217-F44A-45BF-BAE6-774B99155E3A

Also note that TDE provides a different level of protection than the device-level encryption and deduplication on your storage device. The device-level encryption only prevents someone from stealing the device, since files would be decrypted transparently as they are presented to the server OS. By comparison, TDE prevents someone from stealing and decrypting an individual file from the device through a server OS, using a conventional file transfer method like sftp.

If you have a reason - or more likely a requirement - to encrypt at the file level and not just at the device level, then disabling TDE on your backups - even if it could be done - would be a complete abandonment of your data protection policy. Best practice says that your backups should receive at least the same level of protection as your live data files, since backups are often moved off site or to non-production environments and considered easier to steal.