We are testing a particular HSM to use replace the Oracle wallet and user as a key-store for column encryption. We are using redundant HSMs so that things will continue to run even with a complete loss of one HSM. This works fine when connectivity is lost to one HSM at a time.
The problem we found is that when there is a complete loss of connectivity to both devices, a restoration of connectivity is not sufficient to continue to allow decryption of encrypted columns. The only way we found to restore connectivity in this scenario is to restart the instance.
The question is, which of these do our findings represent?
- A problem with the way we have configured the HSM.
- A limitation of this particular HSM.
- A limitation of the way the Oracle database works with any HSM.