We are testing a particular HSM to use replace the Oracle wallet and user as a key-store for column encryption. We are using redundant HSMs so that things will continue to run even with a complete loss of one HSM. This works fine when connectivity is lost to one HSM at a time.

The problem we found is that when there is a complete loss of connectivity to both devices, a restoration of connectivity is not sufficient to continue to allow decryption of encrypted columns. The only way we found to restore connectivity in this scenario is to restart the instance.

The question is, which of these do our findings represent?

  1. A problem with the way we have configured the HSM.
  2. A limitation of this particular HSM.
  3. A limitation of the way the Oracle database works with any HSM.
  • While I have not used Hardware Security Modules (HSM), I would go with the third choice. If you lose the HSM , you might lose access to your database. So at that point does the instance crash? If this is Linux/Unix do you lose the basic processes like the database or log writer? If so losing both HSM's might cause the database to crash. Hence you would no longer be able to log into the database. The alert log should show you what is happening to the database when it loses the second HSM. – Gandolf989 Jul 21 '17 at 20:32
  • @Gandolf989 The database is fine when this happens, only access to the encrypted columns is lost, but even when connectivity to the HSMs is restored (verified using HSM tools from the database server), the database continues to act as though the HSMs are unavailable. Everything else in the database is fine, only access to the encrypted columns is unavailable. The alert log gives no indication of any issues. – Leigh Riffel Jul 24 '17 at 13:16
  • I suspect that there aren't enough people on this site that are familiar with this hardware. You probably need to take your issue to the manufacturer to understand what your test means. My feeling is still that if the database loses access to the data files, regardless of how it gets its access, the database will hang. The point of having redundancy to to prevent single points of failure from affecting your application. You have proven that that part works. Do you get a third HSM to add redundancy? I guess that depends of the cost of the HSM and the cost of not having your application. – Gandolf989 Jul 24 '17 at 15:25
  • A third HSM would only help in the case of a loss of the HSMs, not in a network failure. The database never loses access to the datafiles, before, during, or after the loss of the HSMs. I suspect there are a sufficient number of people using a HSM on this site, but to your point, perhaps not a sufficient number that have tested it in this scenario. Thank you for taking a shot at it. – Leigh Riffel Jul 25 '17 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.