--- title: "Fortanix DSM with Oracle TDE - Introduction" slug: "using-fortanix-dsm-with-oracle-tde-introduction" updated: 2026-08-19T14:07:16Z published: 2026-08-19T14:07:16Z canonical: "support.fortanix.com/using-fortanix-dsm-with-oracle-tde-introduction" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Fortanix DSM with Oracle TDE - Introduction ## 1.0 Introduction This article describes the TDE process, key hierarchy, prerequisites, and steps to configure **Fortanix-Data-Security-Manager (DSM)** for **Transparent Data Encryption (**[**TDE**](/v1/docs/using-fortanix-dsm-with-oracle-tde-introduction#10-introduction)**).** ## 2.0 Terminology References - **Fortanix Data Security Manager** Fortanix DSM is the cloud solution secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as secrets, such as passwords, API keys, tokens, or any blob of data. - **TDE – Transparent Data Encryption** Transparent Data Encryption (TDE) enables you to encrypt sensitive data that you store in tables and tablespaces. Oracle Database uses authentication, authorization, and auditing mechanisms to secure data in the database, but not in the operating system data files where data is stored. To protect these data files, Oracle Database provides Transparent Data Encryption (TDE). To prevent unauthorized decryption, TDE stores the encryption keys in a security module external to the database, called a keystore. *For more information,* *see* [*Introduction to Transparent Data Encryption*](https://docs.oracle.com/en/database/oracle/oracle-database/12.2/asoag/introduction-to-transparent-data-encryption.html). ## 3.0 TDE Key Hierarchy ![TDEKeyHierarchy.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16378121185428.png) **Figure 1: TDE key hierarchy** TDE encryption uses a two-tiered, key-based architecture to transparently encrypt and decrypt data. The TDE master encryption key (KEK) is stored in a security module (such as an Oracle wallet or Hardware Security Module (HSM) such as Fortanix DSM). This TDE master encryption key is used to encrypt the TDE table or tablespace encryption key (DEK), which in turn is used to encrypt and decrypt data in the database files. Fortanix DSM separates ordinary program functions from encryption operations, making it possible to assign separate, distinct duties to database administrators and security administrators. Security is enhanced because the keystore password can be unknown to the database administrator, requiring the security administrator to provide the password. ## 4.0 Prerequisites Ensure the following: - Oracle Database must be on Fortanix DSM-supported versions. Currently, the supported database versions are: **11g R2, 12c, 18c, 19c, 21c, 23ai, 26ai**. For Oracle 11g, make sure Oracle Database patch **18948524** is applied. This patch enables the Auto-login mode of the HSM wallet. - Download the latest Fortanix PKCS#11 library from [*here*](/v1/docs/pkcs-11). Copy it to the database server. ## 5.0 Configure Fortanix DSM A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections: ### 5.1 Signing Up To get started with the Fortanix DSM cloud service, you must register an account at . For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region. *For more information on how to set up the Fortanix DSM, refer to* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.* ### 5.2 Creating an Account Access in a web browser and enter your credentials to log in to Fortanix DSM. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png) **Figure 2: Logging in** *For more information on how to set up an account in Fortanix DSM, refer to* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.* ### 5.3 Creating a Group Perform the following steps to create a group in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(79).png) **Figure 3: Add groups** 2. On the **Adding new group** page: 1. **Title**: Enter a name for your group. 2. **Description** (optional): Enter a short description of the group. 3. Click **SAVE** to create the new group. *For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.* > [!NOTE] > TIP > > It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.* ### 5.4 Creating an Application Perform the following steps to create an application (app) in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Add_App(7).png) **Figure 4: Add application** 2. On the **Adding new app** page: 1. **App name**: Enter the name for your application. 2. **ADD DESCRIPTION** (optional): Enter a short description of the application. 3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.* 4. **Assigning the new app to groups**: Select the group created in [*Section 5.3: Creating a Group*](/v1/docs/using-fortanix-dsm-with-oracle-tde-introduction#53-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list. 3. Click **SAVE** to add the new application. *For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.* ### 5.5 Copying the App UUID Perform the following steps to copy the app UUID from the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-dsm-with-oracle-tde-introduction#54-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app. 2. From the top of the app’s page, click the copy icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot 2025-05-12 164953.png) next to the app UUID to copy it to be used later. Additionally, perform the following steps to copy the credentials: 1. On the **INFO** tab, click **VIEW API KEY DETAILS**. 2. Click the **USERNAME/PASSWORD** tab. 3. From the **Credentials Details** dialog box, copy the **Username (app UUID)** and **Password** to be used later. ### 5.6 Copying the API Key Perform the following steps to copy the API key from the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-dsm-with-oracle-tde-introduction#54-creating-an-application) to go to the detailed view of the app. 2. On the **INFO** tab, click **VIEW API KEY DETAILS**. 3. From the **API Key Details** dialog box, copy the **API Key** of the app to be used later. ## 6.0 Verify Connectivity Run the following command to validate the connectivity from the database node(s) to the Fortanix DSM endpoint: ```bash curl -v https://DSM_ENDPOINT ``` You must receive a 200 status code. ### 6.1 Known Connectivity Issues - Port **443** is blocked between the database server and Fortanix DSM. - The root CA certificate used to sign the Fortanix DSM Cluster certificate is not present in the database server trust store. ## 7.0 References *For more information on how to integrate Fortanix DSM with Oracle TDE, refer to* [*Using Fortanix DSM with Oracle TDE*](/v1/docs/using-fortanix-dsm-with-oracle-tde)*.* Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface. ## Related - [Fortanix DSM with Oracle TDE](/using-fortanix-dsm-with-oracle-tde.md) - [Fortanix DSM as a KMS to Secure VMware Virtual Environments](/fortanix-dsm-as-a-kms-to-secure-vmware-virtual-environments.md) - [(Release 4.23) Kubernetes Version Upgrade to 1.27 K8s](/fortanix-data-security-manager-release-423-kubernetes-version-upgrade-to-127-k8s.md) - [Data Center Labeling](/fortanix-data-security-manager-data-center-labeling.md)