A replicated or restored database can use the existing CSP Vault for Databases deployment to access its TDE master keys. TDE master key transfer is required when the test environment is isolated from the production environment and uses an independently installed CSP Vault for Databases cluster.

In this workflow, the production CSP Vault for Databases environment is the environment from which the TDE master keys are exported, and the test CSP Vault for Databases environment is the environment into which the keys are imported. The test environment does not initially contain the TDE master keys used by the production database. Transfer the required keys so that the test database can access the encrypted data.

The database and TDE master keys are transferred separately. Use a database replication or restore method appropriate for your environment to copy the database. To protect the TDE master keys during transfer, create a wrapping key in the test environment. The production environment uses the public key to wrap the master keys during export. The corresponding private key remains in the test environment and is used to unwrap the keys during import.

Complete the procedures below to transfer Oracle TDE master keys: 

• Setting Up a CSP Vault for Databases Production Environment for Oracle Server
• Setting Up a CSP Vault for Database Test Environment for Oracle Server
• Transferring Oracle TDE Master Keys from a Production Environment to a Test Environment