Is there any method to encrypt a Recovery Manager(RMAN) backup while the backup is being written out to tape?
RMAN does not use an explicit encryption method, although the binary format of backup files offers some security. The Media Management Vendor may offer encryption because of the security issue revolves around physical security of the media. The encryption may be a transport bit filtering option. All Media Manager’s support some degree of security regarding who can load and read their tapes. Note that the proprietary binary format of the backup output file from RMAN is not easily decipherable. To extract information from a datafile, you would have to have a copy of the same media management software and a copy of the media management backup catalog, and a in- depth knowledge of Oracle proprietary information. With the correct hardware, software, and knowledge it is theoretical possible. This security risk is not specific to the database. A customer has the same concerns with operating system backups of non-database files.
Recovery manager does not offer encryption. Please note that the backup output file is actually in an Oracle proprietary format. It is not a ‘readable datafile’. To extract a datafile, you would have to have a copy of the same media management software and a copy of the media management backup catalog, as well as proprietary oracle internals information (or the recovery catalog / controlfile) to be able to easily extract the files. However, with the correct hardware, software and knowledge it would be possible. This particular backup security problem is not specific to the database. A customer may have similar concerns with Operating System backups of non-database files. Since the concern really covers a general issue with physical security of media, it may be possible that a Media Management vendor offers encryption as a transport bit filtering option. Currently, I do not know which (if any) Media Management vendors offer this as an optional feature. However, all Media Manager’s to so
