Oracle JDBC Thin驱动仅通过URL配置强制网络加密的方案咨询

可行配置方案 #

使用最新版Oracle JDBC驱动（19c及以上版本均支持，推荐升级到21c/23c官方正式版），可直接在TNS格式URL的DESCRIPTION块内新增SECURITY子节点配置加密参数，无需修改Properties，完全符合约束要求。

修改后的TNS描述符示例 #

DESCRIPTION = 
   (ADDRESS_LIST =
       (ADDRESS = (PROTOCOL = tcp)(HOST = myora1.corp.net)(PORT = 1521))
       (ADDRESS = (PROTOCOL = tcp)(HOST = myora2.corp.net)(PORT = 1521)))
   (FAILOVER=ON)
   (SECURITY =
       (ENCRYPTION_CLIENT = REQUIRED)
       (ENCRYPTION_TYPES_CLIENT = (AES256, AES192, AES128))
   )
   (CONNECT_DATA = (SERVER = dedicated)(SERVICE_NAME = foobar))

其中ENCRYPTION_CLIENT = REQUIRED即对应oracle.net.encryption_client参数设为强制加密，若服务端不支持Oracle Advanced Security加密会直接连接失败，不会降级为明文连接，满足监管要求；可选配置ENCRYPTION_TYPES_CLIENT指定允许的加密算法优先级，默认也会使用Oracle支持的安全加密算法。

最终JDBC URL字符串 #

jdbc:oracle:thin:@(DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = tcp)(HOST = myora1.corp.net)(PORT = 1521))(ADDRESS = (PROTOCOL = tcp)(HOST = myora2.corp.net)(PORT = 1521)))(FAILOVER=ON)(SECURITY=(ENCRYPTION_CLIENT=REQUIRED)(ENCRYPTION_TYPES_CLIENT=(AES256,AES192,AES128)))(CONNECT_DATA = (SERVER = dedicated)(SERVICE_NAME = foobar)))

加密有效性验证 #

连接建立后可执行以下SQL校验是否已启用加密：

SELECT network_service_banner FROM v$session_connect_info WHERE sid = SYS_CONTEXT('USERENV', 'SID')

若返回结果包含Oracle Advanced Security: encryption service相关内容，即说明加密已生效。

内容的提问来源于stack exchange，提问作者peterh