如何在Oracle数据库中存储敏感数据（例如数据库密码）

Question

Basically i'm building a WebApp (ASP.NET MVC5) working with Oracle Database. The application connects to multiple oracle databases and an admin should be able to dynamically add new database connections to the webapp.

The way we are doing it now, when an admin adds a new database via the admin panel, the database connection info is stored in our own Oracle Database (this includes the username and password to the database). These passwords are currently stored plaintext.

All the webapp would have to do is retrieve the database credentials from our own database, format them into a connection string and connect to the database.

The problem is, if we hash the passwords, they will not work in a connection string, nor would this add any security at all. All the encryption of these passwords should happen on the databas-side.

I found out about TDE (transparant data encryption) but i believe this is only available in the enterprise edition of Oracle Database and i do not have access to this. Is there any other way to securely store the database passwords? Am i missing something ?

Answer 1

You can simply encrypt the passwords and store it in the database. When a user changes the password or signs up for the first time, simply encrypt them. While checking for validation, encrypt the text box and check if two strings match.
And when you require to know the passwords, decrypt them.
A sample code for encryption looks like

        // Encrypt the text
        public static string EncryptText(string strText)
        {
            return Encrypt(strText, "a#94tOc*"); // use any string to encrypt other than a#94tOc*
        }

        //The function used to encrypt the text
        private static string Encrypt(string strText, string strEncrKey)
        {
            byte[] byKey = { };
            byte[] IV = { 0X12, 0X34, 0X56, 0X78, 0X90, 0XAB, 0XCD, 0XEF };
            byKey = System.Text.Encoding.UTF8.GetBytes(strEncrKey.Substring(0, 8));
            DESCryptoServiceProvider des = new DESCryptoServiceProvider();
            byte[] inputByteArray = System.Text.Encoding.UTF8.GetBytes(strText);
            MemoryStream ms = new MemoryStream();
            CryptoStream cs = new CryptoStream(ms, des.CreateEncryptor(byKey, IV), CryptoStreamMode.Write);
            cs.Write(inputByteArray, 0, inputByteArray.Length);
            cs.FlushFinalBlock();
            return Convert.ToBase64String(ms.ToArray());
        }

Similarly for decrypting, use:

        //Decrypt the text 
        public static string DecryptText(string strText)
        {
            return Decrypt(strText, "a#94tOc*"); // use same as encryption string
        }
        //The function used to decrypt the text
        private static string Decrypt(string strText, string sDecrKey)
        {
            byte[] byKey = { };
            byte[] IV = { 0X12, 0X34, 0X56, 0X78, 0X90, 0XAB, 0XCD, 0XEF };
            byte[] inputByteArray = new byte[strText.Length + 1];
            byKey = System.Text.Encoding.UTF8.GetBytes(sDecrKey.Substring(0, 8));
            DESCryptoServiceProvider des = new DESCryptoServiceProvider();
            inputByteArray = Convert.FromBase64String(strText.Replace(' ', '+'));
            MemoryStream ms = new MemoryStream();
            CryptoStream cs = new CryptoStream(ms, des.CreateDecryptor(byKey, IV), CryptoStreamMode.Write);
            cs.Write(inputByteArray, 0, inputByteArray.Length);
            cs.FlushFinalBlock();
            System.Text.Encoding encoding = System.Text.Encoding.UTF8;
            return encoding.GetString(ms.ToArray());
        }

So basically just call EncryptText(password) to encrypt and DecryptText(encrypted_password) to decrypt.