ORACLE 11g TDE (Transparent Data Encryption) on SAP ERP - Performance Impact ???

[Former Member]

Hello All,

We are in the process of implementing the Oracle TDE on SAP ERP 6.0 to help us encrypt the personnel / secret data that we have accumalated in the years of using ERP.

I have a couple of questions and appreciate you sharing any experience you may have in this topic:

     1. Performance: We are a 5 TB DB on Oracle 11g [11.2.3] ERP shop and have a HUGE concern on the Performance impact DURING / POST the TDE implementation, has anyone with this size have performed TDE and have experienced any issues / learning lessons to share ???

     2. Capacity: We are currently running our SAP ERP 6.0 EHP4 on the HP-UX B.11.31 hardware on U ia64  with Oracle 11g with . Do we need to consider adding more CPU / memory power to support any performance impact. We are cuurently using 30+Gb memory with 10 Dual Core CPU's.

Please share your learning to help us understnad the impact to implement TDE.

Thanks,

Gaurang

[stefan_koehler]

Hi Gaurang,

well as far as i understand it correctly, your concerns are mostly / only about performance and hardware utilization after implementing TDE, right?

I did some performance troubleshooting (with TDE tablespace encryption enabled, but the root cause was not related to TDE in that cases), but only on CPUs with "Hardware cryptographic acceleration" (in my case Intel AES-NI). Examples of these CPUs can be found here: Oracle Advanced Security Transparent Data Encryption Best Practices

Oracle stated the following in the mentioned white paper:

Internal benchmark tests and customers reported a performance impact of 4 to 8% in end user response time, and an increase of 1 to 5% in CPU usage.

Intel itself published a performance benchmark without and with AES-NI here (page 3): Encrypt Healthcare Data with Performance Using Intel® Xeon® Processors

The impact itself  depends on the "type of TDE" (TDE Column or Tablespace Encryption). These populated values are  in the range of my experience, but it also depends on the "main driving part" of performance for the und user. Just a simple example: If your business process is totally database driven (let's say 95 % for a dialog end user) and it usually takes 2 seconds. After implementing TDE it may take 2.152 seconds (by 8 %), but your end users usually do not notice that at all, right? .. even better if your SLA is based on 2.5 or 3 seconds .. this picture may be reverted, if you take a look at long running batch processes for example. So the noticeable impact depends on your database usage and processes.

> Do we need to consider adding more CPU / memory power to support any performance impact. We are cuurently using 30+Gb memory with 10 Dual Core CPU's.

Depends on the used TDE type, your current utilization, business processes and targets of course.

Regards

Stefan