Setting Up the Encryption Framework

Use the Encryption Administration component to access the pages that are used to configure the Encryption Framework. Pages appear in the navigation collection for easy access.

Administrators must have the Encryption Configuration Admin role to access this setup component.

This example illustrates the Encryption Administration component, which lists pages that used to set up the Encryption Framework in HCM.

Video: Image Highlights, PeopleSoft HCM Update Image 39: HCM Encryption Configuration

Here are the high-level steps for setting up the Encryption Framework:

1. Set up the administrator(s) with the new Encryption Configuration Admin role. This role allows the administrators to access the Encryption Administration component and configure the framework.

   Additionally, if you want the administrator(s) to be able to view unmasked data after encryption is run, create a role and assign it to the administrator(s). Add this role to the Grant Unmasked Access Page of the source records that store the data to be encrypted. Both Global Payroll for United States and Payroll for North America deliver user roles for this purpose.

2. Select the Enable Encryption check box on the HCM Options Page of the Installation Table.

3. Create Encryption and Decryption profile IDs to use in the framework. You may use existing profile IDs you have already created provided they are not based on 3DES algorithm, or create new profile IDs. Do not use any of the profiles provided as sample data.

   The 3DES encryption algorithm is now considered obsolete and is maintained for backward compatibility only. It is recommended that you create a new set of Encryption and Decryption profiles not based on 3DES and instead use another similar, but stronger algorithm (e.g., AES).

   For more information on Profiles, see the Defining Encryption Profiles topic in PeopleTools: Security Administration, “Securing Data with PeopleSoft Encryption Technology”.

   For more information on Encryption Algorithms, see the Privacy Through Encryption section of the Understanding Data Security topic in PeopleTools: Security Administration, "Securing Data with PeopleSoft Encryption Technology".

4. Review and update the Encryption Administration pages to set up the framework as needed.

   • Define Country for Encryption Page

   • Define Source Records Page

   • Define Process Records Page

   • Map Batch Processes Page

5. Run the Encryption process on the Manage Encryption and Masking Page.

Refer to these topics for additional information about the data encryption implementation that is specific to applications:

Understanding Data Encryption for Global Payroll for United States

Understanding Data Encryption for Payroll for North America

Use the Define Country for Encryption page (HSC_ENCCTRY) to add countries that need to encrypt and mask sensitive data.

Navigation:

Set Up HCM > Common Definitions > Encryption Configuration > Encryption Administration > Define Country for Encryption

This example illustrates the fields and controls on the Define Country for Encryption page.

Use the Define Source Records page (HSC_CRYPTRUN) to define encryption criteria.

Navigation:

Set Up HCM > Common Definitions > Encryption Configuration > Encryption Administration > Define Source Records

This example illustrates the fields and controls on the Define Source Records page before the encryption process is run. Fields in the Encryption Criteria section are read-only.

This example illustrates the fields and controls on the Define Source Records page after the encryption process is run, in which the fields in the Encryption Criteria section become editable.

This screenshot shows the system-delivered data for Payroll for North America, which includes the DIR_DEP_DISTRIB (direct deposits), GARN_SPEC (garnishment), and SRC_BANK (source bank) source records. To comply with Nacha requirements, do not change the delivered data.

Use the Field Mapping page (HSC_FLDSEL_SEC) to view or change the field mapping of the data to be encrypted.

Navigation:

Click the Edit Fields button on the Define Source Records page.

This example illustrates the fields and controls on the Field Mapping Page, which is displayed in read-only mode when the source record is encrypted.

This screenshot shows the Payroll for North America setup example, where the ACCOUNT_NUM field stores the sensitive data (bank account numbers) in the DIR_DEP_DISTRIB source record, and the PY_BANKACCCRYPT field, a new field added to the same source record to store the encrypted data of the account numbers after the encryption process is run.

This page becomes editable when the source record is decrypted.

Use the Grant Unmasked Access page (HSC_ROLESEL_SEC) to specify roles for users to view unmasked data after data is encrypted.

Navigation:

Select the Grant Unmasked Access button on the Define Source Records page.

This example illustrates the fields and controls on the Grant Unmasked Access page.

Use the Define Process Records page (HSC_MASKREC) to define process records for batch processes that display unmasked data.

Navigation:

Set Up HCM > Common Definitions > Encryption Configuration > Encryption Administration > Define Process Records

This example illustrates the fields and controls on the Define Process Records page.

This screenshot shows the system-delivered data for Payroll for North America, which is the DIR_DEP_DISTRIB source record. To comply with Nacha requirements, do not change the delivered-system data for the Process Record and Process Stage Record fields.

Some applications have batch processes that display the sensitive data in its actual, unmasked form in the output files. For example, the account numbers that appear in direct deposit transmit files created by the DDP001 process need to be unmasked. For the unmasked data to display in its outputs after the encryption is run, the batch process (DDP001) copies the required data from the process record (defined on this page) to perform data unmasking in the stage record. The stage record structure must match the process record + one additional key field PROCESS_INSTANCE as the first key field.

Use this page to define an association between a process record (where the masked data is stored) and a source record (from where the application batch process retrieves the encrypted data to unmask the data coming from the process record).

Use the Manage Encryption and Masking page (HSC_CRYPT_RCTL) to run the encryption process for specified source records.

Navigation:

Set Up HCM > Common Definitions > Encryption Configuration > Encryption Administration > Manage Encryption and Masking

This example illustrates the fields and controls on the Manage Encryption and Masking page.

Use the Encryption Details page (HSC_COUNTRY_SEC) to view the list of countries whose data set from the source record is encrypted.

Navigation:

Select the Encrypted link on the Manage Encryption and Masking page.

This example illustrates the fields and controls on the Encryption Details page.

Use the Map Batch Processes page (HSC_PRCSSTG_MAP) to identify application batch processes that display unmasked data in output files.

Navigation:

Set Up HCM > Common Definitions > Encryption Configuration > Encryption Administration > Map Batch Processes

This example illustrates the fields and controls on the Map Batch Processes page.

This batch process mapping is used to identify application batch processes that are required to output the actual data. Without this configuration, application batch processes will always show masked data in the output.

This screenshot shows the system-delivered data for Payroll for North America. To comply with Nacha requirements, do not change the delivered data.

This setup step is not required for Global Payroll for United States.

Use the Process Records page (HSC_PRCSMSK_SEC) to view the process record setup for the application batch process.

Navigation:

Select the Process Records link on the Map Batch Processes page.

This example illustrates the fields and controls on the Process Records page.

The source record, process record, and process stage record setup is defined on the Define Process Records Page.

Use the Maintain Process page (HSC_PRCSCLEANUP_RC) to clean up residual data from the staging tables of the encryption process.

Navigation:

Set Up HCM > Common Definitions > Encryption Configuration > Encryption Administration > Maintain Process

This example illustrates the fields and controls on the Maintain Process page.

This section describes what needs to be done when you want to encrypt data for a new country, using Payroll for North America as an example.

Suppose that you ran the encryption process to encrypt direct deposit account numbers for USA to comply with Nacha requirements. Now, you have decided to run it for Canada as well to enhance data security. You need to decrypt all encrypted data from the source record, add the new country, and encrypt data for all selected countries.

Follow these steps:

1. Run the decryption process on the Manage Encryption and Masking Page to decrypt all direct deposit account numbers previously encrypted for USA.

   Select the Decrypt action for the DIR_DEP_DISTRIB source record. Run the process. After the process completes, all account numbers for USA will be unmasked in the database.

2. Add CAN to the country list on the Define Country for Encryption Page. The page now shows both USA and CAN.

3. Run the encryption process on the Manage Encryption and Masking Page to encrypt direct deposit account numbers for both countries.

   Select the Encrypt action for the DIR_DEP_DISTRIB source record. Run the process. After the process completes, all account numbers for USA and CAN will be masked in the database.

4. Run the Mask Direct Deposit Audit Rcd process. This process masks the direct deposit account numbers for Canadian employees. Previously masked account numbers remain unchanged.

   Note that the Mask Direct Deposit Audit Rcd process can be run to mask account numbers in the audit records for direct deposits and general deductions. For more information, see Audit Records.

This procedure applies to other scenarios involving different source records and countries.