Changing Credit Card Encryption

PeopleTools Encryption Technology is an advanced security framework that provides a security model for applications to encrypt credit card data. The system encrypts data using algorithms and encryption keys. The system also modifies the display of credit card numbers to show only the last four digits. The system displays an X in place of each credit card number other than the last four digits. This includes credit card numbers that are display-only as well as those that are editable.

These steps must be performed in PeopleTools before you can generate new credit card encrypted numbers:

1. Use the Administer Encryption Profile page to create the credit card profile.

   PeopleTools > Security > Encryption > Encryption Profiles

2. Use the Algorithm Keyset page to create the Keyset ID and Key Text.

   PeopleTools > Security > Encryption > Encryption Algorithm Keysets

   • The Keyset ID on the Algorithm Keyset page should be the same as the SYMMETRICKEY field of the Administer Encryption Profile page.

   • The Key Text field on the Algorithm Keyset page should be the same for all Keyset rows for the encrypt and decrypt algorithm.

See also the product documentation for PeopleTools: Security Administration, “Securing Data with PeopleSoft Encryption Technology.”

Use the Manage Credit Card Encryption (FS_CC_CNVRT) page to change the profile ID used to encrypt and decrypt credit card numbers for all tables in your Financial and Supply Management system, and to re-encrypt credit card numbers using the new profile ID.

Navigation:

Set Up Financials/Supply Chain > Upgrade > Manage Credit Card Encryption

This example illustrates the fields and controls on the Manage Credit Card Encryption page. You can find definitions for the fields and controls later on this page.

When this process completes, all products begin to use the new encryption and decryption profiles.

If you want to decrypt the existing credit card data using 3des algorithm, the credit conversion process must be run. Encryption and decryption profiles will be populated under existing encryption profiles group box on the credit card conversion process page before running the existing 3des algorithm. New encryption/decryption profiles using aes algorithms can be selected under the New Encryption Profiles group box. Once selected and the conversion process is run, the credit card data encrypted using 3des algorithm will be decrypted and encrypted with profiles using aes algorithms. The conversion process can be run multiple times to decrypt and re-encrypt using various algorithms.

If the original implementation has been customized in any way (For example, replacing or altering the 3des encryption), it is strongly recommended that the changes be thoroughly reviewed and validated before integrating or deploying the updated solution delivered in Patch 37384713. After uptake of this patch, existing credit card data encrypted using 3des algorithm will continue to be encrypted using 3des algorithm as in code below, provided the credit card conversion automatic encryption process is not run.

In the code below, if no row exists in PS_FS_CC_CNVRT_PRF then the system will continue to use PS_CREDIT_CARD_ENCRYPT encryption profile which uses 3des algorithm for encryption. And like wise continue to use PS_CREDIT_CARD_DECRYPT decryption profile which uses 3des algorithm for decryption.

Function encryptcc(&FIELD1, &FIELD2)
   Local boolean &UseStrongEncryption;
   Local Crypt &CCCrypt = CreateObject("Crypt");
   &UseStrongEncryption = True;
   &FIELD2 = "";
   
   If &UseStrongEncryption Then
      If All(&FIELD1) Then
         SQLExec("SELECT CRYPT_PRFL_ID FROM PS_FS_CC_CNVRT_PRF", &encrypt_profile);
         If None(&encrypt_profile) Then
            &encrypt_profile = "PS_CREDIT_CARD_ENCRYPT";
         End-If;
         &CCCrypt.Open(&encrypt_profile);
         &CCCrypt.UpdateData(&FIELD1);
         &FIELD2 = &CCCrypt.Result;
      End-If;
   End-If;
End-Function;

Function decryptcc(&FIELD1, &FIELD2)
   Local boolean &UseStrongEncryption;
   Local Crypt &CCCrypt = CreateObject("Crypt");
   
   &UseStrongEncryption = True;
   &FIELD2 = "";
   
   If &UseStrongEncryption Then
      If All(&FIELD1) Then
         SQLExec("SELECT CRYPT_PRFL_DECRYPT FROM PS_FS_CC_CNVRT_PRF", &decrypt_profile);
         If None(&decrypt_profile) Then
            &decrypt_profile = "PS_CREDIT_CARD_DECRYPT";
         End-If;
         &CCCrypt.Open(&decrypt_profile);
         &CCCrypt.UpdateData(&FIELD1);
         &FIELD2 = &CCCrypt.Result;
      End-If;
   End-If;
End-Function;