PeopleSoft Encryption Technology Development

The functional elements of PeopleSoft Encryption Technology are:

  • A DLL for each supported encryption library, which uses C glue code to convert each cryptographic library's API into a unified plug-in with an API accessible from PeopleCode.

  • A universal keystore that handles all forms of encryption keys, protected with row-level security.

  • A sequence, or chain, of algorithms that you define for a specific type of encryption task.

    These algorithms are applied in turn to transform data from its original form into a desired final form.

  • An encryption profile, which you define as an instance of an algorithm chain, applicable to a specific encryption task.

  • The PeopleCode crypt class for accessing the algorithm chains that you define.

To develop and use an encryption profile:

  1. Obtain an encryption library.

    The current release of PeopleTools includes the OpenSSL encryption library.

  2. Develop API glue code to access the encryption library's algorithms.

    PeopleTools includes glue code already developed to support the delivered OpenSSL encryption library.

    The glue code combines with each library to create a plug-in accessible from PeopleCode. The plug-in can be an independent DLL file, or it can be incorporated into the encryption library file, which is the case with the delivered OpenSSL library.

    You can develop glue code to produce plug-in wrappers for other encryption libraries of your choice. The plug-ins make their APIs accessible to PeopleCode, and the new algorithms become as easily available as the delivered algorithms. You can find development information and examples of glue source code in PS_HOME\src\pspetssl.

  3. Load the encryption library's algorithms into the PET database, generate accompanying encryption keys, and insert them into the PET keystore.

  4. Define a chain of algorithms by selecting from the algorithms in the database.

    Because all algorithms are accessed from PeopleCode, you can combine algorithms from different libraries regardless of their source.

  5. Define an encryption profile, which is an instance of an algorithm chain applicable to a specific encryption task.

    With an encryption profile you can apply parameter values that differ from the default values.

  6. Test the encryption profile using the Administer Encryption Profile page.

  7. Write PeopleCode to invoke the encryption profile.

    With the delivered glue code, you can take advantage of the capabilities of these libraries through a single PeopleCode object. The PeopleCode crypt class provides an interface into all algorithms loaded from the underlying encryption libraries.