Application Encryption
The functionality described in this section allows implementations to configure fields to encrypt when storing it in the database. This functionality is mutually exclusive from the User Interface Masking functionality described in the previous section. This feature supports encrypting specific elements stored within a CLOB or XML column.
The following points highlight the features of the encryption functionality:
• The encryption key is defined using a keystore, which must be set up in order to use this functionality. For details about setting up the keystore in the system, see the Installation Guide.
• When a field is configured to be encrypted, the encrypted data is stored in a special encryption field that is not the source field (the one exposed to the user on the user interface). The source field captures the data as masked. Because a special field is required to support encryption, the product must provide support for that field to be encrypted.
• For encrypted data that must allow searching, the system supports capturing a hash value in a special field. The product must provide support for this functionality. Besides providing a special field to capture the hash value, base search functionality for that data must also cater for this configuration.
• The system supports encrypting data that is captured as an element within an XML field. If the XML field is provided in a schema owned by the product, then the product must provide specific support for the capture of the encrypted data.
The following sections provide additional information about the support for encryption provided by the framework. Refer to the security chapter of the administration guide for your particular product for more information.
Encrypting and Masking the Data
When a product enables encrypting for a given type of data, a special encryption field should be created to capture the encrypted value. Because encrypting is optional, the source field (the one exposed to the user) should not be this special encrypted field. If encryption is configured, the system will internally populate the encrypted field. The source field will be populated with asterisks by default. That way the masked data is what is shown to the user on page rather than the encrypted value.
The following points highlight how the system behaves when encryption is configured and when it is not. Assume as an example, the field is a credit card number. The user views and populates a field with the field name CC_NBR. The table also has a second field ENCR_CC_NBR. A user populates the credit card number:
• If encryption is not configured, CC_NBR will be updated with the entered credit card number and ENCR_CC_NBR will be empty. Note that in this case, an implementation may choose to configure
user interface masking.
• If encryption is configured, CC_NBR will be updated with ‘*******************’ and ENCR_CC_NBR will contain the encrypted value. The asterisks for the standard field will fill the full field size up to 50 characters.
If for some reason the standard masking using all asterisks is not desired, the system supports supplying an explicit masking algorithm using the same Feature Configuration - Data Masking plug-in spot used for
User Interface Masking.
Warning:
Unlike user interface masking, the masking of encrypted fields is not driven by security. The data stored in the source field for all encrypted data should be masked. Be sure not to configure security authorization logic in algorithms used for this type of masking.
Feature Option Configuration
Create a feature configuration with a Feature Type of Encryption. For each source field you are encrypting, enter an option with option type of Field Encryption. The value will contain mnemonics that reference the appropriate encryption key alias defined in the keystore along with configuration related to the field and its table location. Unlike the user interface data masking, the configuration for data encryption is related to how the data is stored rather than how it is displayed. In addition, each entry may define an explicit masking algorithm to override the default and if supported, may also define a hash field and hash alias.
For data that is stored in a specific column on a table, an explicit field to capture the encrypted value must exist. Indicate the table name, source field name and encrypted field name along with the alias: table='table_name', field='fld_name', encryptedField='encr_fld_name', alias='alias key'
A "where" clause may also be specified when data resides in a child table and only data of a certain type needs to be encrypted.
Example, table='CI_PER_ID', field='PER_ID_NBR', encryptedField='ENCR_PER_ID_NBR', alias='key alias', where='ID_TYPE_CD='SSN''
For data that is stored in an XML column in a record, the source field to be encrypted must reference a meta-data field name in its schema definition along with the element that captures the encrypted data and the alias: field='field_name', encryptedField='encr_field_name', alias='key alias'
The syntax for adding a reference to a masking algorithm is maskAlg='algorithm name' .
The syntax for adding configuration for capturing a hash value for searching purposes is hashAlias='hashAliasKey' hashField='HASH_FLD_NAME'.
The following is an example of configuration that uses all the possible options (specific masking algorithm, where clause and hash field support):
table='CI_PER_ID', field='PER_ID_NBR', alias='aliasKey', encryptedField='ENCR_PER_ID_NBR', hashAlias='hashAliasKey' hashField='HASH_PER_ID_NBR', where='ID_TYPE_CD=SSN', maskAlg='CM-PERIDMASK'
Searching by an Encrypted Value
If the product supports a hashed value for an encrypted field for searching purposes, the following points highlight explorer zone configuration for this purpose
• The user filter value should reference the source field and should include an additional encrypt= mnemonic. For example
type=STRING
label=PER_ID_NBR
encrypt=[CI_PER_ID,PER_ID_NBR,ID_TYPE_CD,F1]
• The SQL should include the hashed value in the WHERE clause. Note that because encryption is optional, a product zone that includes searching by a field eligible for encryption will include finding a match for the filter in the source field (as plain text) or in the hashed field. For example:
WHERE
[(F2) (ID.PER_ID_NBR =:F2 OR ID.HASH_PER_ID_NBR = :F2)]
Customizing Encryption Algorithm
Although the encryption algorithm to use with a given key can be gleaned from the key in the keystore, there is sometimes extra information associated with an algorithm that might need to be used to encrypt or decrypt data.
The system provides a feature configuration option for the Encryption feature type using the option type Algorithm Info that can be used to adjust the behavior of the encryption.
• You can modify the default mode and padding of the encryption algorithm.
• If a key will be used to digitally sign anything, the signing algorithm can also be specified for the key.
For details about the syntax, refer to the feature option type’s detailed description.
Parent topic