Processing Encrypted SQL Data In ProIV
Posted 28 October 2013 - 01:43 PM
Does anyone have a solution for handling encrypted SQL Server data e.g. a credit card number? I already have a solution to encrypt it within ProIV but our CIO wants me to find him a purely SQL solution as well. The encryption has to be independent of ProIV so that non ProIV applications have access to the encrypted data as well.
E.g. the data is encrypted in the SQL table. I read that data into ProIV and some way decrypt it for use in my function. When I write the credit card number back to SQL, SQL encrypts it.
Posted 31 October 2013 - 02:57 PM
Posted 31 October 2013 - 03:09 PM
Yes, I think an SSO is the way to go but bypassing SQL all together. Wim Soutendijk responded to a post on the ProIV Forum website. He has developed an SSO that encrypts/decrypts a string based on a fixed encryption key. The encrypted data is written to SQL as a varchar. I'm currently working with a Java developer to enhance it so that instead of the fixed encryption key, we pass it the key. This way users have complete control over their encrypted data with the developer not having access. I will let you know how I make out with this solution.
Posted 04 November 2013 - 03:58 PM
// Function created to encrypt passwords via call to Oracle
// The dummy (SELECT '1' FROM DUAL WHERE 1 = 1) part of the statement is required to workaround the
// fact that ProIV will assume an implied WHERE statement if it sees a binded variable before
// locating a WHERE command and force the WHERE command just before the binded variable.
SELECT PASSWORD_HASHED, (SELECT '1' FROM DUAL WHERE 1 = 1)
FROM (SELECT SECUADMIN.HASH_VAL(:$PASSWORD) AS PASSWORD_HASHED FROM DUAL)
CREATE OR REPLACE function SECUADMIN.hash_val (p_in_val in varchar2)--, p_key in varchar2)
DBMS_CRYPTO.hash ( src => utl_i18n.string_to_raw (concat(p_in_val , 'salt value'),
typ => DBMS_CRYPTO.hash_md5
Reply to this topic
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users