11/27/2024 12:23:10 AM
|
| |
| slxdeveloper.com Community Forums |
|
| |
|
|
The Forums on slxdeveloper.com are now retired. The forum archive will remain available for the time being. Thank you for your participation on slxdeveloper.com!
Forum to discuss writing script in Architect plugins for SalesLogix & general SalesLogix customization topics (for Windows client only). View the code of conduct for posting guidelines.
|
|
|
|
Encrypting database columns?
Posted: 13 Dec 06 4:43 AM
|
fiogf49gjkf0d SLX 6.2.3
Is it possible to have a column in a custom table in the SLX database encrypted? We have been asked if it possible to store credit card information in SalesLogix. I know about the PCI regulations on storing credit cards, but at the technical level would it be possible to store them encrypted, and then unencrypt the last four digits for display?
|
|
|
|
Re: Encrypting database columns?
Posted: 13 Dec 06 12:12 PM
|
fiogf49gjkf0d In much of the product you can not do "on the fly" decryption so you will have to store the data exactly how you want it to be displayed (assuming this will be accessed via reports, groups, etc). For the data entry side you will have to programmatically encrypt the data as there is no "encryption control". This is definitely something you can do, it just takes some code.
1. the user enters the data
2. the user saves the form
3. you modify the data to be encrypted
4. the data posts to the database
BTW I am also assuming you are trying to prevent SalesLogix users from seeing the data unencrypted. If this is not the case and you are concerned with theft or hacking, etc. there are tools for encrypting databases and entire hard drives for that matter. I have never used any of them so I can not recommend any products.
Timmus |
|
|
|
Re: Encrypting database columns?
Posted: 13 Dec 06 2:03 PM
|
fiogf49gjkf0d You have to answer a simple question: Do your users ever need to see the result?
For passwords, a string is encrypted using a 1 way hash. To verify the password a string is encrypted and compared to the hash. At no time is the original password known or retrievable. For a credit card # you would basically be verifying if the number you're given is hashed to the number stored, which in most cases is ideal.
For a more complex type, you have to store a way to retreive the data. I believe this is called the key, but I'm a little confused when it comes to the terms. It's a better idea to use as many keys as possible, possibly one per account or so in the event that a hacker gets a copy of 1 key, the entire database isn't compromised.
There are existing functions in SLX that can be used to generate a hash. For more complicated cyphers, you either have to find a COM wrapper or make a .NET Extension for v7. .NET's cyphers are top notch so I'd go that route if I needed a way to retrieve the decrypted value. |
|
|
|
You can
subscribe to receive a daily forum digest in your
user profile. View the site code
of conduct for posting guidelines.
 Forum RSS Feed - Subscribe to the forum RSS feed to keep on top of the latest forum activity!
|
|
|
|
|
|
|
|