Configure field level encryption

Applies to: On premises

You can encrypt specific fields in the IBM OpenPages® repository to prevent system administrators from viewing confidential data directly from the database. Data in encrypted fields is shown as a string of random characters.

Simple string and long string field data types are supported.

Fields that are encrypted are not eligible for use in Global Search.

Note: Before encrypting long strings in OpenPages running on Oracle 12.2, refer to the following Technote: http://www.ibm.com/support/docview.wss?uid=swg22010106. The Technote describes a potential issue and how to resolve it by obtaining the appropriate patch from Oracle support and applying it to your environment. The IBM OpenPages reporting framework handles encrypted fields by running a database function to decrypt them. When a long string (CLOB) field is made encrypted, the framework must be regenerated to call this database function. For more information, see Generating the reporting framework.

Restrictions:

  • The maximum size of long strings that can be encrypted is 2 MB.
  • Do not include encrypted long string fields in the search criteria for a filter because they can return unexpected results.
You need to do the following tasks to use field level encryption:
  • Create a file that contains the encryption keystore and key pair. See Create the encryption keystore file and key pair.
  • Set up the encryption keystore. Setting up the encryption keystore
  • Place the keystore file on the application servers in your environment.
    In a horizontal environment, the keystore file must be available to each application server. There are two options:
    • Each application server must have access to the file location on the admin application server.
    • The file must be available in the same location on each application server.

    In a non-clustered environment, place the keystore file on the admin application server.

  • Enable the keystore. See Enabling the encryption keystore.
Note: If you already configured field level encryption but the properties of the key changed, see Updating the encryption keystore.