data encryption in hitachi solutions ecommerce

© Hitachi Solutions. 2015. All rights reserved.

Data Encryption in Hitachi Solutions Ecommerce


Contents

1. Feature Overview

2. Generate custodian key phrases

3. New encryption key generation

4. Apply new encryption key

5. Manager Panel and Web Store disabled during encryption

2


Feature overview

• Split knowledge and dual key control – Two separate CSRs/custodians are required to generate the two encryption

pass phrases, and neither CSR knows the pass phrase generated by the other. Both CSRs/custodians are required to

construct the whole pass phrase.

• Auto-generated machine keys – The encryption keys/ passphrases can be manually generated or are auto-

generated. However, the key custodians do not need to be write them down or keep in a safe place physically. The

keys cannot be retrieved once used by the system. This makes the re-encryption process even more secure.

• Compliance with PCI PA-DSS requirements- The re-encryption process complies with PA DSS requirements 2.4

and 2.5, as well as PCI DSS requirements 3.5 and 3.6.

• Self-serviceable Manager Panel process - The re-encryption process is initiated via the Manager Panel making it

convenient for the CSR to easily schedule the process after the PCI recommended 90 day period. The encryption

process can also be cancelled if required via the same Manager Panel.


Only the Security Administrator or the Organization Administrator can generate the custodian key phrases via the Manager Panel. Two pass phrases are required to generate the complete key. The pass phrases can be auto-generated by the system. If the CSR wants to create the pass phrase manually, then it is mandated that it should be more than 20 characters long and contain numbers, alphabets and special characters.

Generate custodian key phrases


Each of the two pass phrases is required to be generated by two separate key custodians/ CSRs. Once a custodian has generated a pass phrase, the same custodian would be denied access by the system to the second key generation page. After the two pass phrases have been entered, they are combined to generate the complete key for starting the re-encryption process. To ensure complete security of the re-encryption process, the keys are not saved and cannot be retrieved by the CSRs once they have been entered into the system.

Split knowledge and dual key control


Once both passphrases have been entered the CSR can schedule the encryption schedule. Clicking the ‘Start New Key Generation’ button generates the new encryption key. Generating a new key necessitates that the data is re-encrypted using the new key.

Start new key generation process


During the new key generation process, all relevant entities are moved to a separate table and the encryption process undertaken. This allows business to function as usual without any impact on web store or Manager Panel transactions. The CSR can monitor the progress of the encrypted entities under the Encryption Status grid. The grid displays the number of entities that will undergo the encryption process.

Start new key generation process (cont.)


Apply new encryption key

Clicking the ‘Apply new encryption key’ button would allow the CSR to schedule the encryption process as per business convenience. The data re-encrypted during the new key generation process will be moved to actual entities. Any new data generated during the intervening period would be taken up at this time and re-encrypted along with the other entities.


Once the new key application process is initiated, a warning message is displayed on the Manager Panel and web store informing the user about the re-encryption process schedule and asking them to save their work. The Manager Panel and web store are disabled and not available for any transactions while the new key is being applied. In case the process does not run for reasons such as network problems or other technical reasons, new key will not be applied, and any encryption that may have happened will be rolled back to avoid data corruption issues. The CSR can view the reasons for failure in the audit log and make necessary corrections before restarting the encryption process.

Manager Panel and Web Store disabled during encryption


Thank You.

data encryption in hitachi solutions ecommerce

Software