Re: Triggers - READ

["Booth Martin" <Booth@xxxxxxxxxxxx>]

I did this for a client a few years ago.  The way we solved it was with a
specific program that returned the data in the format required.  As I
remember it the returned field was 18 or 19 characters long and could
contain all asterisks, or asterisks followed by the last four digits.

The program had adopted authority, so no one could reach the program
excepting through authorized programs.  Within the program itself there was
a password process that would allow viewing the whole number in a window,
however the whole number was never passed back to the calling program.  The
password setting process was fairly simple, and the password was passed
around to authorized users.  It was a call center operation so the number
had to be easily available.  Security was important but they still had to be
able to do business in a prompt manner.

The data file itself had some sort of column level security on the credit
card fields, but I don't remember the details of that part of the problem.
 
 
 
---------------------------------------------------------
Booth Martin   http://www.MartinVT.com
Booth@xxxxxxxxxxxx
---------------------------------------------------------
 
-------Original Message-------
 
From: Midrange Systems Technical Discussion
Date: 12/30/2003 1:25:46 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: Triggers - READ
 
Loyd,
 
The application is Credit Card related.  They are wanting to be able to
have the data encrypted so that only some one using a program with the
decrypt API could get to the data.  Since I just started this job 3 weeks
ago I can't get into the specifics as to why or why not using regular
authority verses encryption.  But do know they only want certain people to
see whole number, others only last 4 digits, and no one to be able to see
the data raw (ie: queries, copyfiles, etc.), only way to get to it would
be with program that calls the decrypt module.  I think this is being
required by CC Co., but can't swear to it.
 
Sorry for the delay, been off for the Holidays.
 
-- Jim
 
 
 
 
Just wondering... how would the read trigger know when to decrypt the
fields
and when not? Who does the trigger program trust? Is this a regulatory
thing
(HIPPA) or a trust issue?
 
The encryption is of no use against the programmer(s) who have access to
the
source. If the files contain the right permissions/authorities, only those
users who need to have access already know the contents of the encrypted
fields.
 
What business problem would this solve?
 
(I'm not trying to be mean here but you piqued my curiosity.)
 
Loyd