Search Results cipher_data

Overview

The APPS.IBY_SECURITY_PKG package body is the core cryptographic and data-protection engine within the Oracle Payments (IBY) module of Oracle E-Business Suite 12.1.1 and 12.2.2. Its principal business function is to safeguard sensitive payment instrument data — most notably credit card numbers, bank account details, security codes (CVV), and personal identifiers — throughout their lifecycle in the payments flow. The package implements key management, symmetric encryption, cryptographic hashing, data masking, and reversible encoding so that payment instrument information can be stored, transmitted, and displayed without exposing raw cleartext to unauthorised users, reports, or interfaces. It underpins the Payments security model that supports PCI-DSS obligations by combining system-level subkeys, site salts, and hash verification to protect cardholder and account data at rest and in transit.

Key Procedures and Functions

The package exposes 49 documented procedures and functions, which group into several functional areas:

• Key management: VALIDATE_SYS_KEY, CREATE_SYS_KEY, and CHANGE_SYS_KEY collectively create, verify, and rotate the system-level encryption key. GET_SYS_SUBKEY and GET_SYS_SUBKEY_HEX derive individual subkeys used to encrypt distinct data elements, ensuring isolation between fields.
• Encryption and hashing: CIPHER_DATA performs the core encryption operation, while GET_HASH, COMPUTE_NEW_HASH, GET_RAW_HASH, and GET_KEY_HASH generate and verify cryptographic hashes for integrity and lookup purposes without revealing cleartext.
• Cleartext preparation: PREPARE_CLEARTXT and UNPACK_CLEARTXT format and reverse the formatting of cleartext prior to and following cryptographic processing.
• Salt handling: GET_SITE_SALT and GET_SALT_VERSION retrieve the site-specific salt and its version, used to strengthen hashes and support controlled rotation.
• Masking and unmasking: MASK_DATA and MASK_DATE_FIELD render sensitive values partially obscured for display; GET_UNMASKED_DATA recovers the original value for authorised processes.
• Encoding: ENCODE_NUMBER, DECODE_NUMBER, and ENCODE_CVV convert numeric and security-code values into protected representations and back.

Tables Accessed

The package reads and writes several IBY configuration and security tables through APPS synonyms. IBY_SYS_SECURITY_OPTIONS, IBY_SYS_SECURITY_SUBKEYS, and its _S shadow table store system security settings and subkey definitions. IBY_SECURITY_SEGMENTS and IBY_SECURITY_SEGMENTS_S define how security is segmented across the application. IBY_PAYEE_SUBKEYS holds payer/payee-specific subkeys, while IBY_CREDITCARD and IBY_CREDITCARD_ISSUERS_B hold encrypted card records and issuer data. Transaction and transmission tables — IBY_TRXN_SUMMARIES_ALL, IBY_TRANSMIT_VALUES, IBY_TRANSMIT_CONFIGS_B, IBY_TRANSMIT_PARAMETERS_B, and IBY_BEP_ACCT_OPT_VALS/IBY_BEP_ACCT_OPT_NAME_B — are accessed during encryption, decryption, and transmittal of payment data. It also depends on FND_CRYPTO, FND_VAULT, FND_GFM, FND_API, FND_GLOBAL, FND_LOG, and IBY_UTILITY_PVT, and uses DBMS_OBFUSCATION_TOOLKIT, UTL_RAW, and V$NLS_PARAMETERS.

Usage Notes

Although the package is not referenced directly by any database object, it is referenced by 32 other packages — a signal that it is a foundational utility invoked across Oracle Payments internals. It is typically called when credit card or bank account data is captured or updated through Payments forms, when payee and payment instrument records are inserted or modified, when secure data is transmitted to payment systems or banks, and when masked values are displayed in query-only forms. Administrators may invoke its key-management routines (such as CREATE_SYS_KEY or CHANGE_SYS_KEY) during initial Payments configuration or key rotation. Custom code should avoid calling this package directly where public Payments APIs exist, because its procedures assume the system security options, subkeys, and salts are already configured and consistent.