Optimizing the MigrateEncryptedInfo utility
MigrateEncryptedInfo is a utility that is used for re-encrypting sensitive data that is stored in the database. It executes two tasks within this utility and each of the tasks is controlled by a separate configuration file.
- WC_installdir/bin/MigrateEncryptedInfo.sh
- WC_installdir/bin/MigrateEncryptedInfo.bat
When you open up the MigrateEncryptedInfo script, you can see that there are two calls to MKChangeApp. Each of these calls represents a distinct task that the script performs.
Task one
The first task enforces that the sensitive data in the database is consistent with the PDIEncrypt flag specified in the instance configuration file. If this task detects that the data and the PDIEncrypt flag are out of sync, it migrates the data to the current merchant key. By default, this task is commented out.
If the PDIEncrypt flag value is changed, it means you want to encrypt the data from plain text or decrypt the data to plaintext. You can manually enable this part in the MigrateEncryptedInfo script. The default value of PDIEncrypt flag is on.
For example, if the data in the database is in plain text, but you want it to be encrypted, change the PDIEncrypt setting in the instance configuration file to "on". Then, enable this part in MigrateEncrytedInfo script and run this task. Once the PDIEncrypt flag is enabled, any subsequent data that is entered into the database is also encrypted. Alternatively, if the data in the database is encrypted, but you want it to be in plain text, change the PDIEncrypt setting in the instance configuration file to "off". Then, enable this part in MigrateEncryptedInfo script, and run this task to decrypt the existing data. Any subsequent data that is entered into the database is also decrypted.
The following sections of the MigrateEncryptedInfo script need to be enabled:
# echo "#######################" >> $WCLOGDIR/MigrateEncryptedInfoError.log
# echo "### CCInfoMigration ###" >> $WCLOGDIR/MigrateEncryptedInfoError.log
# echo "#######################" >> $WCLOGDIR/MigrateEncryptedInfoError.log
# cp -f CCInfoDBUpdate.$DBTYPEEXT.txt $WCTEMPDIR/DBUpdate.txt
# cd $WCTEMPDIR
# ${JAVA_EXE?} -Xmx512m -DnewKeyNeeded=true -DInstanceXMLFileAccess.debug=true -DReencryptionRequestDispatcher.debug=true -DReencryptionTask.debug=true -Dwclogdir=$WCLOGDIR -cp $CP com.ibm.commerce.dbupdatetool.MKChangeApp "action1_2" $WCINST $param3 $param4 $param5 $param6 $param7 $interactive_output > $WCLOGDIR/CCInfoMigration.log 2>> $WCLOGDIR/MigrateEncryptedInfoError.log
# if [ "$?" = "1" ]
# then
# echo "Migration failed. Please check $WCLOGDIR/CCInfoMigration.log and $WCLOGDIR/MigrateEncryptedInfoError.log for details."
# rm -f DBUpdate.txt
# cd $WCS_HOME/bin
# exit 1
# fi
# rm -f DBUpdate.txt
# cd $WCS_HOME/bin
The following sections of the MigrateEncryptedInfo script need to be enabled:
REM Echo ####################### >> %WCLOGDIR%\MigrateEncryptedInfoError.log
REM Echo ### CCInfoMigration ### >> %WCLOGDIR%\MigrateEncryptedInfoError.log
REM Echo ####################### >> %WCLOGDIR%\MigrateEncryptedInfoError.log
REM copy CCInfoDBUpdate.%DBTYPE%.txt %WCTEMPDIR%\DBUpdate.txt >nul
REM cd %WCTEMPDIR%
REM %JAVA_HOME%\bin\java -Xmx512m -DnewKeyNeeded=true -DInstanceXMLFileAccess.debug=true -DReencryptionRequestDispatcher.debug=true -DReencryptionTask.debug=true -Dwclogdir=%WCLOGDIR% -cp %CP% com.ibm.commerce.dbupdatetool.MKChangeApp "action1_2" %2 %3 %4 %5 %6 %7 %interactive_output% > %WCLOGDIR%\CCInfoMigration.log 2>> %WCLOGDIR%\MigrateEncryptedInfoError.log
REM if errorlevel 1 goto exec_failed1
REM del DBUpdate.txt
REM cd ..\bin
- WC_userdir/bin/CCInfoDBUpdate.DBTYPE.txt
- WC_installdir/bin/CCInfoDBUpdate.DBTYPE.txt
- WC_installdir\bin\CCInfoDBUpdate.DBTYPE.txt
Task two
- WC_userdir/schema/DBTYPE/migration/DBUpdate.txt
- WC_installdir/schema/DBTYPE/migration/DBUpdate.txt
- WC_installdir\schema\DBTYPE\migration\DBUpdate.txt
- ReEncryptUserPasswords
- The first action item, ReEncryptUserPasswords, migrates user passwords (stored in the USERREG table) to the new password scheme (one way hashed), and to the new merchant key. Due to security improvements, if you are migrating the database from a version of WebSphere Commerce earlier than version 5.4, running the ReEncryptUserPasswords action is mandatory to encrypt the user passwords to the new format. This action also migrates user passwords to a new merchant key.
- ReEncryptUserPasswordHistory
- The next action item, ReEncryptUserPasswordHistory, migrates old user passwords (stored in the USERPWDHST table) to the new merchant key. If you configured a password policy to store previous passwords, you need to run this action.
- ReEncryptCreditCards
- The third item in the configuration, ReEncryptCreditCards, re-encrypts credit card data using a new merchant key. This action is required if the PDIEncrypt flag is "on" in the instance configuration file and credit card data needs to be re-encrypted with the new key. The data in the following tables are processed as part of this action:
- ReEncryptGiftCenterUserPasswords
- Migrates gift center user passwords (stored in the GRUSERAUTH table) to the new merchant key. If you are not using Gift Registry, you do not need to run this action item.
Minimizing the running time of the MigrateEncryptedInfo utility by eliminating unnecessary actions
The MigrateEncryptedInfo utility reads database data first before it checks whether re-encryption needs to be performed against the retrieved data for each action. If you know ahead of time certain tasks do not apply to your site configuration, you can customize the script such that these tasks are not performed. Customizing the script saves some time in reading and processing the data. This is especially valuable if you have a large data set.