The encryption key rotation process itself involves two phases. In the first phase, a user with appropriate application permissions must log into OPERA utilities and provide a series of strings that will be used to generate a new encryption key. The application provides the ability for up to four separate individuals to input an eight character string that will be combined to generate the final key. At a minimum, We are recommends two individuals provide strings at this phase of the process.
Once four eight character strings have been provided, the OPERA application will perform a series of steps where records to be updated are identified. Through these steps and the remainder of the first phase, OPERA users may continue to use the system as normal.
After the first phase has finished, all users must log out of the application, all running services must be stopped, and an external executable must be invoked. This external program puts the final key in place and finalizes the re-encryption of existing data. In the process of performing these steps, several database level objects are invalidated, so the utility will finish by completing a compilation of any invalid objects. On average, this downtime window lasts from 15 – 30 minutes.
To streamline the individual steps involved, the utility described throughout this document should be employed.
Note: Recommends that phase 2 should be initiated immediately after the completion of phase 1.