1 - DB2 User Defined Functions and APIs

This section provides a detailed list of functions and extended stored procedures for general functions, and protection and unprotection of different data types.

1.1 - General UDFs

This section includes list of general UDFs that can be used to retrieve the DB2 Protector version and the current user.

pty.whoami

The UDF returns the name of the user.

Signature:

pty.whoami()

Parameters:
None

Result:

  • This UDF returns the name of user logged on to the database as VARCHAR(256).

Example:

SELECT pty.whoami() FROM SYSIBM.SYSDUMMY1;

pty.getversion

The UDF returns the version number of the DB2 protector.

Signature:

pty.getversion()

Parameters:
None

Result:

  • The UDF returns the version number of the DB2 protector as VARCHAR(256).

Example:

SELECT pty.getversion() FROM SYSIBM.SYSDUMMY1;

pty.getcoreversion

The UDF returns the core library version, used with the DB2 protector.

Signature:

pty.getcoreversion()

Parameters:
None

Result:

  • The UDF returns the core library version, used with the DB2 protector, as VARCHAR(256).

Example:

SELECT pty.getcoreversion() FROM SYSIBM.SYSDUMMY1;

1.2 - Access Check UDFs

These UDFs are used to check access permissions. The functions returns 1 if the user has access. Otherwise, it returns a 0 (zero).

pty.have_sel_perm

The UDF verifies whether the user has select or unprotect access to the data element.

Signature:

pty.have_sel_perm(communicationid INTEGER, dataelement VARCHAR)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.

Result:

  • The UDF returns either of the following values:
    • 1 - If the user has select or unprotect access.
    • 0 - If the user does not have access.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.have_sel_perm(0, 'NoEncryption') FROM SYSIBM.SYSDUMMY1;

pty.have_upd_perm

The UDF verifies whether the user has update or reprotect access to the data element.

Signature:

pty.have_upd_perm(communicationid INTEGER, dataelement VARCHAR)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.

Result:

  • The UDF returns either of the following values:
    • 1 - If the user has update or reprotect access.
    • 0 - If the user does not have access.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.have_upd_perm(0, 'NoEncryption') FROM SYSIBM.SYSDUMMY1;

pty.have_ins_perm

The UDF verifies whether the user has insert or protect access to the data element.

Signature:

pty.have_ins_perm(communicationid INTEGER, dataelement VARCHAR)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.

Result:

  • The UDF returns either of the following values:
    • 1 - If the user has insert or protect access.
    • 0 - If the user does not have access.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.have_ins_perm(0, 'NoEncryption') FROM SYSIBM.SYSDUMMY1;

1.3 - VarChar UDFs

The UDFs, listed in this section, protect and unprotect VARCHAR data.

pty.ins_enc_varchar

The UDF encrypts the VARCHAR data with an encryption data element.

Signature:

pty.ins_enc_varchar(communicationid INTEGER, dataelement VARCHAR, data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
dataVARCHAR(32672)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted value as VARCHAR(32672) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_varchar(0, 'AES128', 'Protegrity', 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_varchar

The UDF re-encrypts the VARCHAR data that is updated with an encryption data element.

Signature:

pty.upd_enc_varchar(communicationid INTEGER, dataelement VARCHAR, data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
dataVARCHAR(32672)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted value as VARCHAR(32672) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_varchar(0, 'AES128', 'Protegrity', 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_varchar

The UDF decrypts the encrypted VARCHAR data with a data element.

Signature:

pty.sel_dec_varchar(communicationid INTEGER, dataelement VARCHAR, data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
dataVARCHAR(32672) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted value as VARCHAR(32672).
  • The UDF returns the unprotected value as NULL when the user has no unprotect access to the data in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_varchar(0, 'AES128', pty.ins_enc_varchar(0, 'AES128', 'Protegrity', 0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_varchar

The UDF protects the VARCHAR value using the Tokenization and No Encyrption data elements.

Signature:

pty.ins_varchar(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(32672).

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for Tokenization:

SELECT pty.ins_varchar(0, 'TE_A_S13_L1R2_Y', 'Protegrity', 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_varchar

The UDF re-protects the VARCHAR data using Tokenization and NoEncryption data elements.

Signature:

pty.upd_varchar(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(32672).

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_varchar(0, 'TE_A_S13_L1R2_Y', 'Protegrity', 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_varchar

The UDF unprotects the protected VARCHAR value using Tokenization and NoEncryption data elements.

Signature:

pty.sel_varchar(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(32672).
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for Tokenization:

SELECT pty.sel_varchar(0, 'TE_A_S13_L1R2_Y',pty.ins_varchar(0, 'TE_A_S13_L1R2_Y', 'Protegrity', 0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_hash_varchar

The UDF uses the hash function to protect the VARCHAR data with a data element for hashing to return a protected value.

Signature:

pty.ins_hash_varchar(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the hash value as VARCHAR(32672) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_hash_varchar(0, 'HMAC_SHA256', 'Protegrity', 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_hash_varchar

The UDF uses the hash function to protect the VARCHAR data with a data element for hashing to return a protected value.

Signature:

pty.upd_hash_varchar(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the hashed value as VARCHAR(32672) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_hash_varchar(0, 'HMAC_SHA256', 'Protegrity', 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_unicode_varchar

The UDF protects the VARCHAR data with the following data elements:

  • Tokenization types such as Unicode Gen2
  • Format Preserving Encryption (FPE) with the Plaintext Encoding type as UTF-8
  • No Encryption

Signature:

pty.ins_unicode_varchar(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(32672).

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for FPE:

SELECT pty.ins_unicode_varchar(0,'FPE_FF1_AES256_UTF8_APIP_AN_L0R0_ASTNE_ML2','ProtegrityIndia',0) FROM SYSIBM.SYSDUMMY1;

Example for Unicode Gen2:

Note: The Unicode Gen2 data elements support the newly introduced SLT_X_1 tokenizer along with the existing SLT_1_3 tokenizer. For more information about the Unicode Gen2 data elements, refer to Unicode Gen2.

SELECT pty.ins_unicode_varchar(0,'TE_UG2_UTF16LE_LL1AN_SLT13_L2R0_ASTYES',N'xyzÀÁÂÃÄÅÆÇÈÉÊ',0) FROM SYSIBM.SYSDUMMY1;
SELECT pty.ins_unicode_varchar(0,'TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE',N'ϠϡϢϣϥϦ',0) FROM SYSIBM.SYSDUMMY1;

pty.upd_unicode_varchar

The UDF reprotects the VARCHAR data with the following data elements:

  • Tokenization types such as Unicode Gen2
  • No Encryption

Signature:

pty.upd_unicode_varchar(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(32672).

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for Unicode Gen2:

SELECT pty.upd_unicode_varchar(0,'TE_UG2_UTF16LE_LL1AN_SLT13_L2R0_ASTYES',N'xyzÀÁÂÃÄÅÆÇÈÉÊ',0) FROM SYSIBM.SYSDUMMY1;
SELECT
pty.upd_unicode_varchar(0,'TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE',N'ϠϡϢϣϥϦ',0) FROM SYSIBM.SYSDUMMY1;

pty.sel_unicode_varchar

The UDF unprotects the protected VARCHAR data with the following data elements:

  • Tokenization types such as Unicode Gen2
  • No Encryption

Signature:

pty.sel_unicode_varchar(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(32672).
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and user does not have unprotect access to the data.
  • This UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for FPE:

SELECT pty.sel_unicode_varchar(0, 'FPE_FF1_AES256_APIP_A_L0R0_ASTNI_ML2', 'Protegrity', 0) FROM SYSIBM.SYSDUMMY1;

Example for Unicode Gen2:

Note: The Unicode Gen2 data elements support the newly introduced SLT_X_1 tokenizer along with the existing SLT_1_3 tokenizer. For more information about the Unicode Gen2 data elements, refer to Unicode Gen2.

SELECT pty.sel_unicode_varchar(0, 'TE_UG2_UTF16LE_LL1AN_SLT13_L2R0_ASTYES', N'xyzÀÁÂÃÄÅÆÇÈÉÊ', 0) FROM SYSIBM.SYSDUMMY1;
SELECT pty.sel_unicode_varchar(0, 'TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE', N'ϠϡϢϣϥϦ', 0) FROM SYSIBM.SYSDUMMY1;

1.4 - VarChar for Bit Data UDFs

The UDFs, listed in this section, protect and unprotect VARCHAR FOR BIT DATA.

pty.ins_enc_varcharfbd

The UDF encrypts the VARCHAR FOR BIT DATA value with an encryption data element.

Signature:

pty.ins_enc_varcharfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted value as VARCHAR(32672) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_varcharfbd(0, 'AES128', CAST( 'Protegrity' AS VARCHAR(10) FOR BIT DATA ), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_varcharfbd

The UDF re-encrypts the VARCHAR FOR BIT DATA value that is updated with an encryption data element.

Signature:

pty.upd_enc_varcharfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted value as VARCHAR(32672) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_varcharfbd(0, 'AES128', CAST( 'Protegrity' AS VARCHAR(10) FOR BIT DATA ), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_varcharfbd

The UDF decrypts the VARCHAR FOR BIT DATA value with a data element.

Signature:

pty.sel_dec_varcharfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted value as VARCHAR(32672) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_varcharfbd(0, 'AES128', pty.ins_enc_varcharfbd(0, 'AES128', CAST('Protegrity' AS VARCHAR(10) FOR BIT DATA), 0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_varcharfbd

The UDF protects the VARCHAR FOR BIT DATA value with Tokenization and NoEncryption data elements.

Signature:

pty.ins_varcharfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data value as VARCHAR(32672) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_varcharfbd(0,'TE_A_S13_L1R2_Y',CAST('Protegrity' AS VARCHAR(10) FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

pty.upd_varcharfbd

The UDF re-protects the VARCHAR FOR BIT DATA value that is updated with a Tokenization and NoEncryption data element.

Signature:

pty.upd_varcharfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data value as VARCHAR(32672) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_varcharfbd(0,'TE_A_S13_L1R2_Y',CAST('Protegrity' AS VARCHAR(10) FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

pty.sel_varcharfbd

The UDF unprotects the protected VARCHAR FOR BIT DATA value with the following data elements:

  • Tokenization
  • Format Preserving Encryption(FPE) with the Plaintext Encoding type as ASCII
  • NoEncryption

Signature:

pty.sel_varcharfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(32672) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data value as VARCHAR(32672) FOR BIT DATA.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_varcharfbd(0,'TE_A_S13_L1R2_Y',CAST('Protegrity' AS VARCHAR(10) FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

1.5 - Char UDFs

The UDFs, listed in this section, protect and unprotect CHAR data.

pty.ins_enc_char

The UDF protects the CHAR data with an encryption data element.

Signature:

pty.ins_enc_char(comm_id INTEGER, dataelement VARCHAR, input_data CHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(254)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted value as VARCHAR(290) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_char(0,'AES128','Protegrity',0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_char

The UDF re-protects the CHAR data that is updated with an encryption data element.

Signature:

pty.upd_enc_char(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(254)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted value as VARCHAR(290) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_char(0,'AES128','Protegrity',0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_char

The UDF unprotects the protected CHAR data with a data element.

Signature:

pty.sel_dec_char(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(290) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(254).

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_char(0,'AES128',pty.ins_enc_char(0,'AES128','Protegrity',0),0) FROM SYSIBM.SYSDUMMY1;

pty.ins_char

The UDF protects the CHAR data with Tokenization and NoEncryption data elements.

Caution: The pty.ins_char UDF cannot be used for a FPE data element.

Signature:

pty.ins_char(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(254)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(305).

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_char(0,'TE_A_S13_L1R2_Y','Protegrity',0) FROM SYSIBM.SYSDUMMY1;

pty.upd_char

The UDF re-protects the CHAR data with Tokenization and NoEncryption data elements.

Caution: The pty.upd_char UDF cannot be used for a FPE data element.

Signature:

pty.upd_char(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(254)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the protected or tokenized value as VARCHAR(305).

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_char(0,'TE_A_S13_L1R2_Y','Protegrity',0) FROM SYSIBM.SYSDUMMY1;

pty.sel_char

The UDF unprotects the protected CHAR data with Tokenization and NoEncryption data elements.

Caution: The pty.sel_char UDF cannot be used for a FPE data element.

Signature:

pty.sel_char(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(305)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(254).
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_char(0,'TE_A_S13_L1R2_Y','Protegrity',0) FROM SYSIBM.SYSDUMMY1;

1.6 - Char for Bit Data UDFs

The UDFs, listed in this section, protect and unprotect CHAR FOR BIT DATA.

pty.ins_enc_charfbd

The UDF encrypts the CHAR FOR BIT DATA value with an encryption data element.

Signature:

pty.ins_enc_charfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(254) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(290) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_charfbd(0,'AES128',CAST('Protegrity' AS CHAR(10) FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_charfbd

The UDF re-encrypts the CHAR FOR BIT DATA value that is updated with an encryption data element.

Signature:

pty.upd_enc_charfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(254) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(290) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_charfbd(0,'AES128',CAST('Protegrity' AS CHAR(10) FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_charfbd

The UDF decrypts the CHAR FOR BIT DATA value with a data element.

Signature:

pty.sel_dec_charfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(290) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as VARCHAR(254) FOR BIT DATA.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_charfbd (0, 'AES128', pty.ins_enc_charfbd(0,'AES128',CAST('Protegrity' AS CHAR(10) FOR BIT DATA),0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_charfbd

The UDF protects the CHAR FOR BIT DATA value with Tokenization and NoEncryption data elements.

Signature:

pty.ins_charfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(254) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(254) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_charfbd(0,'TE_A_S13_L1R2_Y',CAST('Protegrity' AS CHAR(10) FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

pty.upd_charfbd

The UDF re-protects the CHAR FOR BIT DATA value with Tokenization and NoEncryption data elements.

Signature:

pty.upd_charfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(254) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(254) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_charfbd(0,'TE_A_S13_L1R2_Y',CAST('Protegrity' AS CHAR(10) FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

pty.sel_charfbd

The UDF unprotects the protected CHAR FOR BIT DATA value with Tokenization and NoEncryption data elements.

Signature:

pty.sel_charfbd(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(254) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as VARCHAR(254) FOR BIT DATA.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_charfbd(0,'TE_A_S13_L1R2_Y',CAST('Protegrity' AS CHAR(10) FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

1.7 - Long VarChar UDFs

The UDFs, listed in this section, protect and unprotect LONG VARCHAR data.

pty.ins_enc_lvarchar

The UDF encrypts the LONG VARCHAR data with an encryption data element.

Signature:

pty.ins_enc_lvarchar(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHARSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as LONG VARCHAR FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_lvarchar(0,'AES128', CAST('Protegrity' AS LONG VARCHAR),0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_lvarchar

The UDF re-encrypts the LONG VARCHAR data that is updated with an encryption data element.

Signature:

pty.upd_enc_lvarchar(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHARSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as LONG VARCHAR FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_lvarchar(0,'AES128', CAST('Protegrity' AS LONG VARCHAR),0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_lvarchar

The UDF decrypts the LONG VARCHAR data with a data element.

Signature:

pty.sel_dec_lvarchar(comm_id INTEGER, dataelement VARCHAR(64), input_data LONG VARCHAR FOR BIT DATA, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHAR FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as LONG VARCHAR.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_lvarchar(0,'AES128', pty.ins_enc_lvarchar(0,'AES128', CAST('Protegrity' AS LONG VARCHAR),0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_lvarchar

The UDF protects the LONG VARCHAR data with Tokenization and NoEncryption data elements.

Signature:

pty.ins_lvarchar(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHARSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the protected (tokenized) data as LONG VARCHAR.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_lvarchar(0,'TE_A_S13_L1R2_Y', CAST('Protegrity' AS LONG VARCHAR),0) FROM SYSIBM.SYSDUMMY1;

pty.upd_lvarchar

The UDF re-protects the LONG VARCHAR data with Tokenization and NoEncryption data elements.

Signature:

pty.upd_lvarchar(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHARSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the protected (tokenized) data as LONG VARCHAR.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_lvarchar(0,'TE_A_S13_L1R2_Y', CAST('Protegrity' AS LONG VARCHAR),0) FROM SYSIBM.SYSDUMMY1;

pty.sel_lvarchar

The UDF unprotects the protected LONG VARCHAR data with Tokenization and NoEncryption data elements.

Signature:

pty.sel_lvarchar(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHARSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as LONG VARCHAR.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_lvarchar(0,'TE_A_S13_L1R2_Y',CAST('Protegrity' AS LONG VARCHAR),0) FROM SYSIBM.SYSDUMMY1;

1.8 - Long VarChar for Bit Data UDFs

The UDFs, listed in this section, protect and unprotect LONG VARCHAR FOR BIT DATA.

pty.ins_enc_lvcfbd

The UDF encrypts the LONG VARCHAR FOR BIT DATA value with an encryption data element.

Signature:

pty.ins_enc_lvcfbd(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR FOR BIT DATA, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHAR FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as LONG VARCHAR FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_lvcfbd(0,'AES128',CAST('Protegrity' AS LONG VARCHAR FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_lvcfbd

The UDF re-encrypts the LONG VARCHAR FOR BIT DATA value that is updated with an encryption data element.

Signature:

pty.upd_enc_lvcfbd(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR FOR BIT DATA, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHAR FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as LONG VARCHAR FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_lvcfbd(0,'AES128',CAST('Protegrity' AS LONG VARCHAR FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_lvcfbd

The UDF decrypts the LONG VARCHAR FOR BIT DATA value with a data element.

Signature:

pty.sel_dec_lvcfbd(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR FOR BIT DATA, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHAR FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as LONG VARCHAR FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_lvcfbd(0,'AES128', pty.ins_enc_lvcfbd(0,'AES128',CAST('Protegrity' AS LONG VARCHAR FOR BIT DATA),0),0) FROM SYSIBM.SYSDUMMY1;

pty.ins_lvcfbd

The UDF protects the LONG VARCHAR FOR BIT DATA value with Tokenization and NoEncryption data elements.

Signature:

pty.ins_lvcfbd(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR FOR BIT DATA, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHAR FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the protected/tokenized data as LONG VARCHAR FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_lvcfbd(0,'TE_A_S13_L1R2_Y',CAST('Protegrity' AS LONG VARCHAR FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

pty.upd_lvcfbd

The UDF re-protects the LONG VARCHAR FOR BIT DATA value with Tokenization and NoEncryption data elements.

Signature:

pty.upd_lvcfbd(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR FOR BIT DATA, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHAR FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as LONG VARCHAR FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_lvcfbd(0,'TE_A_S13_L1R2_Y',CAST('Protegrity' AS LONG VARCHAR FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

pty.sel_lvcfbd

The UDF unprotects the protected LONG VARCHAR FOR BIT DATA value with Tokenization and NoEncryption data elements.

Signature:

pty.sel_lvcfbd(comm_id INTEGER, dataelement VARCHAR, input_data LONG VARCHAR FOR BIT DATA, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataLONG VARCHAR FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as LONG VARCHAR FOR BIT DATA.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_lvcfbd(0,'TE_A_S13_L1R2_Y', CAST('Protegrity' AS LONG VARCHAR FOR BIT DATA),0) FROM SYSIBM.SYSDUMMY1;

1.9 - Date UDFs

The UDFs, listed in this section, protect and unprotect DATE data.

pty.ins_enc_date

The UDF encrypts a DATE value with an encryption data element.

Signature:

pty.ins_enc_date(comm_id INTEGER, dataelement VARCHAR, input_data DATE, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataDATESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_date(0,'AES128',current_date,0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_date

The UDF re-encrypts the DATE value that is updated with an encryption data element.

Signature:

pty.upd_enc_date(comm_id INTEGER, dataelement VARCHAR, input_data DATE, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataDATESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_date(0,'AES128',current_date,0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_date

The UDF decrypts the DATE value with a data element.

Signature:

pty.sel_dec_date(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR(34) FOR BIT DATA, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(34) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as DATE.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_date(0,'AES128',pty.ins_enc_date(0,'AES128',current_date,0),0) FROM SYSIBM.SYSDUMMY1;

pty.ins_date

The UDF protects the DATE value with Tokenization and NoEncryption data elements.

Signature:

pty.ins_date(comm_id INTEGER, dataelement VARCHAR, input_data DATE, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataDATESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as DATE.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_date(0,'TE_Datetime_TY_DY_N',current_date,0) FROM SYSIBM.SYSDUMMY1;

pty.upd_date

The UDF re-protects the DATE value with Tokenization and NoEncryption data elements.

Signature:

pty.upd_date(comm_id INTEGER, dataelement VARCHAR, input_data DATE, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataDATESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as DATE.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_date(0,'TE_Date_YMD_S13',current_date,0) FROM SYSIBM.SYSDUMMY1;

pty.sel_date

The UDF unprotects the protected DATE value with Tokenization and NoEncryption data elements.

Signature:

pty.sel_date(comm_id INTEGER, dataelement VARCHAR, input_data DATE, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataDATESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as DATE.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_date(0,'TE_Datetime_TY_DY_N',pty.ins_date(0,'TE_Datetime_TY_DY_N',current_date,0),0) FROM SYSIBM.SYSDUMMY1;

1.10 - Timestamp UDFs

The UDFs, listed in this section, protect and unprotect TIMESTAMP data.

pty.ins_enc_timestamp

The UDF encrypts a TIMESTAMP value with an encryption data element.

Signature:

pty.ins_enc_timestamp(comm_id INTEGER, dataelement VARCHAR, input_data TIMESTAMP, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataTIMESTAMPSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(50) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_timestamp(0, 'AES128', current_timestamp, 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_timestamp

The UDF re-encrypts a TIMESTAMP value with an encryption data element.

Signature:

pty.upd_enc_timestamp(comm_id INTEGER, dataelement VARCHAR, input_data TIMESTAMP, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataTIMESTAMPSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(50) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_timestamp(0, 'AES128', current_timestamp, 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_timestamp

The UDF decrypts the TIMESTAMP value with a data element.

Signature:

pty.sel_dec_timestamp(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(50) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as TIMESTAMP.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_timestamp(0, 'AES128', pty.ins_enc_timestamp(0,'AES128',current_timestamp,0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_timestamp

The UDF protects the TIMESTAMP value with Tokenization and NoEncryption data elements.

Signature:

pty.ins_timestamp(comm_id INTEGER, dataelement VARCHAR, input_data TIMESTAMP, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataTIMESTAMPSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as TIMESTAMP.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_timestamp(0,'TE_Datetime_TY_DY_N',current_timestamp,0) FROM SYSIBM.SYSDUMMY1;

pty.upd_timestamp

The UDF re-protects the TIMESTAMP value with the No Encryption data element.

Signature:

pty.upd_timestamp(comm_id INTEGER, dataelement VARCHAR, input_data TIMESTAMP, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataTIMESTAMPSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as TIMESTAMP.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_timestamp(0, 'NoEncryption', current_timestamp, 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_timestamp

The UDF unprotects the protected TIMESTAMP value with Tokenization and NoEncryption data elements.

Signature:

pty.sel_timestamp(comm_id INTEGER, dataelement VARCHAR, input_data TIMESTAMP, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataTIMESTAMPSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as TIMESTAMP.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_timestamp(0,'TE_Datetime_TY_DY_N',pty.ins_timestamp(0,'TE_Datetime_TY_DY_N',current_timestamp,0),0) FROM SYSIBM.SYSDUMMY1;

1.11 - Time UDFs

The UDFs, listed in this section, protect and unprotect TIME data.

pty.ins_enc_time

The UDF encrypts TIME value with an encryption data element.

Signature:

pty.ins_enc_time(comm_id INTEGER, dataelement VARCHAR, input_data TIME, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataTIMESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_time(0,'AES128',current_time,0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_time

The UDF re-encrypts the TIME value that is updated with an encryption data element.

Signature:

pty.upd_enc_time(comm_id INTEGER, dataelement VARCHAR, input_data TIME, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataTIMESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_time(0,'AES128',current_time,0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_time

The UDF decrypts the TIME value with a data element.

Signature:

pty.sel_dec_time(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(34) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as TIME.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_time(0, 'AES128', pty.ins_enc_time(0,'AES128',current_time,0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_time

The UDF protects the TIME value with a NoEncryption data element.

Signature:

pty.ins_time(comm_id INTEGER, dataelement VARCHAR, input_data TIME, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataTIMESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as TIME.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_time(0,'NoEncryption','09:42:00',0) FROM SYSIBM.SYSDUMMY1;

pty.upd_time

The UDF re-protects the TIME value with a NoEncryption data element.

Signature:

pty.upd_time(comm_id INTEGER, dataelement VARCHAR, input_data TIME, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataTIMESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as TIME.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_time(0,'NoEncryption',current_time,0) FROM SYSIBM.SYSDUMMY1;

pty.sel_time

The UDF unprotects the protected TIME value with a NoEncryption data element.

Signature:

pty.sel_time(comm_id INTEGER, dataelement VARCHAR, input_data TIME, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataTIMESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as TIME.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_time(0,'NoEncryption',current_time,0) FROM SYSIBM.SYSDUMMY1;

1.12 - Integer UDFs

The UDFs, listed in this section, protect and unprotect INTEGER data.

pty.ins_enc_integer

The UDF protects the INTEGER data with a data element for encryption.

Signature:

pty.ins_enc_integer(comm_id INTEGER, dataelement VARCHAR, input_data INTEGER, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataINTEGERSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_integer(0, 'AES128', CAST(123456 AS INTEGER), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_integer

The UDF re-encrypts the INTEGER data that is updated with an encryption data element.

Signature:

pty.upd_enc_integer(comm_id INTEGER, dataelement VARCHAR, input_data INTEGER, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataINTEGERSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_integer(0, 'AES128', CAST(123456 AS INTEGER), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_integer

The UDF decrypts the INTEGER data with a data element.

Signature:

pty.sel_dec_integer(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(34) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as INTEGER.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_integer(0, 'AES128', pty.ins_enc_integer(0, 'AES128', CAST(123456 AS INTEGER), 0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_integer

The UDF protects the INTEGER data with Tokenization and NoEncryption data elements.

Signature:

pty.ins_integer(comm_id INTEGER, dataelement VARCHAR, input_data INTEGER, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataINTEGERSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as INTEGER.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for NoEncryption:

SELECT pty.ins_integer(0, 'NoEncryption', CAST(123456 AS INTEGER), 0) FROM SYSIBM.SYSDUMMY1;

Example for Tokenization:

SELECT pty.ins_integer(0, 'TE_INT_4', CAST(123456 AS INTEGER), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_integer

The UDF re-protects the INTEGER data with Tokenization and NoEncryption data elements.

Signature:

pty.upd_integer(comm_id INTEGER, dataelement VARCHAR, input_data INTEGER, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataINTEGERSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as INTEGER.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for NoEncryption:

SELECT pty.upd_integer(0, 'NoEncryption', CAST(123456 AS INTEGER), 0) FROM SYSIBM.SYSDUMMY1;

Example for Tokenization:

SELECT pty.upd_integer(0, 'TE_INT_4', CAST(123456 AS INTEGER), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_integer

The UDF unprotects the protected INTEGER data with Tokenization and NoEncryption data elements.

Signature:

pty.sel_integer(comm_id INTEGER, dataelement VARCHAR, input_data INTEGER, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataINTEGERSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as INTEGER.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for NoEncryption:

SELECT pty.sel_integer(0, 'NoEncryption', CAST(123456 AS INTEGER), 0) FROM SYSIBM.SYSDUMMY1;

Example for Tokenization:

SELECT pty.sel_integer(0, 'TE_INT_4', CAST(123456 AS INTEGER), 0) FROM SYSIBM.SYSDUMMY1;

1.13 - SmallInt UDFs

The UDFs, listed in this section, protect and unprotect SMALLINT data.

pty.ins_enc_smallint

The UDF encrypts the SMALL INTEGER data with a data element for encryption.

Signature:

pty.ins_enc_smallint(comm_id INTEGER, dataelement VARCHAR, input_data SMALLINT, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataSMALLINTSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_smallint(0, 'AES128', CAST(1234 AS SMALLINT), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_smallint

The UDF re-encrypts the SMALL INTEGER data that is updated with a data element for encryption.

Signature:

pty.upd_enc_smallint(comm_id INTEGER, dataelement VARCHAR, input_data SMALLINT, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataSMALLINTSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_smallint(0, 'AES128', CAST(1234 AS SMALLINT), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_smallint

The UDF decrypts the SMALL INTEGER data with a data element.

Signature:

pty.sel_dec_smallint(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(34) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as SMALLINT.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_smallint(0,'AES128',pty.ins_enc_smallint(0,'AES128',CAST(1234 AS SMALLINT),0),0) FROM SYSIBM.SYSDUMMY1;

pty.ins_smallint

The UDF protects the SMALL INTEGER data with Tokenization and NoEncryption data elements.

Signature:

pty.ins_smallint(comm_id INTEGER, dataelement VARCHAR, input_data SMALLINT, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataSMALLINTSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as SMALLINT.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for Tokenization:

SELECT pty.ins_smallint(0, 'TE_INT_2', CAST(1234 AS SMALLINT), 0) FROM SYSIBM.SYSDUMMY1;

Example for NoEncryption:

SELECT pty.ins_smallint(0, 'NoEncryption', CAST(1234 AS SMALLINT), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_smallint

The UDF re-protects the SMALL INTEGER data with Tokenization and NoEncryption data elements.

Signature:

pty.upd_smallint(comm_id INTEGER, dataelement VARCHAR, input_data SMALLINT, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataSMALLINTSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as SMALLINT.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for Tokenization:

SELECT pty.upd_smallint(0, 'TE_INT_SLT13_2', CAST(1234 AS SMALLINT), 0) FROM SYSIBM.SYSDUMMY1;

Example for NoEncryption:

SELECT pty.upd_smallint(0, 'NoEncryption', CAST(1234 AS SMALLINT), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_smallint

The UDF unprotects the protected SMALL INTEGER data with Tokenization and NoEncryption data elements.

Signature:

pty.sel_smallint(comm_id INTEGER, dataelement VARCHAR, input_data SMALLINT, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataSMALLINTSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as SMALLINT.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for Tokenization:

SELECT pty.sel_smallint(0, 'TE_INT_2', CAST(1234 AS SMALLINT), 0) FROM SYSIBM.SYSDUMMY1;

Example for NoEncryption:

SELECT pty.sel_smallint(0, 'NoEncryption', CAST(1234 AS SMALLINT), 0) FROM SYSIBM.SYSDUMMY1;

1.14 - BigInt UDFs

The UDFs, listed in this section, protect and unprotect BIGINT data.

pty.ins_enc_bigint

The UDF encrypts the BIG INTEGER data with a data element for encryption.

Signature:

pty.ins_enc_bigint(comm_id INTEGER, dataelement VARCHAR, input_data BIGINT, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBIGINTSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_bigint(0, 'AES128', CAST(12345678 AS BIGINT), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_bigint

The UDF re-encrypts the BIG INTEGER data that is updated with a data element for encryption.

Signature:

pty.upd_enc_bigint(comm_id INTEGER, dataelement VARCHAR, input_data BIGINT, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBIGINTSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_bigint(0, 'AES128', CAST(12345678 AS BIGINT), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_bigint

The UDF decrypts the BIG INTEGER data with a data element.

Signature:

pty.sel_dec_bigint(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(34) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as BIGINT.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_bigint(0, 'AES128', pty.ins_enc_bigint(0, 'AES128', CAST(12345678 AS BIGINT), 0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_bigint

The UDF protects the BIG INTEGER data with Tokenization and NoEncryption data elements.

Signature:

pty.ins_bigint(comm_id INTEGER, dataelement VARCHAR, input_data BIGINT, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBIGINTSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as BIGINT.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for Tokenization:

SELECT pty.ins_bigint(0, 'TE_INT_8_BIGINT', CAST(12345678 AS BIGINT), 0) FROM SYSIBM.SYSDUMMY1;

Example for NoEncryption:

SELECT pty.ins_bigint(0, 'NoEncryption', CAST(12345678 AS BIGINT), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_bigint

The UDF re-protects the BIG INTEGER data with Tokenization and NoEncryption data elements.

Signature:

pty.upd_bigint(comm_id INTEGER, dataelement VARCHAR, input_data BIGINT, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBIGINTSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as BIGINT.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for Tokenization:

SELECT pty.upd_bigint(0, 'TE_INT_8', CAST(12345678 AS BIGINT), 0) FROM SYSIBM.SYSDUMMY1;

Example for NoEncryption:

SELECT pty.upd_bigint(0, 'NoEncryption', CAST(12345678 AS BIGINT), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_bigint

The UDF unprotects the protected BIG INTEGER data with Tokenization and NoEncryption data elements.

Signature:

pty.sel_bigint(comm_id INTEGER, dataelement VARCHAR, input_data BIGINT, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBIGINTSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as BIGINT.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example for Tokenization:

SELECT pty.sel_bigint(0, 'TE_INT_8', CAST(12345678 AS BIGINT), 0) FROM SYSIBM.SYSDUMMY1;

Example for NoEncryption:

SELECT pty.sel_bigint(0, 'NoEncryption', CAST(12345678 AS BIGINT), 0) FROM SYSIBM.SYSDUMMY1;

1.15 - Real UDFs

The UDFs, listed in this section, protect and unprotect REAL data.

pty.ins_enc_real

The UDF encrypts REAL data with a data element for encryption.

Signature:

pty.ins_enc_real(comm_id INTEGER, dataelement VARCHAR, input_data REAL, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataREALSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_real(0, 'AES128', CAST(123456 AS REAL), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_real

The UDF re-encrypts the REAL data that is updated with a data element for encryption.

Signature:

pty.upd_enc_real(comm_id INTEGER, dataelement VARCHAR, input_data REAL, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataREALSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_real(0, 'AES128', CAST(123456 AS REAL), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_real

The UDF decrypts the REAL data with a data element.

Signature:

pty.sel_dec_real(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(34) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as REAL.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_real(0, 'AES128', pty.ins_enc_real(0,'AES128',CAST(123456 AS REAL),0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_real

The UDF protects the REAL data with a NoEncryption data element.

Signature:

pty.ins_real(comm_id INTEGER, dataelement VARCHAR, input_data REAL, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataREALSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as REAL.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_real(0, 'NoEncryption', CAST(123456 AS REAL), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_real

The UDF re-protects the REAL data with a NoEncryption data element.

Signature:

pty.upd_real(comm_id INTEGER, dataelement VARCHAR, input_data REAL, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataREALSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as REAL.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_real(0, 'NoEncryption', CAST(123456 AS REAL), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_real

The UDF unprotects the protected REAL data with a NoEncryption data element.

Signature:

pty.sel_real(comm_id INTEGER, dataelement VARCHAR, input_data REAL, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataREALSpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as REAL.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_real(0, 'NoEncryption', CAST(123456 AS REAL), 0) FROM SYSIBM.SYSDUMMY1;

1.16 - Double UDFs

The UDFs, listed in this section, protect and unprotect DOUBLE data.

pty.ins_enc_double

The UDF encrypts the DOUBLE data with a data element for encryption.

Signature:

pty.ins_enc_double(comm_id INTEGER, dataelement VARCHAR, input_data DOUBLE, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataDOUBLESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_double(0, 'AES128', CAST(123456 AS DOUBLE), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_double

The UDF re-encrypts the DOUBLE data that is updated with a data element for encryption.

Signature:

pty.upd_enc_double(comm_id INTEGER, dataelement VARCHAR, input_data DOUBLE, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataDOUBLESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as VARCHAR(34) FOR BIT DATA.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_double(0, 'AES128', CAST(123456 AS DOUBLE), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_double

The UDF decrypts the DOUBLE data with a data element.

Signature:

pty.sel_dec_double(comm_id INTEGER, dataelement VARCHAR, input_data VARCHAR, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataVARCHAR(34) FOR BIT DATASpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as DOUBLE.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_double(0, 'AES128', pty.ins_enc_double(0,'AES128',CAST(123456 AS DOUBLE),0), 0) FROM SYSIBM.SYSDUMMY1;

pty.ins_double

The UDF protects the DOUBLE data with a NoEncryption data element.

Signature:

pty.ins_double(comm_id INTEGER, dataelement VARCHAR, input_data DOUBLE, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataDOUBLESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as DOUBLE.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_double(0, 'NoEncryption', CAST(123456 AS DOUBLE), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_double

The UDF re-protects the DOUBLE data with a NoEncryption data element.

Signature:

pty.upd_double(comm_id INTEGER, dataelement VARCHAR, input_data DOUBLE, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataDOUBLESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as DOUBLE.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_double(0, 'NoEncryption', CAST(123456 AS DOUBLE), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_double

The UDF unprotects the protected DOUBLE data with a NoEncryption data element.

Signature:

pty.sel_double(comm_id INTEGER, dataelement VARCHAR, input_data DOUBLE, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataDOUBLESpecifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as DOUBLE.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_double(0, 'NoEncryption', CAST(123456 AS DOUBLE), 0) FROM SYSIBM.SYSDUMMY1;

1.17 - Blob UDFs

The UDFs, listed in this section, protect and unprotect BLOB data.

** Note:** The BLOB UDFs support a maximum input size of 2,147,483,576 bytes, which is approximately 2GB. The the protected output can be up to 2,147,483,610 bytes. Large operations are memory intensive. For example, 2 GB operation can require several gigabytes of memory per member. Ensure the instance is sized adequately. For example, the INSTANCE_MEMORY should be 16 GB or higher. Otherwise, the UDFs may fail with the SQL0930N error.

pty.ins_enc_blob

The UDF encrypts the BLOB data with a data element for encryption.

Signature:

pty.ins_enc_blob(comm_id INTEGER, dataelement VARCHAR, input_data BLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as BLOB 2147483576 bytes.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_blob(0,'AES128', CAST('Protegrity' AS BLOB(1M)), 0)  FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_blob

The UDF re-encrypts the BLOB data that is updated with a data element for encryption.

Signature:

pty.upd_enc_blob(comm_id INTEGER, dataelement VARCHAR, input_data BLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as BLOB (102434) bytes.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_blob(0, 'AES128', BLOB('blob_db2.jpg'), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_blob

The UDF decrypts the BLOB data with a data element.

Signature:

pty.sel_dec_blob(comm_id INTEGER, dataelement VARCHAR, input_data BLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as BLOB 100K.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_blob(0,'AES128',pty.ins_enc_blob(0,'AES128', CAST('Protegrity' AS BLOB(1M)), 0),0)  FROM SYSIBM.SYSDUMMY1;

pty.ins_blob

The UDF protects the BLOB data with a NoEncryption data element.

Signature:

pty.ins_blob(comm_id INTEGER, dataelement VARCHAR, input_data BLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as BLOB 2147483576 Bytes.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_blob(0,'NoEncryption', CAST('Protegrity' AS BLOB(1M)), 0)  FROM SYSIBM.SYSDUMMY1;

pty.upd_blob

The UDF re-protects the BLOB data with a NoEncryption data element.

Signature:

pty.upd_blob(comm_id INTEGER, dataelement VARCHAR, input_data BLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as BLOB 100K.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_blob(0, 'NoEncryption', BLOB('blob_db2.jpg'), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_blob

The UDF unprotects the protected BLOB data with a NoEncryption data element.

Signature:

pty.sel_blob(comm_id INTEGER, dataelement VARCHAR, input_data BLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as BLOB 2147483576 Bytes.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_blob(0,'NoEncryption',pty.ins_blob(0,'NoEncryption', CAST('Protegrity' AS BLOB(1M)), 0),0)  FROM SYSIBM.SYSDUMMY1;

1.18 - Clob UDFs

The UDFs, listed in this section, protect and unprotect CLOB data.

Note: The CLOB UDFs support a maximum input size of 2,147,483,576 bytes, which is approximately 2GB. The protected output can be up to 2,147,483,610 bytes. Use the BLOB UDFs for binary data like images, audio, and video. This is because the CLOB codepage conversion can corrupt binary content. Large operations are memory intensive. For example, 2 GB operation can require several gigabytes of memory per member. Ensure the instance is sized adequately. For example, the INSTANCE_MEMORY should be 16 GB or higher. Otherwise, the UDFs may fail with the SQL0930N error.

pty.ins_enc_clob

The UDF encrypts the CLOB data with a data element for encryption.

Signature:

pty.ins_enc_clob(comm_id INTEGER, dataelement VARCHAR, input_data CLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataCLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as BLOB 2147483610 bytes.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_enc_clob(0,'AES128', CAST('Protegrity' AS CLOB(1M)), 0) FROM SYSIBM.SYSDUMMY1;

pty.upd_enc_clob

The UDF re-encrypts the CLOB data that is updated with a data element for encryption.

Signature:

pty.upd_enc_clob(comm_id INTEGER, dataelement VARCHAR, input_data CLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataCLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the encrypted data as BLOB 2147483610 bytes.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_enc_clob(0, 'AES128', CLOB('clob.txt'), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_dec_clob

The UDF decrypts the CLOB data with a data element.

Signature:

pty.sel_dec_clob(comm_id INTEGER, dataelement VARCHAR, input_data BLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataBLOB(2147483610 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the decrypted data as CLOB 2147483576 Bytes.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_dec_clob(0,'AES128',pty.ins_enc_clob(0,'AES128', CAST('Protegrity' AS CLOB(1M)), 0),0)  FROM SYSIBM.SYSDUMMY1;

pty.ins_clob

The UDF protects the CLOB data with a NoEncryption data element.

Signature:

pty.ins_clob(comm_id INTEGER, dataelement VARCHAR, input_data CLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataCLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as CLOB 2147483576 bytes.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.ins_clob(0,'NoEncryption', CAST('Protegrity' AS CLOB(1M)), 0)  FROM SYSIBM.SYSDUMMY1;

pty.upd_clob

The UDF re-protects the CLOB data with a NoEncryption data element.

Signature:

pty.upd_clob(comm_id INTEGER, dataelement VARCHAR, input_data CLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataCLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as CLOB 2147483610 bytes.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.upd_clob(0, 'NoEncryption', CLOB('clob.txt'), 0) FROM SYSIBM.SYSDUMMY1;

pty.sel_clob

The UDF unprotects the protected CLOB data with a NoEncryption data element.

Signature:

pty.sel_clob(comm_id INTEGER, dataelement VARCHAR, input_data CLOB, scid INTEGER)

Parameters:

NameTypeDescription
communicationidINTEGERSpecifies the location where the UDF will find the policy. The value must be the same as configured in the config.ini file.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelementVARCHAR(64)Specifies the name of the data element.
input_dataCLOB(2147483576 Bytes)Specifies the input data.
scidINTEGERSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Result:

  • The UDF returns the data as CLOB 2147483576 Bytes.
  • The UDF returns the unprotected value as NULL, when the user has no unprotect access to the data in the policy.
  • The UDF returns the protected value, if this option is configured in the policy and the user does not have unprotect access to the data.
  • The UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If you configure an exception in the policy and the user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT pty.sel_clob(0,'NoEncryption',pty.ins_clob(0,'NoEncryption', CAST('Protegrity' AS CLOB(1M)), 0),0)  FROM SYSIBM.SYSDUMMY1;

2 - Oracle User Defined Functions and APIs

2.1 - General UDFs

This section includes the general UDFs that can be used to retrieve the Oracle Protector version and the current user.

pty.whoami

The UDF returns the name of the user who is currently logged in to the database.

Signature:

pty.whoami()

Parameters:
None

Returns:
This UDF returns the name of the user as the VARCHAR2 string.

Exception:
None

Example:

select pty.whoami() ”Test of WhoAmI” from dual;
Test of WhoAmI
---
USER1

pty.getversion

This UDF returns the version of the protector.

Signature:

pty.getversion()

Parameters:
None

Returns:
This UDF returns the version of the protector as the VARCHAR2 string.

Example:

select pty.getversion() ”Test of GetVersion” from dual;

Test of GetVersion
---
x.x.x.x

2.2 - Access Check Procedures

The procedures listed here check whether the user is granted access permissions to the data element. The procedures will pass if the user has access. Otherwise, it casts an exception with the reason for failure.

The permissions for protect, unprotect, and reprotect are defined based on the roles assigned to the user. For more information about how to grant these permissions and assign roles, refer to Policy Management.

pty.ins_check

This procedure determines if the user has insert(protect) access to the data element.

Signature:

pty.ins_check(dataelement VARCHAR)

Parameters:

NameTypeDescription
dataelementVARCHARSpecifies the name of the data element.

Returns:
The procedure returns the value as Success, if the user can insert data.

Example:

declare
begin
  dbms_output.put_line('Test of INSERT check procedure');
  dbms_output.put_line('------------------------------');
  pty.ins_check('DE_AES256');
end;

pty.sel_check

The procedure determines whether the user has select(unprotect) access to a data element.

Signature:

pty.sel_check(dataelement VARCHAR)

Parameters:

NameTypeDescription
dataelementVARCHARSpecifies the name of the data element.

Returns:
The procedure returns the value as success, if the user has access.

Example:

declare
begin
  dbms_output.put_line('Test of SELECT check procedure');
  dbms_output.put_line('------------------------------');
  pty.sel_check('DE_AES256');
end;

pty.upd_check

This procedure determines if the user has update(reprotect) access to the data element.

Signature:

pty.upd_check(dataelement VARCHAR)

Parameters:

NameTypeDescription
dataelementVARCHARSpecifies the name of the data element.

Returns:
The procedure returns the value as Success, if the user has update permissions.

Example:

declare
begin
  dbms_output.put_line('Test of UPDATE check procedure');
  dbms_output.put_line('------------------------------');
  pty.upd_check('DE_AES256');
end;

2.3 - Insert Encryption UDFs

These UDFs encrypt the data.

Note: The permissions for protect, unprotect, and reprotect are defined based on the roles assigned to the user. For more information about how to grant these permissions and assign roles, refer to Policy Management.

pty.ins_encrypt

This UDF encrypts data with a data element for encryption.

Signature:

pty.ins_encrypt (dataelement CHAR, inval CHAR, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalCHARSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select pty.ins_encrypt('DE_AES256', 'Original data', 0) "Test of INSERT encrypt func" from dual;

pty.ins_encrypt_char

This UDF encrypts the CHAR data with a data element for encryption.

Signature:

pty.ins_encrypt_char (dataelement CHAR, inval CHAR, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalCHARSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select pty.ins_encrypt_char('DE_AES256', 'Original data', 0) "Test of INSERT enc CHAR func" from dual;

pty.ins_encrypt_varchar2

This UDF encrypts the VARCHAR2 data with a data element for encryption.

Signature:

pty.ins_encrypt_varchar2(dataelement CHAR, inval VARCHAR2, scid1 BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted values as the LONG RAW data.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select pty.ins_encrypt_varchar2('DE_AES256', 'Original data', 0) "Test INSERT enc VARCHAR2 func" from dual;

pty.ins_encrypt_date

This UDF encrypts the DATE data with a data element for encryption.

Note: To protect the Oracle input data type DATE, use the UDFs as described in Oracle Input Data Type to UDF Mapping to identify the appropriate UDF as per requirements.

Signature:

pty.ins_encrypt_date(dataelement CHAR, inval DATE, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalDATESpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted values as the RAW data.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select pty.ins_encrypt_date('DE_AES256', '23-OCT-14', 0) "Test of INSERT enc DATE func" from dual;

pty.ins_encrypt_integer

This UDF encrypts the INTEGER data with a data element for encryption.

Signature:

pty.ins_encrypt_integer (dataelement CHAR, inval INTEGER, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalINTEGERSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted values as the RAW data.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.ins_encrypt_integer('DE_AES256', 12345, 0) "Test of INSERT enc INT func" from dual;

pty.ins_encrypt_real

This UDF encrypts the REAL data with a data element for encryption.

Signature:

pty.ins_encrypt_real (dataelement CHAR, inval REAL, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalREALSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted values as the RAW data.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select pty.ins_encrypt_real('DE_AES256', 1234.1234, 0) "Test of INSERT enc REAL func" from dual;

pty.ins_encrypt_float

This UDF encrypts the FLOAT data with a data element for encryption.

Signature:

pty.ins_encrypt_float (dataelement CHAR, inval FLOAT, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalFLOATSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted values as the RAW data.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.ins_encrypt_float('DE_AES256', 1234.1234, 0) "Test of INSERT enc FLOAT func" from dual;

pty.ins_encrypt_number

This UDF encrypts the NUMBER data with a data element for encryption.

Signature:

pty.ins_encrypt_number (dataelement CHAR, inval NUMBER, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalNUMBERSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted values as the RAW data.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.ins_encrypt_number('DE_AES256', 12345, 0) "Test of INSERT enc NUMBER func" from dual;

pty.ins_encrypt_raw

This UDF encrypts the RAW data, which is variable length binary data of maximum size 2000 bytes, with a data element for encryption.

Signature:

pty.ins_encrypt_raw(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted values as the RAW data.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.ins_encrypt_raw('DE_AES256', 'FFDD12345', 0) "Test of INSERT enc RAW func" from dual;

2.4 - Insert No-Encryption, Token, and FPE UDFs

These UDFs are used with Tokenization, Format Preserving Encryption (FPE) and, No Encryption data elements.

pty.ins_char

This UDF protects the CHAR data with tokenization and No Encryption data elements.

Note: This UDF supports masking.

Signature:

pty.ins_char (dataelement CHAR, inval CHAR, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalCHARSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the protected value as the CHAR data type.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.ins_char('DE_CHAR', 'Original data', 0) "Test of INSERT CHAR func" from dual;

pty.ins_varchar2

This UDF protects the VARCHAR data with tokenization and No Encryption data elements.

Note: This UDF supports masking.

CAUTION: For Date type of data elements, the pty.ins_varchar2 UDF returns an invalid date format error if the input value falls between the non-existent date range from 05-OCT-1582 to 14-OCT-1582 of the Gregorian Calendar. For more information about the tokenization and de-tokenization of the cutover dates of the Proleptic Gregorian Calendar, refer to the section Date Tokenization for cutover Dates of the Proleptic Gregorian Calendar in Protection Methods Reference.

Signature:

pty.ins_varchar2 (dataelement CHAR, inval VARCHAR2, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the protected value as the VARCHAR2 data type.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.ins_varchar2('DE_VARCHAR2', 'Original data', 0) "Test of INSERT VARCHAR2 func" from dual; 

pty.ins_unicodenvarchar2

This UDF encrypts data with a data element.

Note: This UDF does not support masking.

Signature:

pty.ins_unicodenvarchar2 (dataelement CHAR, inval CHAR, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalCHARSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the protected value as the NVARCHAR2 datatype.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message that explains what went wrong. >Note: Ensure to use the supported data element only. Using an unsupported data element might result in successful protection without returning any error, but corruption of data can occur.

Example:

select pty.ins_unicodenvarchar2('fpe_unicode', 'Original data', 0) "Test of INSERT encrypt func" from dual;

pty.ins_unicodevarchar2_tok

This UDF protects the VARCHAR2 data with a Unicode Gen2 data element.

Note: This UDF does not support masking.

Signature:

pty.ins_unicodevarchar2_tok(dataelement IN CHAR, inval IN VARCHAR2, SCID IN BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the protected value as the VARCHAR2 datatype.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message that explains what went wrong. >Note: Ensure to use the supported data element only. Using an unsupported data element might result in successful protection without returning any error, but corruption of data can occur.

Example for Unicode Gen2:

```
select pty.ins_unicodevarchar2_tok('TE_UG2_UTF16LE_LL1AN_SLT13_L2R0_ASTYES',N'xyzÀÁÂÃÄÅÆÇÈÉÊ',0) from dual;
```

```
select pty.ins_unicodevarchar2_tok('TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE',N'ϠϡϢϣϥϦ',0) from dual;
```

pty.ins_unicodenvarchar2_tok

This UDF protects the NVARCHAR2 data with a Unicode Gen2 data element.

Note: This UDF does not support masking.

Signature:

pty.ins_unicodenvarchar2_tok(dataelement IN CHAR, inval IN NVARCHAR2, SCID IN BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalNVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the protected value as the NVARCHAR2 data type.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message that explains what went wrong. >Note: Ensure to use the supported data element only. Using an unsupported data element might result in successful protection without returning any error, but corruption of data can occur.

Example for Unicode Gen2:
select pty.ins_unicodenvarchar2_tok('TE_UG2_UTF16LE_LL1AN_SLT13_L2R0_ASTYES',N'xyzÀÁÂÃÄÅÆÇÈÉÊ',0) from dual;

```
select pty.ins_unicodenvarchar2_tok('TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE',N'ϠϡϢϣϥϦ',0) from dual;
```

pty.ins_date

This UDF protects the DATE data with a tokenization and No Encryption data element.

Signature:

pty.ins_date (dataelement CHAR, inval DATE, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalDATESpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected DATE value, when No Encryption data element is used.
  • This UDF returns the protected DATE value, when a tokenization data element is used and if the data element date format and the NLS_DATE_FORMAT environment variable for an Oracle session is the same as mentioned in the note above.

Exception:

  • No Encryption Date Element: If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.
  • Tokenization Date Element: Tokenization fails and the UDF terminates with an error message explaining what went wrong.

Example for No Encryption:

select PTY.ins_date('DE_NoEnc', '10-23-2014', 0) "Test of INSERT DATE func" from dual;

Example for Tokenization:

select PTY.ins_date('DE_DATE', '10-23-2014', 0) "Test of INSERT DATE func" from dual;

pty.ins_integer

This UDF protects the INTEGER data with a tokenization and No Encryption data element.

Signature:

pty.ins_integer(dataelement CHAR, inval INTEGER, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalINTEGERSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the protected value as the INTEGER datatype.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.ins_integer('DE_Integer', 12345, 0) "Test of INSERT INT func" from dual;

pty.ins_real

This UDF protects the REAL data with a No Encryption data element.

Note: Data corruption occurs when the input length exceeds 10 decimal digits in the REAL datatype.

Signature:
pty.ins_real(dataelement CHAR, inval REAL, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalREALSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotected value as the REAL datatype.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. If an unsupported data element is passed, then the UDF returns the following error:
character to number conversion error

Example:

select PTY.ins_real('DE_NoEnc', 1234.1234, 0) "Test of INSERT REAL func" from dual;

pty.ins_float

This UDF protects the FLOAT data with a No Encryption data element.

Signature:

pty.ins_float (dataelement CHAR, inval FLOAT, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalFLOATSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotected value as the FLOAT datatype.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. If an unsupported data element is passed, then the UDF returns the following error:
character to number conversion error

Example:

select PTY.ins_float('DE_NoEnc', 1234.1234, 0) "Test of INSERT FLOAT func" from dual;

pty.ins_number

This UDF protects the NUMBER data with tokenization and No Encryption data elements.

Note: Data corruption occurs when the input length exceeds 10 decimal digits in the NUMBER datatype.

Signature:

pty.ins_number (dataelement CHAR, inval NUMBER, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalNUMBERSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotected value as the NUMBER datatype.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. If an unsupported data element is passed, then the UDF returns the following error:
character to number conversion error

Example:

select PTY.ins_number('DE_Integer', 12345, 0) "Test of INSERT NUMBER func" from dual;

pty.ins_raw

This UDF protects the RAW data with a No Encryption data element.

Signature:

pty.ins_raw (dataelement CHAR, inval RAW, scid BINARY_INTEGER\)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotected value as RAW data.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. If an unsupported data element is passed, then the UDF returns the following error:
character to number conversion error

Example:

select PTY.ins_raw('DE_NoEnc', 'FFDD12345', 0) "Test of INSERT RAW func" from dual;

2.5 - Multiple Insert Encryption Procedures

These procedures encrypt one to four values of data with one procedure call. The user must be granted Protect access for the data element that will be used to execute these procedures. You can use the ins_check procedure to check whether the user has Protect access.

Note: These UDFs are marked for deprecation and will be removed from the future releases. Protegrity recommends to use the standard Insert or Protect UDFs.

pty.encInsert

This procedure encrypts one value of VARCHAR2 data with one data element for encryption.

Signature:

pty.encInsert(dataelement VARCHAR2, cdata VARCHAR2, rdata RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementVARCHAR2Specifies the name of the data element.
cdataVARCHAR2Specifies the input data
rdataRAWSpecifies the encrypted output data
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This procedure returns the encrypted value as RAW data.

Exception:
If you configure an exception in the policy and the user does not have Protect access rights in the policy, then the procedure terminates with an error message explaining what went wrong.

Example:

declare 
  raw_out raw(2000); 
begin 
  dbms_output.put_line('Test of INSERT multi encryption procedure for 1 
    COLUMN');
  dbms_output.put_line('----------------------------------------------');
  pty.encInsert('DE_AES256', 'ASFGFGghg5577fFFyu', raw_out, 0);
  DBMS_OUTPUT.PUT_LINE('Encrypted data: ' || raw_out);
end;

pty.ins_encryptx2

This procedure encrypts two values of VARCHAR2 data with two data elements for encryption.

Signature:

pty.ins_encryptx2 (dataelement1 VARCHAR2, cdata1 VARCHAR2, rdata1 RAW, scid1 BINARY_INTEGER, dataelement2 VARCHAR2, cdata2 VARCHAR2, rdata2 RAW, scid2 BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelement1VARCHAR2Speicifies the name of the data element.
cdata1VARCHAR2Specifies the input data.
rdata1RAWSpecifies the encrypted output data.
scid1BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement2VARCHAR2Speicifies the name of the data element.
cdata2VARCHAR2Specifies the input data.
rdata2RAWSpecifies the encrypted output data.
scid2BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This procedure returns the encrypted values as RAW data.

Exception:
If you configure an exception in the policy and the user does not have Protect access rights in the policy, then the procedure terminates with an error message explaining what went wrong.

Example:

Encrypted values are the output parameters 
declare 
  raw_out1 raw(2000);
  raw_out2 raw(2000);
begin 
  dbms_output.put_line('Test of INSERT multi encryption procedure for 2 
    COLUMNS');
  dbms_output.put_line('---------------------------------------------');
  pty.ins_encryptx2('DE_AES256', 'ASFGFGghg5577fFFyu', raw_out1, 0, 
    'DE_AES256', 'IyutGGg76hg8h1', raw_out2, 0);
  DBMS_OUTPUT.PUT_LINE('Encrypted data1: ' || raw_out1);
  DBMS_OUTPUT.PUT_LINE('Encrypted data2: ' || raw_out2);
end;

pty.ins_encryptx3

This procedure encrypts three values of VARCHAR2 data with three data elements for encryption.

Signature:

pty.ins_encryptx3(dataelement1 VARCHAR2, cdata1 VARCHAR2, rdata1 RAW, scid1 BINARY_INTEGER, dataelement2 VARCHAR2, cdata2 VARCHAR2, rdata2 RAW, scid2 BINARY_INTEGER, dataelement3 VARCHAR2, cdata3 VARCHAR2, rdata3 RAW, scid3 BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelement1VARCHAR2Specifies the name of the data element.
cdata1VARCHAR2Specifies the input data
rdata1RAWSpecifies the encrypted output data
scid1BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement2VARCHAR2Specifies the name of the data element.
cdata2VARCHAR2Specifies the input data
rdata2RAWSpecifies the encrypted output data
scid2BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement3VARCHAR3Specifies the name of the data element.
cdata3VARCHAR3Specifies the input data
rdata3RAWSpecifies the encrypted output data
scid3BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This procedure returns the encrypted values as RAW data.

Exception:
If you configure an exception in the policy and the user does not have Protect access rights in the policy, then the procedure terminates with an error message explaining what went wrong.

Example:

declare 
  raw_out1 raw(2000);
  raw_out2 raw(2000);
  raw_out3 raw(2000);
begin 
  dbms_output.put_line('Test of INSERT multi encryption procedure for 3 
    COLUMNS');
  dbms_output.put_line('---------------------------------------------');
  pty.ins_encryptx3('DE_AES256', 'ASFGFGghg5577fFFyu', raw_out1, 0, 
    'DE_AES256', 'IyutGGg76hg8h1', raw_out2, 0, 'DE_AES256', 'AAaazzZZ1199', 
    raw_out3, 0);
  DBMS_OUTPUT.PUT_LINE('Encrypted data1: ' || raw_out1);
  DBMS_OUTPUT.PUT_LINE('Encrypted data2: ' || raw_out2);
  DBMS_OUTPUT.PUT_LINE('Encrypted data3: ' || raw_out3);
end;

pty.ins_encryptx4

This procedure encrypts four values of VARCHAR2 data with four data elements for encryption.

Signature:

pty.ins_encryptx4(dataelement1 VARCHAR2, cdata1 VARCHAR2, rdata1 RAW, scid1 BINARY_INTEGER, dataelement2 VARCHAR2, cdata2 VARCHAR2, rdata2 RAW, scid2 BINARY_INTEGER, dataelement3 VARCHAR2, cdata3 VARCHAR2, rdata3 RAW, scid3 BINARY_INTEGER, dataelement4 VARCHAR2, cdata4 VARCHAR2, rdata4 RAW, scid4 BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelement1VARCHAR2Specifies the name of the data element.
cdata1VARCHAR2Specifies the input data
rdata1RAWSpecifies the encrypted output data
scid1BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement2VARCHAR2Specifies the name of the data element.
cdata2VARCHAR2Specifies the input data
rdata2RAWSpecifies the encrypted output data
scid2BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement3VARCHAR3Specifies the name of the data element.
cdata3VARCHAR3Specifies the input data
rdata3RAWSpecifies the encrypted output data
scid3BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement4VARCHAR2Specifies the name of the data element.
cdata4VARCHAR2Specifies the input data.
rdata4RAWSpecifies the encrypted output data.
scid4BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This procedure returns the encrypted value as RAW data.

Exception:
If you configure an exception in the policy and the user does not have Protect access rights in the policy, then the procedure terminates with an error message explaining what went wrong.

Example:

declare 
  raw_out1 raw(2000);
  raw_out2 raw(2000);
  raw_out3 raw(2000);
  raw_out4 raw(2000);
begin 
  dbms_output.put_line('Test of INSERT multi encryption procedure for 4 
    COLUMNS');
  dbms_output.put_line('---------------------------------------------');
  pty.ins_encryptx4('DE_AES256', 'ASFGFGghg5577fFFyu', raw_out1, 0, 
    'DE_AES256', 'IyutGGg76hg8h1', raw_out2, 0, 'DE_AES256', 'AAaazzZZ1199', 
    raw_out3, 0, 'DE_AES256', 'fhgdADGHSJddeg', raw_out4, 0);
  DBMS_OUTPUT.PUT_LINE('Encrypted data1: ' || raw_out1);
  DBMS_OUTPUT.PUT_LINE('Encrypted data2: ' || raw_out2);
  DBMS_OUTPUT.PUT_LINE('Encrypted data3: ' || raw_out3);
  DBMS_OUTPUT.PUT_LINE('Encrypted data3: ' || raw_out4);
end;

2.6 - Select Decryption UDFs

The UDFs in this section decrypt the encrypted data. Unprotect access is required to use these procedures.

pty.sel_decrypt

This UDF decrypts the RAW data with an encryption data element.

Signature:

pty.sel_decrypt(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the CHAR2 datatype.
  • This UDF returns the unprotected value as the NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_decrypt('DE_AES256', PTY.ins_encrypt('DE_AES256', 'Original data', 0),0) "Test of SELECT dec func" from dual;

pty.sel_decrypt_char

This UDF decrypts the CHAR data with an encryption data element.

Signature:

pty.sel_decrypt_char(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the CHAR2 datatype.
  • This UDF returns the unprotected value as the NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_decrypt_char('AES256', PTY.ins_encrypt_char('AES256', 'Original data', 0),0) "Test of SELECT dec CHAR func" from dual; 

pty.sel_decrypt_varchar2

This UDF decrypts the VARCHAR2 data with an encryption data element.

Signature:

pty.sel_decrypt_varchar2(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the VARCHAR2 datatype.
  • This UDF returns the unprotected value as the NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_decrypt_varchar2('AES256', PTY.ins_encrypt_varchar2('AES256','Original data', 0),0) "Test of SELECT dec VARCHAR2 func" from dual;

pty.sel_decrypt_date

This UDF decrypts the DATE data with an encryption data element.

Signature:

pty.sel_decrypt_date(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the DATE datatype.
  • This UDF returns the unprotected value as the NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_decrypt_date('DE_AES256', PTY.ins_encrypt_date('DE_AES256', '23-OCT-14', 0),0) "Test of SELECT dec DATE func" from dual;

pty.sel_decrypt_integer

This UDF decrypts the INTEGER data with an encryption data element.

Signature:

pty.sel_decrypt_integer(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the INTEGER datatype.
  • This UDF returns the unprotected value as the NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_decrypt_integer('DE_AES256', PTY.ins_encrypt_integer('DE_AES256', 12345, 0),0) "Test of SELECT dec INT func" from dual;

pty.sel_decrypt_real

This UDF decrypts the REAL data with an encryption data element.

Signature:

pty.sel_decrypt_real(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the REAL datatype.
  • This UDF returns the unprotected value as the NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_decrypt_real('AES256', PTY.ins_encrypt_real('AES256',1234.1234,0),0) “Test of SELECT dec REAL func” from dual;

pty.sel_decrypt_float

This UDF decrypts the FLOAT data with an encryption data element.

Signature:

pty.sel_decrypt_float(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the FLOAT datatype.
  • This UDF returns the unprotected value as the NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_decrypt_float('DE_AES256', PTY.ins_encrypt_float('DE_AES256', 1234.1234, 0),0) "Test of SELECT dec FLOAT func" from dual;

pty.sel_decrypt_number

This UDF decrypts the NUMBER data with an encryption data element.

Signature:

pty.sel_decrypt_number(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the NUMBER datatype.
  • This UDF returns the unprotected value as the NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_decrypt_number('DE_AES256', PTY.ins_encrypt_number('DE_AES256', 12345, 0),0) "Test of SELECT dec NUMBER func" from dual;

pty.sel_decrypt_raw

This UDF decrypts the RAW data with an encryption data element.

Signature:

pty.sel_decrypt_raw(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the RAW data.
  • This UDF returns the unprotected value as the NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have access, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_decrypt_raw('AES256', PTY.ins_encrypt_raw('AES256', 'FFDD12345', 0),0) "Test of SELECT dec RAW func" from dual;

2.7 - Select No-Encryption, Token, and FPE UDFs

These UDFs unprotect the protected data. Unprotect access is required to use these UDFs.

pty.sel_char

This UDF unprotects the CHAR data with tokenization and No Encryption data elements.

Note: This UDF supports masking.

Signature:

pty.sel_char(dataelement CHAR, inval CHAR, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalCHARSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the CHAR datatype.
  • This UDF returns the protected value, if this option is configured in the policy and user does not have access to data.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.
  • This UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_char('DE_DTP2_AES256_AN', PTY.ins_char('DE_DTP2_AES256_AN', 'Original data', 0),0) "Test of SELECT CHAR func" from dual;

pty.sel_varchar2

This UDF unprotects the VARCHAR2 data with tokenization and No Encryption data elements.

Note: This UDF supports masking.

Signature:

pty.sel_varchar2(dataelement CHAR, inval VARCHAR2, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the VARCHAR2 datatype.
  • This UDF returns the protected value, if this option is configured in the policy and user does not have access to data.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.
  • This UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_varchar2('DE_DTP2_AES256_AN', PTY.ins_varchar2('DE_DTP2_AES256_AN', 'Original data', 0),0) "Test of SELECT VARCHAR2 func" from dual;

pty.sel_unicodenvarchar2

This UDF unprotects the protected NVARCHAR data.

Note: This UDF does not support masking.

Signature:

pty.sel_unicodenvarchar2(dataelement CHAR, inval NVARCHAR2, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalNVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the NVARCHAR2 datatype.
  • This UDF returns the protected value, if this option is configured in the policy and user does not have access to data.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.
  • This UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. Using an unsupported data element might result in successful unprotection without returning any error, but corruption of data can occur.

Example:

select pty.sel_unicodenvarchar2('fpe_unicode', PTY.ins_unicodenvarchar2('fpe_unicode', 'Original data', 0),0) "Test of SELECT NVARCHAR2 func" from dual;

pty.sel_unicodevarchar2_tok

This UDF unprotects the VARCHAR2 data protected by a Unicode Base64 and Unicode Gen2 data element.

Note: This UDF does not support masking.

Signature:

pty.sel_unicodevarchar2_tok(dataelement IN CHAR, inval IN VARCHAR2, SCID IN BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotected value as VARCHAR2.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. Using an unsupported data element might result in successful unprotection without returning any error, but corruption of data can occur.

Example for Unicode Base64:

select pty.sel_unicodevarchar2_tok('TE_UNICODE_BASE64_SLT13_ASTYES', pty.ins_unicodevarchar2_tok('TE_UNICODE_BASE64_SLT13_ASTYES', 'Protegrity123',0),0) from dual;

Example for Unicode Gen2:
select pty.sel_unicodevarchar2_tok('TE_UG2_UTF16LE_LL1AN_SLT13_L2R0_ASTYES',pty.ins_unicodevarchar2_tok('TE_UG2_UTF16LE_LL1AN_SLT13_L2R0_ASTYES',N'xyzÀÁÂÃÄÅÆÇÈÉÊ',0),0) from dual; select pty.sel_unicodevarchar2_tok('TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE',pty.ins_unicodevarchar2_tok('TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE',N'ϠϡϢϣϥϦ',0),0) from dual;

pty.sel_unicodenvarchar2_tok

This UDF unprotects the NVARCHAR2 data protected by a Unicode Gen2 data element.

Note: This UDF does not support masking.

Signature:

pty.sel_unicodenvarchar2_tok(dataelement IN CHAR, inval IN NVARCHAR2, SCID IN BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalNVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotected value as NVARCHAR2.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. Using an unsupported data element might result in successful unprotection without returning any error, but corruption of data can occur.

Example for Unicode Gen2:
select pty.sel_unicodenvarchar2_tok('TE_UG2_UTF16LE_LL1AN_SLT13_L2R0_ASTYES',pty.ins_unicodenvarchar2_tok('TE_UG2_UTF16LE_LL1AN_SLT13_L2R0_ASTYES',N'xyzÀÁÂÃÄÅÆÇÈÉÊ',0),0) from dual;

```
select 
pty.sel_unicodenvarchar2_tok('TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE',pty.ins_unicodenvarchar2_tok('TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE',N'ϠϡϢϣϥϦ',0),0) from dual;
```

pty.sel_date

This UDF unprotects the DATE data with a No Encryption data element.

Signature:

pty.sel_date(dataelement CHAR, inval DATE, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalDATESpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the DATE datatype.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.
  • This UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_date('DE_NoEnc', PTY.ins_date('DE_NoEnc', '23-OCT-14', 0),0) "Test of SELECT DATE func" from dual;

pty.sel_integer

This UDF unprotects the INTEGER data with tokenization and No Encryption data elements.

Signature:

pty.sel_integer(dataelement CHAR, inval INTEGER, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalINTEGERSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the INTEGER datatype.
  • This UDF returns the protected value, if this option is configured in the policy and user does not have access to data.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.
  • This UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.sel_integer('Integer4',PTY.ins_integer('integer',12344567,0),0) “Test of SELECT INT func” from dual;

pty.sel_real

This UDF unprotects the REAL data with a No Encryption data element.

Signature:

pty.sel_real(dataelement CHAR, inval REAL, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalREALSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the REAL datatype.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.
  • This UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. If an unsupported data element is passed, the following error is returned: character to number conversion error.

Example:

select PTY.sel_real('DE_NoEnc', PTY.ins_real('DE_NoEnc', 1234.1234, 0),0) "Test of SELECT REAL func" from dual;

pty.sel_float

This UDF unprotects the FLOAT data with a No Encryption data element.

Signature:

pty.sel_float(dataelement CHAR, inval FLOAT, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalFLOATSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the FLOAT datatype.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.
  • This UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. If an unsupported data element is passed, the following error is returned: character to number conversion error.

Example:

select PTY.sel_float('DE_NoEnc', PTY.ins_float('DE_NoEnc', 1234.1234, 0),0) "Test of SELECT FLOAT func" from dual; 

pty.sel_number

This UDF unprotects the NUMBER data with tokenization and No Encryption data elements.

Signature:

pty.sel_number(dataelement CHAR, inval NUMBER, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalNUMBERSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the NUMBER datatype.
  • This UDF returns the protected value, if this option is configured in the policy and user does not have access to data.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.
  • This UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. If an unsupported data element is passed, the following error is returned: character to number conversion error.

Example:

select PTY.sel_number('DE_Integer', PTY.ins_number('DE_Integer', 123455667, 0),0) "Test of SELECT NUMBER func" from dual; 

pty.sel_raw

This UDF unprotects the RAW data with a No Encryption data element.

Signature:

pty.sel_raw(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the unprotected value as the RAW data.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.
  • This UDF returns the unprotected value as NULL, when the user is not specified in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. If an unsupported data element is passed, the following error is returned: character to number conversion error.

Example:

select PTY.sel_raw('DE_NoEnc', PTY.ins_raw('DE_NoEnc', 'FFDD12345', 0),0) "Test of SELECT RAW func" from dual;

2.8 - Update Encryption UDFs

These UDFs update the data. Protect access is required to use these functions.

Note: These UDFs are marked for deprecation and will be removed from the future releases. Protegrity recommends to use the standard Insert or Protect UDFs.

pty.encUpdate

This procedure updates and encrypts one value of the VARCHAR2 data with one data element for encryption.

Signature:

pty.encUpdate(dataelement VARCHAR2, cdata VARCHAR2, rdata RAW, scid INTEGER)

Parameters:

NameTypeDescription
dataelementVARCHAR2Specifies the name of the data element.
cdataVARCHAR2Specifies the input data.
rdataRAWSpecifies the encrypted output data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have reprotect access rights in the policy, then the procedure terminates with an error message explaining what went wrong.

Example:

declare 
  raw_out raw(2000); 
begin 
  dbms_output.put_line('Test of UPDATE multi encryption procedure for 1
    COLUMN');
  dbms_output.put_line('------------------------------------------------
    ------');
  pty.encUpdate('DE_AES256', 'ASFGFGghg5577fFFyu', raw_out, 0);
  DBMS_OUTPUT.PUT_LINE('Encrypted data: ' || raw_out);
end;

pty.upd_encrypt_char

This UDF re-encrypts the CHAR protected data that has been updated, with a data element for encryption.

Signature:

pty.upd_encrypt_char(dataelement CHAR, inval CHAR, scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalCHARSpecifies the input data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_encrypt_char('DE_AES256', 'Original data', 0) "Test of UPDATE enc CHAR func" from dual;

pty.upd_encrypt_varchar2

This UDF re-encrypts the VARCHAR2 data that has been updated, with a data element for encryption.

Signature:

pty.upd_encrypt_varchar2(dataelement CHAR, inval VARCHAR2, scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalVARCHAR2Specifies the input data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_encrypt_varchar2('DE_AES256', 'Original data', 0) "Test of UPDATE enc VARCHAR2 func" from dual;

pty.upd_encrypt_date

This UDF re-encrypts the DATE data that has been updated, with a data element for encryption.

Note: When you use the pty.ins_encrypt_date UDF to protect date, the data is not protected. If you want to protect the Oracle input data type DATE, you must use the UDFs as described in Oracle Input Data Type to UDF Mapping to identify the appropriate UDF as per your requirement.

Signature:

pty.upd_encrypt_date(dataelement CHAR, inval DATE, scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalDATESpecifies the input data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_encrypt_date('DE_AES256', '23-OCT-14', 0) "Test of UPDATE enc DATE func" from dual;

pty.upd_encrypt_integer

This UDF re-encrypts the INTEGER data that has been updated, with a data element for encryption.

Signature:
pty.upd_encrypt_integer(dataelement CHAR, inval INTEGER, scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalINTEGERSpecifies the input data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_encrypt_integer('DE_AES256', 12345, 0) "Test of UPDATE enc INT func" from dual;

pty.upd_encrypt_real

This UDF re-encrypts the REAL data that has been updated, with a data element for encryption.

Signature:

pty.upd_encrypt_real(dataelement CHAR, inval REAL, scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalREALSpecifies the input data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_encrypt_real('DE_AES256', 1234.1234, 0) "Test of UPDATE enc REAL func" from dual;

pty.upd_encrypt_float

This UDF re-encrypts the FLOAT data that has been updated, with a data element for encryption.

Signature:

pty.upd_encrypt_float(dataelement CHAR, inval FLOAT, scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalFLOATSpecifies the input data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_encrypt_float('DE_AES256', 1234.1234, 0) "Test of UPDATE enc FLOAT func" from dual;

pty.upd_encrypt_number

This UDF re-encrypts the NUMBER data that has been updated, with a data element in encryption.

Signature:

pty.upd_encrypt_number(dataelement CHAR, inval NUMBER, scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalNUMBERSpecifies the input data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_encrypt_number('DE_AES256', 12345, 0) "Test of UPDATE enc NUMBER func" from dual;

pty.upd_encrypt_raw

This UDF re-encrypts the RAW data that has been updated, with a data element for encryption.

Signature:

pty.upd_encrypt_raw(dataelement CHAR, inval RAW, scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as RAW data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_encrypt_raw('DE_AES256', 'FFDD12345', 0) "Test of UPDATE enc RAW func" from dual; 

2.9 - Update No-Encryption, Token, and FPE UDFs

These UDFs are used to update the data for tokenization and Format Preserving Encryption (FPE). The user must have Protect access to use these procedures.

Note: For reprotect operations, the Audit logs are generated as Protect Logs instead of Reprotect Logs.

Note: These UDFs are marked for deprecation and will be removed from the future releases. Protegrity recommends to use the standard Insert or Protect UDFs.

pty.upd_char

This UDF re-protects the CHAR data with tokenization and No Encryption data elements.

Signature:

pty.upd_char(dataelement CHAR, inval CHAR, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalCHARSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the output value as the CHAR datatype.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_char('DE_DTP2_AES256_AN', 'Original data', 0) "Test of UPDATE CHAR func" from dual;

pty.upd_varchar2

This UDF reprotects the VARCHAR2 data with tokenization and No Encryption data elements.

Signature:

pty.upd_varchar2(dataelement CHAR, inval VARCHAR2, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the output value as the VARCHAR2 datatype.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_varchar2('DE_DTP2_AES256_AN', 'Original data', 0) "Test of UPDATE VARCHAR2 func" from dual;

pty.upd_unicodenvarchar2

This UDF re-encrypts the NVARCHAR2 data that has been updated, with a data element.

Signature:

pty.upd_unicodenvarchar2(dataelement CHAR, inval NVARCHAR2, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalNVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as the NVARCHAR2 data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. Using an unsupported data element might result in successful reprotection without returning any error, but corruption of data can occur.

Example:

select PTY.upd_unicodenvarchar2('fpe_unicode', 'Original data', 0) "Test of UPDATE encrypt NVARCHAR2 func" from dual;

pty.upd_unicodevarchar2_tok

This UDF re-encrypts the VARCHAR2 data that has been updated with a Unicode Base64 and Unicode Gen2 data element.

Signature:

pty.upd_unicodevarchar2_tok (dataelement IN CHAR, inval IN VARCHAR2, SCID IN BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as VARCHAR2 data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. Using an unsupported data element might result in successful reprotection without returning any error, but corruption of data can occur.

Example:

select pty.upd_unicodevarchar2_tok('TE_UG2_S13_PL_N_BASCYR_AN_UTF8','‎защита данных‎',0) from dual;

pty.upd_unicodenvarchar2_tok

This UDF re-encrypts the NVARCHAR2 data that has been updated with a Unicode Base64 and Unicode Gen2 data element.

Signature:
pty.upd_unicodenvarchar2_tok(dataelement IN CHAR, inval IN NVARCHAR2, SCID IN BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalNVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns an encrypted value as NVARCHAR2 data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.
>Note: Ensure to use the supported data element only. Using an unsupported data element might result in successful reprotection without returning any error, but corruption of data can occur.

Example:

select pty.upd_unicodenvarchar2_tok('TE_UG2_S13_PL_N_BASCYR_AN_UTF8','‎защита данных‎',0) from dual;

pty.upd_date

This UDF reprotects the DATE data with a No Encryption data element.

Note: When you use the pty.ins_encrypt_date UDF to protect date, the data is not protected. If you want to protect the Oracle input data type DATE, you must use the UDFs as described in Oracle Input Data Type to UDF Mapping to identify the appropriate UDF as per your requirement.

Signature:

pty.upd_date (dataelement CHAR, inval DATE, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalDATESpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
The UDF returns the original value as DATE.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_date('DE_NoEnc', '23-OCT-14', 0) "Test of UPDATE DATE func" from dual; 

pty.upd_integer

This UDF re-protects the INTEGER data with tokenization and No Encryption data elements.

Signature:

pty.upd_integer(dataelement CHAR, inval INTEGER, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalINTEGERSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the original value as the INTEGER datatype.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select PTY.upd_integer('DE_Integer', 12345, 0) "Test of UPDATE INT func" from dual;

pty.upd_real

This UDF reprotects the REAL data with a No Encryption data element.

Note: Data corruption occurs when the input length exceeds 10 decimal digits in the REAL datatype.

Signature:

pty.upd_real(dataelement CHAR, inval REAL, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalREALSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the original value as the REAL datatype.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. If an unsupported data element is passed, the following error is returned: character to number conversion error.

Example:

select PTY.upd_real('DE_NoEnc', 1234.1234, 0) "Test of UPDATE REAL func" from dual;

pty.upd_float

This UDF reprotects the FLOAT data with a No Encryption data element.

Signature:

pty.upd_float(dataelement CHAR, inval FLOAT, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalFLOATSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the original value as the FLOAT datatype.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure that you use the supported data element only. If an unsupported data element is passed, the following error is returned: character to number conversion error.

Example:

select PTY.upd_float('DE_NoEnc', 1234.1234, 0) "Test of UPDATE FLOAT func" from dual;

pty.upd_number

This UDF reprotects the NUMBER data with tokenization and No Encryption data elements.

Note: Data corruption occurs when the input length exceeds 10 decimal digits in the NUMBER datatype.

Signature:

pty.upd_number(dataelement CHAR, inval NUMBER, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalNUMBERSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the original value as the NUMBER datatype.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure that you use the supported data element only. If an unsupported data element is passed, the following error is returned: character to number conversion error.

Example:

select PTY.upd_number('DE_Integer', 12345, 0) "Test of UPDATE NUMBER func" from dual;

pty.upd_raw

This UDF re-protects the RAW data with a No Encryption data element.

Signature:

pty.upd_raw(dataelement CHAR, inval RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
invalRAWSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the original value as the RAW data.

Exception:
If the user does not have reprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong. >Note: Ensure to use the supported data element only. If an unsupported data element is passed, the following error is returned: character to number conversion error.

Example:

select PTY.upd_raw('DE_NoEnc', 'FFDD12345', 0) "Test of UPDATE RAW func" from dual;

2.10 - Multiple Update Encryption Procedures

These procedures encrypt one to four values of data with one procedure call. The user must be granted Protect access for the data element that will be used to execute these procedures. You can use the upd_check procedure to check whether the user has Protect access.

Note: These UDFs are marked for deprecation and will be removed from the future releases. Protegrity recommends to use the standard Insert or Protect UDFs.

pty.encUpdate

This procedure updates and encrypts one value of the VARCHAR2 data with one data element for encryption.

Signature:

pty.encUpdate (dataelement VARCHAR2, cdata VARCHAR2, rdata RAW, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementVARCHAR2Specifies the name of the data element.
cdataVARCHAR2Specifies the input data
rdataRAWSpecifies the encrypted output data
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This procedure returns the encrypted value as RAW data.

Exception:
If you configure an exception in the policy and the user does not have Protect access rights in the policy, then the procedure terminates with an error message explaining what went wrong.

Example:

declare 
  raw_out raw(2000); 
begin 
  dbms_output.put_line('Test of UPDATE multi encryption procedure for 1
    COLUMN');
  dbms_output.put_line('------------------------------------------------
    ------');
  pty.encUpdate('DE_AES256', 'ASFGFGghg5577fFFyu', raw_out, 0);
  DBMS_OUTPUT.PUT_LINE('Encrypted data: ' || raw_out);
end;

pty.upd_encryptx2

This procedure updates and encrypts two values of VARCHAR2 data with two data elements for encryption.

Signature:

pty.upd_encryptx2(dataelement1 VARCHAR2, cdata1 VARCHAR2, rdata1 RAW, scid1 BINARY_INTEGER, dataelement2 VARCHAR2, cdata2 VARCHAR2, rdata2 RAW, scid2 BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementVARCHAR2Specifies the name of the data element.
cdataVARCHAR2Specifies the input data
rdataRAWSpecifies the encrypted output data
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement2VARCHAR2Speicifies the name of the data element.
cdata2VARCHAR2Specifies the input data.
rdata2RAWSpecifies the encrypted output data.
scid2BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This procedure returns the encrypted value as RAW data.

Exception:
If you configure an exception in the policy and the user does not have Protect access rights in the policy, then the procedure terminates with an error message explaining what went wrong.

Example:

begin 
  dbms_output.put_line('Test of UPDATE multi encryption procedure for 2 
    COLUMNS');
  dbms_output.put_line('------------------------------------------------
    -------');
  pty.upd_encryptx2('DE_AES256', 'ASFGFGghg5577fFFyu', raw_out1, 0, 
    'DE_AES256', 'IyutGGg76hg8h1', raw_out2, 0);
  DBMS_OUTPUT.PUT_LINE('Encrypted data1: ' || raw_out1);
  DBMS_OUTPUT.PUT_LINE('Encrypted data2: ' || raw_out2);
end;

pty.upd_encryptx3

This procedure updates and encrypts three values of VARCHAR2 data with three data elements for encryption.

Signature:

pty.upd_encryptx3 (dataelement1 VARCHAR2, cdata1 VARCHAR2, rdata1 RAW, scid1 BINARY_INTEGER, dataelement2 VARCHAR2, cdata2 VARCHAR2, rdata2 RAW, scid2 BINARY_INTEGER, dataelement3 VARCHAR2, cdata3 VARCHAR2, rdata3 RAW, scid3 BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelement1VARCHAR2Specifies the name of the data element.
cdata1VARCHAR2Specifies the input data
rdata1RAWSpecifies the encrypted output data
scid1BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement2VARCHAR2Specifies the name of the data element.
cdata2VARCHAR2Specifies the input data
rdata2RAWSpecifies the encrypted output data
scid2BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement3VARCHAR2Specifies the name of the data element.
cdata3VARCHAR2Specifies the input data
rdata3RAWSpecifies the encrypted output data
scid3BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This procedure returns the encrypted value as RAW data.

Exception:
If you configure an exception in the policy and the user does not have Protect access rights in the policy, then the procedure terminates with an error message explaining what went wrong.

Example:

begin 
  dbms_output.put_line('Test of UPDATE multi encryption procedure for 3 
    COLUMNS');
  dbms_output.put_line('-----------------------------------------------
    --------');
  pty.upd_encryptx3('DE_AES256', 'ASFGFGghg5577fFFyu', raw_out1, 0,
    'DE_AES256', 'IyutGGg76hg8h1', raw_out2, 0, 'DE_AES256', 'AAaazzZZ1199',
    raw_out3, 0);
  DBMS_OUTPUT.PUT_LINE('Encrypted data1: ' || raw_out1);
  DBMS_OUTPUT.PUT_LINE('Encrypted data2: ' || raw_out2);
  DBMS_OUTPUT.PUT_LINE('Encrypted data3: ' || raw_out3);
end;

pty.upd_encryptx4

This procedure updates and encrypts four values of VARCHAR2 data with four data elements for encryption.

Signature:

pty.upd_encryptx4 (dataelement1 VARCHAR2, cdata1 VARCHAR2, rdata1 RAW, scid1 BINARY_INTEGER, dataelement2 VARCHAR2, cdata2 VARCHAR2, rdata2 RAW, scid2 BINARY_INTEGER, dataelement3 VARCHAR2, cdata3 VARCHAR2, rdata3 RAW, scid3 BINARY_INTEGER, dataelement4 VARCHAR2, cdata4 VARCHAR2, rdata4 RAW, scid4 BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelement1VARCHAR2Specifies the name of the data element.
cdata1VARCHAR2Specifies the input data
rdata1RAWSpecifies the encrypted output data
scid1BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement2VARCHAR2Specifies the name of the data element.
cdata2VARCHAR2Specifies the input data
rdata2RAWSpecifies the encrypted output data
scid2BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement3VARCHAR2Specifies the name of the data element.
cdata3VARCHAR2Specifies the input data
rdata3RAWSpecifies the encrypted output data
scid3BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.
dataelement4VARCHAR2Specifies the name of the data element.
cdata4VARCHAR2Specifies the input data.
rdata4RAWSpecifies the encrypted output data.
scid4BINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This procedure returns the encrypted value as RAW data.

Exception:
If you configure an exception in the policy and the user does not have Protect access rights in the policy, then the procedure terminates with an error message explaining what went wrong.

Example:

begin 
  dbms_output.put_line('Test of UPDATE multi encryption procedure for 4 
    COLUMNS');
  dbms_output.put_line('------------------------------------------------
    -------');
  pty.upd_encryptx4('DE_AES256', 'ASFGFGghg5577fFFyu', raw_out1, 0, 
    'DE_AES256', 'IyutGGg76hg8h1', raw_out2, 0, 'DE_AES256', 'AAaazzZZ1199',
    raw_out3, 0 , 'DE_AES256', ' ASFGFGghg5577fFFyu; AblnQEWsw0129NGku; 
    BINKUcrc8749lLLnx; CAESYwiw0098mMMns; FEORLkjk2323kKKmn; 
    LAENILmcm6677kBBop; MOIRNAzlz9876lMMyu;  MUBMIARAR6087kUUmn; 
   NIASAlziz2398hTTuv; PATRHXuru9898hFFns; ROYNESgog7802gMMus;
   SIRSHAuna9049kKKjn; TOTALSlol7843mWWqa; TUSFAVopo8080tTTnx; 
   TUHSRAknk8108mKKdw; VAENSAJJBJ6712fFFGH; VEPSIMdsd9898kSDnm; 
   URDPLAghg7676LLyu; UNBAKERkik2233lLLmu; YANMRAlsl9090fFFyu; 
   YASTURhom0123hHHmn; XAOILDghg0987fFFmn; ZABCDEmom5577bHHyy; 
  ZOHRASghg5297nNNcd ', raw_out4, 0);
  DBMS_OUTPUT.PUT_LINE('Encrypted data1: ' || raw_out1);
  DBMS_OUTPUT.PUT_LINE('Encrypted data2: ' || raw_out2);
  DBMS_OUTPUT.PUT_LINE('Encrypted data3: ' || raw_out3);
  DBMS_OUTPUT.PUT_LINE('Encrypted data4: ' || raw_out4);
end;

2.11 - Hash UDFs

These UDFs protect the data as a hash value.

pty.ins_hash_varchar2

This UDF uses the hash function to protect the VARCHAR data with a data element for hashing to return a protected value.

Signature:

pty.ins_hash_varchar2(dataelement CHAR, cdata VARCHAR2, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
cdataVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the Hash value as the RAW data.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT PTY.ins_hash_varchar2('DE_Hash', ' ASertcv2013; CUxdcs3675; ccNNddfF9084; hjMjCS0123',0) "Test of INSERT HASH function" from dual; 

pty.upd_hash_varchar2

This UDF uses the hash function to protect the VARCHAR data with a data element for hashing to return a protected value.

Signature:

pty.upd_hash_varchar2(dataelement CHAR, inval VARCHAR2, scid BINARY_INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
cdataVARCHAR2Specifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the Hash value as the RAW data.
  • This UDF returns the unprotected value as NULL, when the user has no access to data in the policy.

Exception:
If configured in policy and user does not have unprotect access rights, then the UDF terminates with an error message explaining what went wrong.

Example:

SELECT PTY.upd_hash_varchar2('DE_Hash', 'ASertcv2013; CUxdcs3675; ccNNddfF9084; hjMjCS0123;',0) "Test of UPDATE HASH function" from dual; 

2.12 - Blob UDFs

These UDFs can be used to encrypt and decrypt the data stored in the BLOB data type.

pty.ins_encrypt_blob

This function is used to encrypt the data stored in a BLOB with an encryption data element.

Signature:

pty.ins_encrypt_blob(dataelement CHAR, input_data BLOB , scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
input_dataBLOBSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as the BLOB data. > Note: If you perform a protect operation with the input data as null or empty, then the output will be an empty_blob.

Exception:
If the user does not have protect privileges in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select pty.ins_encrypt_blob('AES256',TO_BLOB('691F89CD2BCBF055EFD4F3B51470AEF6'),0) from dual;

Caution: A maximum of 1.5 GB of input data can be protected using the pty.ins_encrypt_blob UDF. The pty.ins_encrypt_blob UDF will return an unexpected behaviour if you exceed the maximum input data limit of 1.5 GB. For example: ORA-28579: network error during callback from external procedure agent.

pty.sel_decrypt_blob

This function is used to decrypt the encrypted data stored in a BLOB with an encryption data element.

Signature:

pty.sel_decrypt_blob (dataelement CHAR, input_data BLOB, scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
input_dataBLOBSpecifies the input data.
scidBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the decrypted value as the BLOB data.
  • This UDF returns the decrypted value as an EMPTY_BLOB, when the user has no access to the database.

Note: If you perform a protect operation with the input data as null or empty, then the output will be an empty_blob.

Exception:
If the user does not have unprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select pty.sel_decrypt_blob('AES256',pty.ins_encrypt_blob('AES256',TO_BLOB('691F89CD2BCBF055EFD4F3B51470AEF6'),0),0) from dual;

2.13 - Clob UDFs

These UDFs can be used to encrypt and decrypt the data stored in the CLOB data type.

pty.ins_encrypt_clob

This function is used to encrypt the data stored in a CLOB with an encryption data element.

Signature:

pty.ins_encrypt_clob(dataelement CHAR, input_data CLOB, scid INTEGER)

CAUTION: Ensure that the input data stored in the CLOB data type does not contain multibyte characters. If you pass data containing multibyte characters to the CLOB UDF, then an unexpected behaviour is observed.
For example: An error 'ORA-28579: network error during callback from external procedure agent' is returned or the input data is corrupted. For more information about CLOB data type, refer to the Oracle Help Center.

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
input_dataCLOBSpecifies the input data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the encrypted value as the CLOB data. >Note: If you perform a protect operation with the input data as null or empty, then the output will be an empty_blob.

Exception:
If the user does not have protect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select pty.ins_encrypt_clob('AES256','John',0) from dual;

Note: A maximum of 500 MB of input data can be protected using the pty.ins_encrypt_clob UDF.

pty.sel_decrypt_clob

This function is used to decrypt the encrypted data stored in a BLOB with an encryption data element.

Signature:

pty.sel_decrypt_clob(dataelement CHAR, input_data BLOB, scid INTEGER)

Parameters:

NameTypeDescription
dataelementCHARSpecifies the name of the data element.
input_dataBLOBSpecifies the input data.
scidINTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

  • This UDF returns the decrypted value as the CLOB data.
  • This UDF returns the decrypted value as an EMPTY_CLOB, when the user has no access to the database.

    Note: If you perform a unprotect operation with the input data as null or empty, then the output will be an EMPTY_CLOB.

Exception:
If the user does not have unprotect access rights in the policy, then the UDF terminates with an error message explaining what went wrong.

Example:

select pty.sel_decrypt_clob('AES256',pty.ins_encrypt_clob('AES256','John',0),0) from dual;

2.14 - Bulk UDFs

Bulk User-Defined Functions (UDFs) in Oracle are designed to process multiple rows in a single call, rather than operating on one row at a time like scalar UDFs. They are typically used for batch operations such as tokenization, encryption, or transformation of large datasets. In Oracle v10.0.0, bulk UDFs are implemented to improve efficiency when working with large tables or columns containing sensitive data.

The features of the bulk UDFs are listed below.

  • Accept table name, source column(s), and data element name as arguments.
  • Read multiple records, prepare batches, and process them collectively.
  • Return results for all rows in one execution cycle.

The advantages of bulk UDFs over scalar UDFs are listed below.

FeatureBulk UDFsScalar UDFs
ProcessingBatch processing (multiple rows at once)Row-by-row
PerformanceHigh throughput, reduced overheadSlower for large datasets
Error HandlingStops on first errorReturns an aggregated error list per batch
MaintainabilityCentralized logic, easier to maintainRepetitive calls, harder to audit
Network OverheadMinimal due to fewer function callsHigh due to multiple calls

Note: When ‘NULL’ is passed as a column name, it will be treated a standard SQL term and be processed appropriately. For example, the following query will return NULL under the result column.

select * from pty.ins_varchar2_bulk('tbl_tok_varchar_bulk_positive','NULL','cid','TE_A_S13_L0R0_ASTYES',NULL,0);

Note: In case of an error in executing the bulk UDFs, it is observed that failed queries return the audit log count based on the internal batch size. The range for the batch size ranges from a minimum of 1 to a maximum of 1000 entries.

Note: The source and primary key column names in the tables will be processed and executed as per SQL’s standard behavior.

pty.ins_encrypt_varchar2_bulk

This function is used to encrypt a column of VARCHAR2 data in bulk, returning a table of results with the primary key and encrypted value.

Note: The column_name data must be in the varchar format.

Signature:

pty.ins_encrypt_varchar2_bulk(
    source_table_name IN VARCHAR2,
    column_name IN VARCHAR2,
    pk_column_name IN VARCHAR2,
    dataelement IN CHAR,
    where_clause IN VARCHAR2,
    SCID IN BINARY_INTEGER
)

Parameters:

NameTypeDescription
source_table_nameVARCHAR2Specifies the name of the source table containing the data to encrypt. Quoted identifiers with spaces are supported.
column_nameVARCHAR2Specifies the name of the column to encrypt. Quoted identifiers with spaces are supported.
pk_column_nameVARCHAR2Specifies the name of the primary key column. Quoted identifiers with spaces are supported.
dataelementCHARSpecifies the name of the data element for encryption.
where_clauseVARCHAR2Specifies the clause to filter rows. SQL injection is checked and unsafe clauses are blocked.
Note: The WHERE clause is processed and executed as per SQL’s standard behavior.
SCIDBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns a pipelined table of type raw_4000_table, where each row contains the primary key and the encrypted value for the column. If the input data is null or empty, the output will be NULL.

Example:

SELECT * FROM TABLE(
  pty.ins_encrypt_varchar2_bulk(
    '<table_name>',
    '<input_column>',
    'ID',
    'AES256',
    'WHERE status = ''ACTIVE''',
    0
  )
);

pty.sel_decrypt_varchar2_bulk

This function is used to decrypt a column of RAW (encrypted VARCHAR2) data in bulk, returning a table of results with the primary key and decrypted value.

Note: The source column data must be in the RAW format.

Signature:

pty.sel_decrypt_varchar2_bulk(
    source_table_name IN VARCHAR2,
    column_name IN VARCHAR2,
    pk_column_name IN VARCHAR2,
    dataelement IN CHAR,
    where_clause IN VARCHAR2,
    SCID IN BINARY_INTEGER
)

Parameters:

NameTypeDescription
source_table_nameVARCHAR2Specifies the name of the source table containing the data to decrypt. Quoted identifiers with spaces are supported.
column_nameVARCHAR2Specifies the name of the column to decrypt. Quoted identifiers with spaces are supported.
pk_column_nameVARCHAR2Specifies the name of the primary key column. Quoted identifiers with spaces are supported.
dataelementCHARSpecifies the name of the data element for decryption.
where_clauseVARCHAR2Specifies the clause to filter rows. SQL injection is checked and unsafe clauses are blocked.
Note: The WHERE clause is processed and executed as per SQL’s standard behavior.
SCIDBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

This UDF returns a pipelined table of type result_table_type, where each row contains the primary key and the decrypted value for the column. If the input data is null or empty, the output will be NULL.

Example:

SELECT * FROM TABLE(
  pty.sel_decrypt_varchar2_bulk(
    '<table_name>',
    '<input_column>',
    'ID',
    'AES256',
    'WHERE status = ''ACTIVE''',
    0
  )
);

pty.ins_varchar2_bulk

This function is used to tokenize (protect) a column of VARCHAR2 data in bulk, returning a table of results with primary key and tokenized value.

Note: The column_name data must be in the varchar format.

Signature:

pty.ins_varchar2_bulk(
    source_table_name IN VARCHAR2,
    column_name IN VARCHAR2,
    pk_column_name IN VARCHAR2,
    dataelement IN CHAR,
    where_clause IN VARCHAR2,
    SCID IN BINARY_INTEGER
)

Parameters:

NameTypeDescription
source_table_nameVARCHAR2Specifies the name of the source table containing the data to tokenize. Quoted identifiers with spaces are supported.
column_nameVARCHAR2Specifies the name of the column to tokenize. Quoted identifiers with spaces are supported.
pk_column_nameVARCHAR2Specifies the name of the primary key column. Quoted identifiers with spaces are supported.
dataelementCHARSpecifies the name of the data element for encryption/tokenization.
where_clauseVARCHAR2Specifies the clause to filter rows. SQL injection is checked and unsafe clauses are blocked.
Note: The WHERE clause is processed and executed as per SQL’s standard behavior.
SCIDBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns a pipelined table of type result_table_type, where each row contains the primary key and the tokenized value for the column. If the input data is null or empty, the output will NULL.

Example:

SELECT * FROM TABLE(
  pty.ins_varchar2_bulk(
    '<table_name>',
    '<input_column>',
    'id',
    'TE_A_S13_L1R2_Y',
    'WHERE status = ''ACTIVE''',
    0
  )
);

Example of table to table insert with Bulk UDF:

insert into <target_table>(col1,col2,col3,col4,col5) 
select p.pk_value,e.col2,e.col3,e.col4,p.result
from <source_table> e join table(pty.ins_varchar2_bulk('<source_table>','col5','col1','de_TokName',NULL,0))
on e.col1 = p.pk_value; 

pty.sel_varchar2_bulk

This function is used to detokenize (unprotect) a column of VARCHAR2 data in bulk, returning a table of results with primary key and detokenized value.

Note: The column_name data must be in the VARCHAR2 format.

Signature:

pty.sel_varchar2_bulk(
    source_table_name IN VARCHAR2,
    column_name IN VARCHAR2,
    pk_column_name IN VARCHAR2,
    dataelement IN CHAR,
    where_clause IN VARCHAR2,
    SCID IN BINARY_INTEGER
)

Parameters:

NameTypeDescription
source_table_nameVARCHAR2Specifies the name of the source table containing the data to detokenize. Quoted identifiers with spaces are supported.
column_nameVARCHAR2Specifies the name of the column to detokenize. Quoted identifiers with spaces are supported.
pk_column_nameVARCHAR2Specifies the name of the primary key column. Quoted identifiers with spaces are supported.
dataelementCHARSpecifies the name of the data element for decryption/detokenization.
where_clauseVARCHAR2Specifies the clause to filter rows. SQL injection is checked and unsafe clauses are blocked.
Note: The WHERE clause is processed and executed as per SQL’s standard behavior.
SCIDBINARY_INTEGERSpecifies the security co-ordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:

This UDF returns a pipelined table of type result_table_type, where each row contains the primary key and the detokenized value for the column. If the input data is null or empty, the output will NULL.

Example:

SELECT * FROM TABLE(
  pty.sel_varchar2_bulk(
    '<table_name>',
    '<input_column>',
    'id',
    'TE_A_S13_L1R2_Y',
    'WHERE status = ''ACTIVE''',
    0
  )
);

2.15 - Oracle Input Datatype to UDF Mapping

This section provides tables with the Oracle input data type to the appropriate UDF mapping. It also provides the data element information that must be considered when creating a policy.

CAUTION: Starting from version 10.0.0, the 3DES, CUSP 3DES, and HMAC-SHA1 protection methods have been deprecated based on NIST recommendations around weak ciphers. It is recommended to use the following protection methods instead of the deprecated methods:

Deprecated Protection MethodsRecommended Protection Methods
3DESAES-128 and AES-256
CUSP 3DESCUSP AES-128 and CUSP AES-256
HMAC-SHA1HMAC-SHA256

For assistance in switching to a different protection method, contact Protegrity.

CAUTION: Starting from version 10.0.0, the Date YYYY-MM-DD, Date DD/MM/YYYY, Date MM/DD/YYYY, Printable, Unicode, and Unicode Base64 tokenization types have been deprecated. It is recommended to use the following tokenization types instead of the deprecated tokenization types:

Deprecated Tokenization TypesRecommended Tokenization Types
Date YYYY-MM-DDDatetime (YYYY-MM-DD HH:MM:SS MMM)
Date DD/MM/YYYYDatetime (YYYY-MM-DD HH:MM:SS MMM)
Date MM/DD/YYYYDatetime (YYYY-MM-DD HH:MM:SS MMM)
PrintableUnicode Gen2
UnicodeUnicode Gen2
Unicode Base64Unicode Gen2

For assistance in switching to a different tokenization type, contact Protegrity.

Oracle UDF - InsertOracle UDF - UpdateOracle Input TypeOutput TypeData Element Type
pty.ins_encrypt_char/pty.ins_encryptpty.upd_encrypt_char/pty.upd_encryptCHARRAW3DES, AES-128, AES-256
pty.ins_encryptpty.upd_encryptCHARRAWCUSP 3DES, CUSP AES 128, CUSP AES 156
pty.ins_charpty.upd_charCHARCHARTOKENS-Numeric(0-9)
pty.ins_charpty.upd_charCHARCHARTOKENS-Alpha(a-z,A-Z)
pty.ins_charpty.upd_charCHARCHARTOKENS-Uppercase Alpha(A-Z)
pty.ins_charpty.upd_charCHARCHARTOKENS-Alpha(a-z,A-Z)
pty.ins_charpty.upd_charCHARCHARTOKENS-Alpha-Numeric (0-9,a-z,A-Z)
pty.ins_charpty.upd_charCHARCHARTOKENS-Uppercase Alpha-Numeric(0-9,A-Z)
pty.ins_charpty.upd_charCHARCHARTOKENS-Printable
pty.ins_charpty.upd_charCHARCHARTOKENS-Credit card(0-9)
pty.ins_charpty.upd_charCHARCHARTOKENS-Lower ASCII (lower part of ASCII table)
pty.ins_charpty.upd_charCHARCHARTOKENS-Email
pty.ins_varchar2pty.ins_varchar2VARCHAR2VARCHAR2No Encryption
pty.ins_encrypt_varchar2pty.upd_encrypt_varchar2VARCHAR2RAW3DES, AES-128, AES-256
pty.ins_encrypt_varchar2pty.upd_encrypt_varchar2VARCHAR2RAWCUSP 3DES, CUSP AES 128, CUSP AES 156
pty.ins_varchar2pty.upd_varchar2VARCHAR2VARCHAR2TOKENS-Numeric(0-9)
pty.ins_varchar2pty.upd_varchar2VARCHAR2VARCHAR2TOKENS-Alpha(a-z,A-Z)
pty.ins_varchar2pty.upd_varchar2VARCHAR2VARCHAR2TOKENS-Uppercase Alpha(A-Z)
pty.ins_varchar2pty.upd_varchar2VARCHAR2VARCHAR2TOKENS-Alpha(a-z,A-Z)
pty.ins_varchar2pty.upd_varchar2VARCHAR2VARCHAR2TOKENS-Alpha-Numeric (0-9,a-z,A-Z)
pty.ins_varchar2pty.upd_varchar2VARCHAR2VARCHAR2TOKENS-Uppercase Alpha-Numeric(0-9,A-Z)
pty.ins_varchar2pty.upd_varchar2VARCHAR2VARCHAR2TOKENS-Printable
pty.ins_varchar2pty.upd_varchar2VARCHAR2VARCHAR2TOKENS-Credit card(0-9)
pty.ins_varchar2pty.upd_varchar2VARCHAR2VARCHAR2TOKENS-Lower ASCII (lower part of ASCII table)
pty.ins_varchar2pty.upd_varchar2VARCHAR2VARCHAR2TOKENS-Email
pty.ins_datepty.upd_dateDATEDATENo Encryption
pty.ins_encrypt_datepty.upd_encrypt_dateDATERAWEncryption-AES-256
pty.ins_varchar2pty.upd_varchar2DATEDATETOKENS-Date(YYYY-MM-DD)
pty.ins_varchar2pty.upd_varchar2DATEDATETOKENS-Date(DD/MM/YYYY)
pty.ins_varchar2pty.upd_varchar2DATEDATETOKENS-Date(MM/DD/YYYY)
pty.ins_varchar2pty.upd_varchar2DATEDATETOKENS-Datetime(YYYY-MM-DD HH:MM:SS MMM)
pty.ins_integerpty.upd_integerINTEGERINTEGERNo Encryption
pty.ins_encrypt_integerpty.upd_encrypt_integerINTEGERRAWEncryption-AES-256
pty.ins_integerpty.upd_integerINTEGERINTEGERTOKENS-INTEGER
pty.ins_numberpty.upd_numberNUMBERNUMBERNo Encryption
pty.ins_encrypt_numberpty.upd_encrypt_numberNUMBERRAWEncryption-AES-256
pty.ins_numberpty.upd_numberNUMBERNUMBERTOKENS-Decimal (numeric with decimal point and sign)
pty.ins_realpty.upd_realREALREALNo Encryption
pty.ins_encrypt_realpty.upd_encrypt_realREALRAWEncryption-AES-256
pty.ins_floatpty.upd_floatFLOATFLOATNo Encryption
pty.ins_encrypt_floatpty.upd_encrypt_floatFLOATRAWEncryption-AES-256
pty.ins_rawpty.upd_rawRAWRAWNo Encryption
pty.ins_encrypt_rawpty.upd_encrypt_rawRAWRAWEncryption-AES-256
BINARYTokenization is not supported for BINARY for ORACLE
UNICODETokenization is not supported for UNICODE for ORACLE
Oracle UDF - InsertOracle UDF - SelectOracle Input TypeOutput TypeData Element Type
pty.ins_encrypt_clobpty.sel_decrypt_clobCLOBCLOB3DES, AES-128, AES-256

3 - MSSQL User Defined Functions and APIs

This section provides a detailed list of functions and extended stored procedures for general functions, and protection and unprotection of different data types.

Warning:
Ensure to use the supported data element only. While using an unsupported data element, the decryption will complete successfully without any error. However, this can result in data corruption.

Note:
In the case of MSSQL Database Protector, if a data element greater than 55 characters long is passed to the UDF, then the UDF terminates with the error message: Data element name too long.

3.1 - General Functions

pty_getVersion

This function returns the version of the installed protector.

Signature:

pty_getVersion()

Parameters:
None

Returns:
This UDF returns the version number as the NVARCHAR datatype.

Example:

DECLARE
@data NVARCHAR(64)
SELECT @data = <database_name>.dbo.pty_getVersion()
PRINT @data;

pty_whoAmI

This function returns the name of the logged in user.

Signature:

pty_whoAmI()

Parameters:
None

Returns:
This UDF returns the name of the user as the NVARCHAR datatype.

Example:

DECLARE
@data NVARCHAR
SELECT @data = <database_name>.dbo.pty_whoAmI()
PRINT @data

3.2 - Insert Procedures

These extended procedures are used while protecting data using Insert queries.

xp_pty_insert

This stored procedure protects the data using an encryption data element.

Signature:

xp_pty_insert(outputdata VARBINARY OUTPUT, data VARCHAR,dataelement VARCHAR, scid INT)

Parameters:

NameTypeDescription
outputdataVARBINARY(8000)Specifies the result of the protect operation.
dataVARCHAR(8000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns either of the following values as protected data in the output parameter

ValueCondition
0If the user has insert(protect) access
1If the user does not have access or for input error

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE 
@result INT,
 @outputdata VARBINARY(8000),
 @data VARCHAR(8000)
SET @data='232432423432'
EXEC @result= <database_name>.dbo.xp_pty_insert @outputdata output,@data, 'AES256', 0
IF @result = 0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata

In the Example, value=‘AES256’, is the name of the data element.

xp_pty_tpe_unicode_insert

This stored procedure protects the data using the FPE Unicode, and Unicode Gen2 data elements.

Note:
This UDF does not support masking.

Signature:

xp_pty_tpe_unicode_insert(outputdata NVARCHAR OUTPUT, data NVARCHAR, dataelement VARCHAR, scid INT)

Parameters:

NameTypeDescription
outputdataNVARCHAR(4000)Specifies the result of the protect operation.
dataNVARCHAR(4000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns either of the following values as protected data in the output parameter:

ValueCondition
0If the user has insert(protect) access.
1If the user does not have access or for input error.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example for Unicode Gen2:

DECLARE 
 @result INT,
 @outputdata NVARCHAR(4000),
 @data NVARCHAR(4000)
SET @data= N'¢€ÃÂÃÄÅÊËÌÃÃŽÃÃÑÒÓÃÃ'
EXEC @result= <database_name>.dbo.xp_pty_tpe_unicode_insert @outputdata output,@data, 
'TE_UG2_SLT13_L2R2_UTF16LE_Latin1_Supplement_ASTYES', 0
IF @result = 0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata

In the Example, value=‘TE_UG2_SLT13_L2R2_UTF16LE_Latin1_Supplement_ASTYES’, is the name of the data element.

Example for FPE Unicode:

DECLARE 
 @result INT,
 @outputdata NVARCHAR(4000),
 @data NVARCHAR(4000)
SET @data= N'232432423432'
EXEC @result= <database_name>.dbo.xp_pty_tpe_unicode_insert @outputdata output,@data, 
'fpe_unicode', 0
IF @result = 0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata

xp_pty_tpe_insert

This stored procedure protects the data using type-preserving data element, such as Tokens and No Encryption for access control.

Signature:

xp_pty_tpe_insert(outputdata VARCHAR OUTPUT, data VARCHAR, dataelement VARCHAR, scid INT)

Parameters:

NameTypeDescription
outputdataVARCHAR(8000)Specifies the result of the protect operation.
dataVARCHAR(8000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns either of the following values as protected data in the output parameter:

ValueCondition
0If the user has insert(protect) access.
1If the user does not have access or for input error.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE 
 @result INT,
 @outputdata VARCHAR(8000),
 @data VARCHAR(8000)
SET @data='How are you'
EXEC @result= <database_name>.dbo.xp_pty_tpe_insert @outputdata output,@data, 'TE_A_S13_L0R0_Y', 
0
IF @result = 0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata

xp_pty_tpe_int_insert

This stored procedure protects the integer data by using an integer-tokenization data element.

Signature:

xp_pty_tpe_int_insert(outputdata INT OUTPUT, data INT, dataelement VARCHAR, scid INT)

Note: This UDF does not support no-encryption integer-tokenization data element.

Parameters:

NameTypeDescription
outputdataINTSpecifies the result of the protect operation.
dataINTSpecifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns either of the following values as protected data in the output parameter:

ValueCondition
0If the user has insert(protect) access.
1If the user does not have access or for input error.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE 
 @result INT,
 @outputdata INT,
 @data INT
SET @data='1234'
EXEC @result= <database_name>.dbo.xp_pty_tpe_int_insert @outputdata output,@data, 'Integer', 0
IF @result=0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata

xp_pty_insert_hash

This stored procedure calculates the hash value of the input data using a HMAC_SHA256 data element.

Note: HMAC_SHA1 is deprecated. Protegrity recommends transitioning to HMAC_SHA256. Starting with v10.0.0, creating new data elements under HMAC_SHA1 is disabled. However, existing data elements under HMAC_SHA1 can be used.

Signature:

xp_pty_insert_hash(hash VARBINARY OUTPUT, data VARCHAR, dataelement VARCHAR, scid INT)

Parameters

NameTypeDescription
hashVARBINARY(8000)Specifies the protected Output data.
dataVARCHAR(8000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns either of the following values as a result of the hash operation:

ValueCondition
0If the user has hash operation access
1If the user does not have access or for input error. This UDF also returns the hash value as the VARBINARY(8000) datatype.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE 
 @result INT,
 @hash VARBINARY(8000),
 @data VARCHAR(8000)
SET @data='232432423432'
EXEC @result= <database_name>.dbo.xp_pty_insert_hash @hash output, @data, 'HMAC_SHA256', 0
IF @result=0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @hash

In the Example, value=‘HMAC_SHA256’, is the name of the data element.

3.3 - UPDATE Extended Stored Procedures

These stored procedures are used while protecting data using Update statements.

xp_pty_update

This stored procedure protects the data using an encryption data element.

Signature:

xp_pty_update(outputdata VARBINARY OUTPUT, data VARCHAR, dataelement VARCHAR, status CHAR, scid INT)

Parameters:

NameTypeDescription
outputdataVARBINARY(8000)Specifies the result of the protect operation.
dataVARCHAR(8000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.
statusCHAR(1)Specifies the status value set to ‘T’.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns either of the following values as protected data in the output parameter:

ValueCondition
0If the user has update access
1If the user does not have access or for input error

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE
 @result INT,
 @outputdata VARBINARY(8000),
 @data VARCHAR(8000)
SET @data = '232432423432'
EXEC @result = <database_name>.dbo.xp_pty_update @outputdata output, @data, 'AES256', 'T', 0
IF @result = 0
 PRINT 'OK'
ELSE
 PRINT 'ERROR'
PRINT @outputdata

In the Example, value=‘AES256’, is the name of the data element.

xp_pty_tpe_unicode_update

This stored procedure protects the data using the FPE Unicode data element only.

Note: This UDF does not support masking.

Signature:

xp_pty_tpe_unicode_update(outputdata NVARCHAR OUTPUT, data NVARCHAR, dataelement VARCHAR, status CHAR, scid INT)

Parameters:

NameTypeDescription
outputdataNVARCHAR(4000)Specifies the result of the protect operation.
dataNVARCHAR(4000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.
statusCHAR(1)Specifies the status value set to ‘T’.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns either of the following values as protected data in the output parameter:

ValueCondition
0If the user has update access
1If the user does not have access or for input error.
This UDF also returns the protected value as the NVARCHAR(4000) datatype.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE
 @result INT,
 @outputdata NVARCHAR(4000),
 @data NVARCHAR(4000)
SET @data = N'232432423432'
EXEC @result = <database_name>.dbo.xp_pty_tpe_unicode_update @outputdata output, @data, 
'fpe_unicode', 'T', 0
IF @result = 0
 PRINT 'OK'
ELSE
 PRINT 'ERROR'
 PRINT @outputdata

xp_pty_tpe_update

This stored procedure protects the data using type-preserving data element, such as Tokens and No Encryption, for access control.

Signature:

xp_pty_tpe_update(outputdata VARCHAR OUTPUT, data VARCHAR, dataelement VARCHAR, status CHAR, scid INT)

Parameters:

NameTypeDescription
outputdataVARCHAR(8000)Specifies the result of the protect operation.
dataVARCHAR(8000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.
statusCHAR(1)Specifies the status value set to ‘T’.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns either of the following values as protected data in the output parameter:

ValueCondition
0If the user has update access
1If the user does not have access or for input error.
This UDF also returns the protected value as the INT datatype.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE
 @result INT,
 @outputdata VARCHAR(8000),
 @data VARCHAR(8000)
SET @data = 'How are you'
EXEC @result = <database_name>.dbo.xp_pty_tpe_update @outputdata output, @data, 
'TE_A_S13_L0R0_Y', 'T', 0
IF @result = 0
 PRINT 'OK'
ELSE
 PRINT 'ERROR'
PRINT @outputdata

xp_pty_tpe_int_update

This stored procedure protects the input data (integer) using an integer-tokenization data element.

Signature:

xp_pty_tpe_int_update(outputdata INT OUTPUT, data INT, dataelement VARCHAR, scid INT)

Parameters:

NameTypeDescription
outputdataINTSpecifies the result of the protect operation.
dataINTSpecifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns either of the following values as protected data in the output parameter:

ValueCondition
0If the user has update access
1If the user does not have access or for input error

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE 
 @result INT,
 @outputdata INT,
 @data INT
SET @data ='1234'
EXEC @result= <database_name>.dbo.xp_pty_tpe_int_update @outputdata output, @data, 'Integer', 0
IF @result = 0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata

xp_pty_update_hash

This stored procedure calculates the hash value of the input data using a HMAC_SHA256 data element.

Note:
New data elements under HMAC_SHA1 cannot be created.
Existing data elements under HMAC_SHA1 remain supported and can continue to be used.

*HMAC_SHA1 is deprecated. We recommend transitioning to HMAC_SHA256, which continues to be supported.

Signature:

xp_pty_update_hash(hash VARBINARY OUTPUT, data VARCHAR, dataelement VARCHAR, scid INT)

Parameters:

NameTypeDescription
hashVARBINARY(8000)Specifies the result of the hash operation.
dataVARCHAR(8000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note: This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns either of the following values as a result of the hash operation:

ValueCondition
0If the user has hash operation access
1If the user does not have access or for input error.
This UDF also returns the hash value as the VARBINARY(8000) datatype.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE 
 @result INT,
 @hash VARBINARY(64),
 @data VARCHAR(64)
SET @data='232432423432'
EXEC @result= <database_name>.dbo.xp_pty_update_hash @hash output,@data, 'HMAC_SHA256', 0
IF @result=0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @hash

3.4 - Access Check Procedures

These functions check access permissions allowed to the user for protecting or unprotecting the data. Depending on the permitted access, a bit value 0 (zero) or 1 is returned.

xp_pty_select_check

This stored procedure determines whether the user has select (unprotect) access to the data element.

Signature:

xp_pty_select_check(dataelement VARCHAR)

Parameters:

NameTypeDescription
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns either of the following values:

ValueCondition
0If the user has select(unprotected) access
1If the user does not have access

Example:

DECLARE 
 @result BIT
SELECT @result = master.dbo.xp_pty_select_check ('AES256')
PRINT @result 

In the Example, value=‘AES256’, is the name of the data element.

xp_pty_update_check

This stored procedure determines whether the user has update access to the data element.

Signature:

xp_pty_update_check (dataelement VARCHAR)

Parameters:

NameTypeDescription
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns either of the following values:

ValueCondition
0If the user has update access
1If the user does not have access

Example:

DECLARE
 @result BIT
SELECT @result = master.dbo.xp_pty_update_check('AES256')
PRINT @result

In the Example, value=‘AES256’, is the name of the data element.

xp_pty_insert_check

This stored procedure determines whether the user has insert (protect) access to the data element.

Signature:

xp_pty_insert_check(dataelement VARCHAR)

Parameters:

NameTypeDescription
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns either of the following values:

ValueCondition
0If the user has insert(protected) access
1If the user does not have access

Example:

DECLARE
 @result BIT
SELECT @result = master.dbo.xp_pty_insert_check('AES256')
PRINT @result

In the Example, value=‘AES256’, is the name of the data element.

3.5 - Select Functions and Procedures

These functions and stored procedures unprotect the data and return the unprotected value.

pty_select

This function unprotects the data that is protected by an encryption data element.

Signature:

pty_select (data VARBINARY, dataelement VARCHAR, def VARCHAR, scid INT)

Parameters:

NameTypeDescription
dataVARBINARY(8000)Specifies the data to unprotect.
dataelementVARCHAR(64)Specifies the name of the the data element.
defVARCHAR(8000)Specifies the default value that is returned if user does not have the permission to unprotect.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotected value as the VARCHAR(8000) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE 
 @result INT,
 @outputdata VARBINARY(8000),
 @data VARCHAR(64)
SET @data='232432423432'
EXEC @result= <database_name>.dbo.xp_pty_insert @outputdata output,@data, 'AES256',0
IF @result=0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata
SELECT @data = <database_name>.dbo.pty_select (@outputdata, 'AES256',null,0)
PRINT @data 

In the Example, value=‘AES256’, is the name of the data element.

pty_selectunicode

This function unprotects the data that is protected by Unicode Gen2, and FPE Unicode data elements.

Note: This UDF does not support masking.

Signature:

pty_selectunicode (data NVARCHAR, dataelement VARCHAR, def INT, scid INT)

Parameters:

NameTypeDescription
dataNVARCHAR(4000)Specifies the data to unprotect.
dataelementVARCHAR(64)Specifies the name of the dataelement.
defINTSpecifies the default value that is returned if user does not have the permission to unprotect.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotect value as the NVARCHAR(4000) datatype. This UDF returns protected value, if the option is configured in policy and user does not have access to the data.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example for Unicode Gen2:

DECLARE 
 @result INT,
 @outputdata NVARCHAR(4000),
 @data NVARCHAR(4000)
SET @data= N'¢€ÃÂÃÄÅÊËÌÃÃŽÃÃÃ'Ã'ÓÃÃ'
EXEC @result= <database_name>.dbo.xp_pty_tpe_unicode_insert @outputdata output,@data,
'TE_UG2_SLT13_L2R2_UTF16LE_Latin1_Supplement_ASTYES',0
IF @result=0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata
SELECT @data = <database_name>.dbo.pty_selectunicode (@outputdata,
'TE_UG2_SLT13_L2R2_UTF16LE_Latin1_Supplement_ASTYES',null,0)
PRINT @data

Example for FPE Unicode:

DECLARE 
 @result INT,
 @outputdata NVARCHAR(4000),
 @data NVARCHAR(4000)
SET @data= N'232432423432'
EXEC @result= <database_name>.dbo.xp_pty_tpe_unicode_insert @outputdata output,@data, 
'fpe_unicode',0
IF @result=0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata
SELECT @data = <database_name>.dbo.pty_selectunicode (@outputdata, 'fpe_unicode',null,0)
PRINT @data

pty_select2

This function unprotects the data that is protected by a type-preserving data element, such as, Tokens and No Encryption, for access control.

Signature:

pty_select2(data VARCHAR, dataelement VARCHAR, def VARCHAR, scid INT)

Parameters:

NameTypeDescription
dataVARCHAR(8000)Specifies the data to unprotect.
dataelementVARCHAR(64)Specifies the name of the data element.
defVARCHAR(8000)Specifies the default value that is returned if user does not have the permission to unprotect.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotected value as the VARCHAR(8000) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE 
 @result INT,
 @outputdata VARCHAR64,
 @data VARCHAR64
SET @data='232432423432'
EXEC @result= <database_name>.dbo.xp_pty_tpe_insert @outputdata output,@data, 'TE_N_S16_L0R0_Y',0
IF @result=0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata
SELECT @data = <database_name>.dbo.pty_select2(@outputdata,'TE_N_S16_L0R0_Y',null,0)
PRINT @data

In the Example, value=‘TE_N_S16_L0R0_Y’, is the name of the data element.

pty_selectint

This function unprotects the data that is protected by an integer-tokenization data element.

Signature:

pty_selectint(data INT, dataelement VARCHAR, def INT, scid INT)

Parameters:

NameTypeDescription
dataINTSpecifies the data to unprotect.
dataelementVARCHAR(64)Specifies the name of the data element.
defINTSpecifies the default value that is returned if user does not have the permission to unprotect.
scidINTSpecifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotected value as the INT datatype. This UDF returns protected value, if the option is configured in policy and user does not have access to the data.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE 
 @result INT,
 @outputdata VARCHAR(64),
 @data INT
 SET @data= 2324
 EXEC @result= <database_name>.dbo.xp_pty_tpe_insert @outputdata output, @data,
'TE_INT_4', 0
 IF @result = 0
 PRINT 'OK'
 ELSE 
 PRINT 'ERROR'
 PRINT @outputdata
 SELECT @data = <database_name>.dbo.pty_selectint(@outputdata,'TE_INT_4',null,0)
 PRINT @data

In the Example, value=‘TE_INT_4’, is the name of the data element.

xp_pty_select

This function unprotects the data that is protected by an encryption data element. It can also be used when the Security Coordinate ID is not defined.

Signature:

xp_pty_select(data VARBINARY, dataelement VARCHAR, def VARCHAR)

Parameters:

NameTypeDescription
dataVARBINARY(8000)Specifies the data to unprotect.
dataelementVARCHAR(64)Specifies the name of the dataelement.
defVARCHAR(8000)Specifies the security coordinate ID. Set the value of the parameter to zero.
Note:
This parameter is no longer used and is retained for compatibility purposes only.

Returns:
This UDF returns the unprotected value as the VARBINARY(8000) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

DECLARE 
@result INT,
@outputdata VARCHAR(64) 
@data VARBINARY(8000),
SET data= '232432423432'
EXEC @result = <database_name>.dbo.xp_pty_insert @outputdata output,@data, 'AES256',0
IF @result=0
 PRINT 'OK'
ELSE 
 PRINT 'ERROR'
PRINT @outputdata
SELECT @data = <database_name>.dbo.xp_pty_select(@outputdata,'AES256',null)
PRINT @data

In the Example, value=‘AES256’, is the name of the data element.

3.6 - VARCHAR UDFs

This section provides a list of VARCHAR UDFs for both, protect and unprotect operations.

pty_varcharins

This UDF protects the VARCHAR data through Tokenization or the No Encryption method.

Signature:

pty_varcharins(data VARCHAR(8000), dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataVARCHAR(8000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.

Results:
This UDF returns the protected value as the VARCHAR(8000) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or security operation is configured in the policy, this UDF terminates with an appropriate error message when the user does not have the required access rights.

Example:

select <database_name>.dbo.pty_varcharins('Protegrity123','TE_AN_L0R0_Y');

In the Example, value=‘TE_AN_L0R0_Y’, is the name of the data element.

pty_varcharsel

This UDF unprotects the protected VARCHAR data through Tokenization or the No Encryption method.

Signature:

pty_varcharsel(data VARCHAR(8000), dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataVARCHAR(8000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the unprotected value as the VARCHAR(8000) datatype.
This UDF returns the protected value when the user does not have the required access rights in the policy.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or security operation is configured in the policy, this UDF terminates with an appropriate error message when the user does not have the required access rights.

Example:

select <database_name>.dbo.pty_varcharsel('m6g2ZC6qb0xSAY','TE_AN_L0R0_Y');

In the Example, value=‘TE_AN_L0R0_Y’, is the name of the data element.

pty_hash_varchar

This UDF protects the VARCHAR data and calculates the hash value.

Note: This function is irreversible, that is, the protected data cannot be unprotected.

Signature:

pty_hash_varchar(data VARCHAR(8000), dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataVARCHAR(8000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the hash value as the VARBINARY(8000) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or security operation is configured in the policy, this UDF terminates with an appropriate error message when the user does not have the required access rights.

Example:

select <database_name>.dbo.pty_hash_varchar('Protegrityl23','HMAC_SHA256');

In the Example, value=‘HMAC_SHA256’, is the name of the data element.

Note: New data elements under HMAC_SHA1 cannot be created. However, existing data elements under HMAC_SHA1 remain supported and can be used. HMAC_SHA1 is deprecated. Protegrity recommends transitioning to HMAC_SHA256.

pty_varcharenc

This UDF encrypts the VARCHAR data using the encryption data element.

Signature:

pty_varcharenc(data VARCHAR(8000), dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataVARCHAR(8000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the encrypted value as the VARBINARY(8000) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or security operation is configured in the policy, this UDF terminates with an appropriate error message when the user does not have the required access rights.

Example:

select <database_name>.dbo.pty_varcharenc('Protegrityl23','AES256');

In the Example, value=‘AES256’, is the name of the data element.

pty_varchardec

This UDF decrypts the encrypted data that was encrypted using the pty_varcharenc UDF.

Signature:

pty_varchardec(data VARBINARY(8000), dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataVARCHAR(8000)Specifies the data to unprotect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the clear or decrypted value as the VARCHAR(8000) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or security operation is configured in the policy, this UDF terminates with an appropriate error message when the user does not have the required access rights.

Example:

select 
<database_name>.dbo.pty_varchardec(<database_name>.dbo.pty_varcharenc('Protegrityl23','AES256'),'AES256');

In the Example, value=‘AES256’, is the name of the data element.

3.7 - NVARCHAR UDFs

This section provides a list of NVARCHAR UDFs for both, protect and unprotect operations.

pty_unicodevarcharins

This UDF protects the NVARCHAR data using the Unicode Gen2, and FPE data elements.

Note: This UDF does not support masking.

Signature:

pty_unicodevarcharins(data NVARCHAR(4000), dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataNVARCHAR(4000)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the protected value as the NVARCHAR(4000) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example for Unicode Gen2:

Note: Unicode Gen2 data elements support newly introduced SLT_X_1 tokenizer from Protection Methods Reference along with the existing SLT_1_3 tokenizer. For more information, refer to section Unicode Gen2 in the Protection Methods Reference

select <database_name>.dbo.pty_unicodevarcharins(N'¢€ÃÂÃÄÅÊËÌÃÃŽÃÃÑÒÓÃÃ','TE_UG2_SLT13_L2R2_UTF16LE_Latin1_Supplement_ASTYES');
select <database_name>.dbo.pty_unicodevarcharins(N'▒','TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE');

Example for Unicode FPE:

select <database_name>.dbo.pty_unicodevarcharins('Protegrityl23','FPE_Alpha_Numeric_ASCII_Minlen2_ID_CC_L0R0_ASTNE');

pty_unicodevarcharsel

This UDF unprotects the protected NVARCHAR data using the Unicode Gen2, and FPE data elements.

Note: This UDF does not support masking.

Signature:

pty_unicodevarcharsel (data NVARCHAR(4000), DataElement VARCHAR(64))

Parameters:

NameTypeDescription
dataNVARCHAR(4000)Specifies the data to unprotect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the unprotected value as the NVARCHAR(4000) datatype.
This UDF returns the protected value, if the option is configured in policy and the user does not have access to the data.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example for Unicode Gen2:

Note: Unicode Gen2 data elements supports newly introduced SLT_X_1 tokenizer from Protection Methods Reference along with existing SLT_1_3 tokenizer. For more information, refer to the section Unicode Gen2 in the Protection Methods Reference

select 
<database_name>.dbo.pty_unicodevarcharsel(<database_name>.dbo.pty_unicodevarcharins(N'¢€ÃÂÃÄÅ
ÊËÌÃÃŽÃÃÑÒÓÃÃ,'TE_UG2_SLT13_L2R2_UTF16LE_Latin1_Supplement_ASTYES'),'TE_UG2_SLT13_L2R2_UTF16LE_Latin1_Supplement_ASTYES');
select 
<database_name>.dbo.pty_unicodevarcharsel(<database_name>.dbo.pty_unicodevarcharins(N'▒',
'TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UTF16LE'),'TE_UG2_SLTX1_L2R2_N_IPA_Greek_Coptic_UT
F16LE');

Example for Unicode FPE:

select
<database_name>.dbo.pty_unicodevarcharsel('Protegrityl23','FPE_Alpha_Numeric_ASCII_Minlen2_ID_CC_L0R0_ASTNE');

3.8 - Integer UDFs

This section provides a list of Integer UDFs for both, protect and unprotect operations.

pty_integerins

This UDF protects the Integer data through the tokenization method.

Signature:

pty_integerins(data Integer, dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataIntegerSpecifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the protected value as the Integer datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

select <database_name>.dbo.pty_integerins(123456,'TE_INT_4');

pty_integersel

This UDF unprotects the protected Integer data through the tokenization method.

Signature:

pty_integersel(data Integer, dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataIntegerSpecifies the data to unprotect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the unprotected value as the Integer datatype.
This UDF returns the protected value, if the option is configured in policy and user does not have access to the data.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

select <database_name>.dbo.pty_integersel(<database_name>.dbo.pty_integerins(123456, 'TE_INT_4'),'TE_INT_4');

pty_integerenc

This UDF encrypts the Integer data using an encryption data element.

Signature:

pty_integerenc(data Integer, dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataIntegerSpecifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the encrypted value as the VARBINARY(8000) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

select <database_name>.dbo.pty_integerenc(1234,'AES256');

In the Example, value=‘AES256’, is the name of the data element.

pty_integerdec

This UDF decrypts the encrypted data that was encrypted using the pty_integerenc UDF.

Signature:

pty_integerdec(data VARBINARY(8000), dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataVARBINARY(8000)Specifies the data to unprotect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the clear or decrypted value as the INT datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

select <database_name>.dbo.pty_integerdec(<database_name>.dbo.pty_integerenc(1234,'AES256'),'AES256');

In the Example, value=‘AES256’, is the name of the data element.

3.9 - BLOB UDFs

This section provides a list of UDFs that can be used for both, encryption and decryption of the data stored as BLOB.

pty_blobenc

This function encrypts the data stored as VARBINARY(max) using any encryption data element.

Warning: This function supports encryption of data up to 1GB. However, exceeding this limit will result in memory issues.

Signature:

pty_blobenc(data VARBINARY(max), dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataVARBINARY (max*)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the encrypted value as the VARBINARY (max*) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Note: The max parameter specifies the maximum length of input and output data, which depends on the specified maximum storage limitation of the VARBINARY data type supported by the MSSQL database.

Exception:
If a data element or security operation is configured in the policy, this UDF terminates with an appropriate error message when the user does not have the required access rights.

Example:

select <database_name>.dbo.pty_blobenc(cast('Protegrity' as varbinary(max)),'AES256');

In the Example, value=‘AES256’, is the name of the data element.

pty_blobdec

This function decrypts the encrypted data stored as VARBINARY(max*) using any encryption data element.

Signature:

pty_blobdec(data VARBINARY(max), dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataVARBINARY (max*)Specifies the data to unprotect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the clear or decrypted value as the VARBINARY(max*) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Note: The max parameter specifies the maximum length of input and output data, which depends on the specified maximum storage limitation of the VARBINARY data type supported by the MSSQL database.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

select <database_name>.dbo.pty_blobdec(<database_name>.dbo.pty_blobenc(cast('Protegrity' as varbinary(max)),'AES256'),'AES256')

In the Example, value=‘AES256’, is the name of the data element.

3.10 - CLOB UDFs

This section provides a list of UDFs that can be used for both, encryption and decryption of the data stored in CLOB.

pty_clobenc

This function encrypts the data stored as VARCHAR(max*) using any encryption data element.

Warning: This function supports encryption of data up to 1GB. However, exceeding this limit will result in memory issues.

Signature:

pty_clobenc(data VARCHAR(max), dataelement VARCHAR(64))

Parameters:

NameTypeDescription
dataVARCHAR(max*)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the encrypted value as the VARBINARY (max*) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Note: The max parameter specifies the maximum length of input and output data, which depends on the specified maximum storage limitation of the VARBINARY data type supported by the MSSQL database.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

select <database_name>.dbo.pty_clobenc('Protegrity','AES256');

In the Example, value=‘AES256’, is the name of the data element.

pty_clobdec

This function decrypts the encrypted data stored as VARBINARY(max*) using any encryption data element.

Signature:

pty_clobdec(data VARBINARY(max), dataelement VARCHAR(64))

Parameters

NameTypeDescription
dataVARBINARY(max*)Specifies the data to protect.
dataelementVARCHAR(64)Specifies the name of the data element.

Returns:
This UDF returns the clear or decrypted value as the VARCHAR(max*) datatype.

Attention: If the user does not have access to the data in the policy, this UDF returns ‘NULL’.

Note: The max parameter specifies the maximum length of input and output data, which depends on the specified maximum storage limitation of the VARBINARY data type supported by the MSSQL database.

Exception:
If a data element or a security operation is configured in the policy and the user does not have access, then the function will terminate with an appropriate error message.

Example:

select <database_name>.dbo.pty_clobdec(dbo.pty_clobenc('Protegrity','AES256'),'AES256');

In the Example, value=‘AES256’, is the name of the data element.