I have a web application with a lot of stored db data, some of which is encrypted. The data is encrypted with a surrogate key, which itself is encrypted with a hash of a user password.

Upon request by the user, they can request an export of a large amount of data. A request is added to a queue which is processed in sequential order with other people's requests. The request information is stored in the db. Each request is too big to do in one run, so they're broken into many smaller parts over time. A user's request may not commence for an hour depending on queue size, and could take up to 15 minutes to compile.

The problem is that I need to decrypt the encrypted fields and include in the output... So while I could ask the user for the password at the time of request, how can the system retain the password, or surrogate key for later use without recording it somewhere? It seems entirely unsafe to store the surrogate key in the db along with the request info (even just temporarily)... and storing it in a session won't work because the user's session is not what executes the compiling script...

Any brilliant ideas how this can be accomplished?


You must log in to answer this question.

Browse other questions tagged .