Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Obfuscating database ID to customer facing number

I'm using mysql database auto-increment as an order ID. When I display the order ID to the user, I want to somehow mask/obfuscate it.

Why?

  • So at first glance, it is obvious to admin users what the number refers to (orders start with 10, customers start with 20 etc)
  • To hide, at first glance, that this is only my 4th order.

Based on this this answer, I want the masked/obfuscated order id to:

  • Be only numbers
  • Consistent length (if possible)
  • Not cause collisions
  • Be reversible so I can decode it and get the original ID

How would I acheive this in PHP? It doesn't have to be very complex, just so at first glance it's not obvious.

like image 434
paul Avatar asked Nov 19 '13 12:11

paul


People also ask

What is ID obfuscation?

ID Obfuscator is a Java library for obfuscating numerical identifiers. Practically, that means taking a number like "17" and transforming it into a string like "GDJSHCX" (and, presumably, turning that string back into a number later).

What are the obfuscation techniques?

Obfuscation is an umbrella term for a variety of processes that transform data into another form in order to protect sensitive information or personal data. Three of the most common techniques used to obfuscate data are encryption, tokenization, and data masking.

What is an example of obfuscate?

To obfuscate is to confuse someone, or to obscure the meaning of something. An example of obfuscate is when a politician purposely gives vague answers to a question so no one knows his real position. To deliberately make more confusing in order to conceal the truth.

What is obfuscation in cyber security?

Obfuscation refers to the process of concealing something important, valuable, or critical. Cybercriminals use obfuscation to conceal information such as files to be downloaded, sites to be visited, etc.


1 Answers

I think you can use XOR operator to hide "at first glance" for example (MySQL example):

(id*121) ^ 2342323

Where 2342323 and 121 are "magic" numbers - templates for the order number. To reverse:

(OrderNum ^ 2342323)/121

Additional advantage in this case - you can validate OrderNumber (to avoid spam or something like this in online form) if (OrderNum ^ 2342323) is divided by 121 with no remainder.

SQLFiddle demo

like image 125
valex Avatar answered Oct 04 '22 00:10

valex