IndexCase 03 / 06 — Database encryption migration2026
No. 03Dah Sing Bank2026

ORACLE MIGRATION

The old encryption module, from Oracle 9 to 21

Database encryption migration2026 — case study
Client
Dah Sing Bank
Year
2026
Role
Fintech intern
Stack
Oracle 9 → 21 · Encryption · PL/SQL · Sync scripts

The brief

The bank ran an old encryption module on Oracle 9, and the target was Oracle 21. The migration had to move the module — its encrypted columns, keys and legacy calls — without a duplicate environment to fall back on.

There was no backup machine and no parallel stack. The resources allowed a controlled downtime window, and the plan had to make that window safe: back the data up first, then move, and be ready to restore if production broke.

The approach

I integrated the Oracle Database Encryption module across the move and worked through the legacy PL/SQL written more than 25 years ago — reading the old functions, preserving their behaviour and carrying them onto Oracle 21.

The synchronization script was the safety net, not an A/B cutover: it copied and verified the data before the window so the system could fall back flawlessly if the migration went wrong in production. The constraints were the resources the bank gave us — one environment, a downtime window, and a script that had to be right.

The outcome

The encryption module moved from Oracle 9 to 21 inside the downtime window, with the synchronization backup ready as the fallback.

Bank transaction processing speed improved by 50%, and the 25-year-old PL/SQL kept behaving after the move.

The migration

The database was Oracle 9; the target, Oracle 21. The job was the bank's old encryption module — the encrypted columns, the keys, and the legacy calls that read them — not the OpenAPI service.

There was no backup machine, so the plan was a controlled downtime window. The synchronization script backed up the data first and kept the fallback ready: if the migration failed in production, the system could be restored without a second environment.

The synchronization script was not an A/B cutover. It existed for fallback: copy the data, verify it, and be ready to put it back. That was the safest plan the bank's resources allowed.

I integrated the Oracle Database Encryption module across the move and maintained the PL/SQL written more than 25 years ago, preserving its behaviour on Oracle 21.

BEFOREDOWNTIME WINDOWAFTERORACLE 9OLD ENCRYPTION MODULEPL/SQL · 25+ YEARSENCRYPTED COLUMNSNO BACKUP MACHINELEGACY SCHEMAENCRYPTION MODULECOLUMNS · KEYS · LEGACY CALLSSYNC SCRIPTDATA BACKUPCOPY · VERIFY · RESTOREFALLBACKORACLE 21ENCRYPTION MODULELIVE SCHEMAENCRYPTMIGRATEFALLBACK READY
No backup machine meant a controlled downtime window; the sync script backed the data up so production could fall back cleanly. It was not an A/B cutover.
RELATIVE TRANSACTION PROCESSING TIMEBEFORE100AFTER5050% FASTERINDEXED TO 100 · SOURCE: CV
Transaction processing time before and after the migration, indexed to 100. The CV records a 50% improvement.
PL/SQL WRITTEN25+ YEARSMIGRATION12 MONTHS19992026LEGACY PL/SQLJUL 2025 — JUN 2026
The PL/SQL was written more than 25 years before the migration; the migration itself ran for 12 months.
AUDITENCRYPTBACKUPDOWNTIMEMIGRATEVERIFYSYNC SCRIPT = FALLBACKCONTROLLED DOWNTIMERESTORE IF IT FAILS
Six phases; the sync script as the fallback, a controlled downtime window, and a restore path — the plan the bank's resources allowed.
A controlled migration of the bank's old encryption module: no backup machine, a downtime window, and a synchronization script that backed the data up so production could fall back cleanly.
Team
Dah Sing Bank engineering
Duration
Jul 2025 — Jun 2026
Contribution
Encryption module, sync scripts, PL/SQL