migration.rb

class AddSecurityStringToOrder < ActiveRecord::Migration
  def self.up
    add_column :orders, :security_string, :string
  end

  def self.down
    remove_column :orders, :security_string
  end
end

order.rb

...

before_create :set_security_string

def set_security_string
  self.security_string = Digest::SHA1.hexdigest("#{Time.now}#{rand.to_s}")[0..15]
end

def to_param
  security_string
end

...