Difference: APPXIODataEncryption (10 vs. 11)

Revision 112008-09-23 - SteveFrizzell

Line: 1 to 1
 
META TOPICPARENT name="APPX500Features"

APPXIO Data Encryption

Line: 42 to 42
 
  1. Make sure that no users are accessing the system  Do not attempt to change the system Encryption Passphrase while other users are accessing the system.
  2. Export all of the encrypted APPXIO data files in all APPX databases.  The Export utility on the Database Management menu should be used to export the encrypted APPXIO data files.
  3. Use the System Parameters maintenance process in System Administration to change the system Encryption Passphrase.  The Set/Change Passphrase screen includes a report that can be run to obtain a list of all FMS groups and files which have been encrypted.  Use this list to verify that you have exported all of the encrypted files.
Changed:
<
<
  1. Change all of the encryption keys that have been entered for individual files and for FMS groups.
  2. Import all of the APPXIO data files that you exported in step 2.  Be sure to specify the "Replace" option for the data import.
>
>
  1. Change all of the encryption keys that have been entered for individual files and for FMS groups in all databases.
  2. Import all of the APPXIO data files in all APPX databases that you exported in step 2.  Be sure to specify the "Replace" option for the data import.
 

Enter/Edit File Encryption Keys

Changed:
<
<		The encryption key for a specific file can be set or changed in Database Management.
>
>		The encryption key for a specific database instance of a file can be set or changed in Database Management.
 
Database Management --> File Specifications --> File Attributes

The same encryption key value can be entered for each file or each file can have its own unique encryption key.  An easy way to ensure that each file has a unique encryption key is to use the Random Key button to automatically generate a random key for the file.  If you choose to enter an encryption key, you should choose "strong" key values just as you would for a password.  This means that your key should not be a common name or word, should include a mixture of letters, numbers, and special characters, and should be more than a few characters in length.

Line: 65 to 65
 FMSGroupEncryptionKey.PNG

How to Create A New Encrypted File

Changed:
<
<		The following steps should be followed to encrypt a new file.
>
>		The following steps should be followed to encrypt a new APPXIO file.
 
  1. If APPXIO file encryption has not already been enabled on your system, first follow the steps for enabling APPXIO file encryption.
Changed:
<
<
  1. Add the file to the data dictionary in your APPX Application.
  2. Enter the appropriate encryption key in the file specifications for the file that you wish to encrypt or assign the file to an FMS group that has an encryption key.
  3. Create the file. 
>
>
  1. Add the new file definition to the data dictionary in your APPX Application.
  2. Enter the appropriate encryption key in the file specifications for each database instance of the file that you wish to encrypt or assign each database instance of the file to an FMS group for which you have entered an encryption key.
  3. Create each database instance of the file. 
 

How to Encrypt an Existing File 

Changed:
<
<		The following steps must be followed to encrypt an existing APPXIO file:
>
>		The following steps should be followed to encrypt an existing APPXIO file:
 
  1. If APPXIO file encryption has not already been enabled on your system, first follow the steps for enabling APPXIO file encryption.
  2. Export the file that is to be encrypted.  If the file has been created in more than one database, you must export each instance of the file that is to be encrypted.
Changed:
<
<
  1. Enter the appropriate encryption key in the file specifications for the file that you wish to encrypt or assign the file to an FMS group that has an encryption key.
  2. Import the file.  Be sure to specify the "Replace" option when importing the file.
>
>
  1. Enter the appropriate encryption key in the file specifications for each database instance of the file that you wish to encrypt or assign each database instance of the file to an FMS group that has an encryption key.
  2. Import the file in each database.  Be sure to specify the "Replace" option when importing each database instance the file.
 

How to Decrypt an Encrypted File

Added:
>
>
  1. Use the Export utility in Database Management to export the encrypted file that is to be decrypted.  If the encrypted file exists in more than one database, you must export each instance of the encrypted file that is to be decrypted.
  2. Remove the encryption key in the file specifications for each database instance of the file that you wish to decrypt.  If the file is assigned to a FMS group that has an encryption key, then you must remove the file from the FMS group or remove the encryption key from the FMS group.  If you need to remove the encryption key from an FMS group, make sure that you exported all of the files that are assigned to the FMS group in step 1 above.
  3. Import each database instance of the file.  Be sure to specify the "Replace" option when importing each database instance the file.
 

Sharing of Encrypted Files

Changed:
<
<		Encrypted files are secure.  If you copy them to another APPX system you will not be able to read them unless you use the same encryption keys that were used on the system that created the file and the same passphrase.
>
>		Encrypted files may be shared and successfully accessed by two or more APPX systems provided the following conditions are all satisfied:
  1. The system Encryption Passphrases are the same on all systems.
  2. The file encryption keys are the same on all systems.
  3. The systems are all registered to the same APPX customer.

If you have more than one APPX system and you do not want to be able to share encrypted files between the systems, then you should use different system Encryption Passphrases and different file encryption keys.

 

Recovery of Corrupted Encrypted Files

Encrypted files which have become corrupted may be recovered by using the "recover" option of the APPX Utility engine.  The recovery process for encrypted files is the same as the recovery process for non-encrypted files.  For additional information on the use of the recover option, you can run:

Line: 91 to 99
 You should keep a record of the system Encryption Passphrase and the Encryption Keys that have been entered in a secure location that can be accessed in the event that you need to reenter the information.  Once entered, the Encryption Passphrase and the Encryption Keys should not be needed again unless you find yourself in a situation where your System Administration files have become corrupted or lost and you cannot restore them from a backup.  You might also need this information to set up an additional APPX server that needs to be able to access encrypted data files that were created on another APPX server.  You will not be able to access your encrypted data files unless you are able to reenter the exact System Passphrase and the exact Encryption Keys that were used to create and process the encrypted data files.

In the unlikely event that you to find yourself in the situation where your encrypted files cannot be accessed because you are unable to correctly enter the necessary System Passphrase and Encryption Keys, you should contact APPX Software, Inc. for assistance with recovering the encrypted data.

Added:
>
>

Application Design Considerations

When an encrypted file is being opened, the APPX File Manager verifies that the system Encryption Passphrase and the encryption key that were used to create the file match the current system Encryption Passphrase and the current encryption key for the file.  If they do not match, the file open will fail.  The system File Status field is also set to "FI_CRYPT" indicating that the open failed because of an encryption mismatch.

 

Limitations:

  1. One-record APPXIO files cannot be encrypted.
  2. Fixed length consecutive APPXIO files cannot be encrypted.  Variable length consecutive APPXIO files may be encrypted.
Changed:
<
<

Issues:

  1. Need to verify that the encrypted passphase and the encrypted keys are being correctly stored in the file header.
  2. Default values can be corrupted in the encryption type field causing the engine to fail to encrypt the data.

Suggested Behavior:

>
>

Suggested Enhancements:

 
  1. If data is encrypted, a warning should be presented to the user prior to generating a new encryption key, or changing the System Parameter Pass Phrase. This could help prevent unintended data loss.
  2. When importing data into an newly encrypted state, we should either delete the PORTDATA or warn the user that the PORTDATA is unencrypted.
  3. When exported from an encrypted state to an unencrypted state, we should warn the user that the exported data is unencrypted.
Deleted:
<
<
  1. System Parameter Passphrase contents should not be displayed. Use asterisk instead.
 

Comments:

Read what other users have said about this page or add your own comments.
View topic | History: r13 < r12 < r11 < r10 | More topic actions...
 
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 2008-2024 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback