Content Manager OnDemand Native Encryption

Jump to navigation Jump to search

CMOD Encryption Introduction

IBM's Content Manager OnDemand protects confidential data several different ways - this article will cover the types of encryption supported by CMOD.

To ensure that your data is kept secure, you need to encrypt data that is "at-rest" on the server, and "in-transit" across the networks as it's being loaded or accessed.

First, some definitions:

What is data 'at rest' in CMOD?
Data that is stored on the server itself, either in short-term, high-performance OnDemand Cache Filesystems, or slow long-term storage.
Encryption at this level prevents server administrators from accessing data directly from the filesystems, and unauthorized third-parties by gaining access to storage media.
Data is encrypted with an encryption key that is located on the server in a standard key database ("keydb"), which is itself protected by a 'stash file'. The keydb and stash file are protected from access by restrictive operating-system level file-access permissions. They can be further protected by implimenting encryption at the operating system or virtual machine level.
What is data 'in transit' in CMOD?
Any data communications with the server over a network is considered to be 'in transit' or 'across the wire'.
Properly configured CMOD SSL encryption protects all communications between all Content Manager OnDemand clients and the server.
CMOD Utilities like arsload and arsdoc can also be configured to use SSL communications exclusively, protecting data as it is ingested or retrieved from CMOD.
Custom line of business applications can be built to use CMOD's SSL support as well.

OnDemand Native Encryption

OnDemand protects data "at-rest" by encrypting it with AES-256-CBC at load time, and before it's written to the CMOD Cache Filesystem, or secondary storage like Tivoli Storage Manager / Spectrum Protect or cloud-based storage services.

Encryption is transparent to all clients accessing CMOD servers - when a retrieval request is received from a client, the server accessed the encrypted file on disk, then decrypts it with the data encryption key, and optionally compresses it in anticipation of being sent back to the user. At that point, if the client connection to the CMOD server is not encrypted, the data is vulnerable to interception or alteration. However, if Content Manager OnDemand SSL support is configured, then the documents are protected by the SSL session key, and cannot be read or changed by a third party.

CMOD SSL Encryption

OnDemand protects communications (logins, search, retrieval, loads, etc.) with industry-standard SSL certificates. This not only allows for strong authentication, but also strong encryption.

Authentication vs. Encryption

Authentication means that you have verifiable proof that who you're connecting to is who you think they are. CMOD authenticates connections to servers with SSL certificates, the same way that banking and online shopping websites do. Server names are verified and validated through SSL certificates.

Encryption means that your connection is protected both from someone being able to intercept the 'clear text' data being exchanged, and from modifying it while it's moving across the network.

Enabling Content Manager OnDemand SSL encryption does both.