User guide

Installation & Setup User Guide
revision 143 — 299
Appendix N: Encryption
Encryption Overview
Encryption is the translation of data into secret code. The purpose of encryption
is to achieve data security. Data sent to and from the B.A.S.I.S. database can be
encrypted using either of two methods:
• Windows Internet Protocol Security (IPSec), a part of Microsoft Windows
2000 Server/Professional
• IRE SafeNet/Speed
Windows 2000 IP Security is based on IPSec (Internet Protocol Security), a set of
protocols being developed by the IETF (Internet Engineering Task Force) to
support application-transparent exchange of packets at the IP layer. IPSec
supports two encryption modes: transport and tunnel. Using IPSec transport
mode, end-to-end security from client-to-server, server-to-server, and client-to-
client can be accomplished. Using L2TP (Layer Two Tunneling Protocol)
secured by IPSec, secure remote access from client-to-gateway over the Internet
can be accomplished. Refer to the IPSec end-to-end walkthrough document in the
Windows 2000 Resource Kit to set up Windows 2000 IP Security for use with
the B.A.S.I.S. system.
IRE SafeNet/Speed is a hardware device that encrypts data passing from one
network to another. SafeNet/Speed automatically encrypts user data with the
Triple-Data Encryption Standard (Triple-DES) for public key encryption.
The encryption that occurs with the B.A.S.I.S. system can be broken down into
two main segments: peer-to-peer and peer-to-panel. Peer-to-peer encryption
occurs between the workstation that is within the secured area and the server that
is outside the secured area. Peer-to-panel encryption occurs between the
workstation within the secured area and the panel via the IRE SafeNet/Speed
box.
A key is a number or set of characters that an algorithm uses to encrypt or decrypt
data. The peer-to-peer and peer-to-panel encryption segments use different keys.
In this document, the key that peer-to-panel encryption uses is referred to as key
A, and the key that peer-to-peer encryption uses is referred to as key B. Key A is
only used within the secured area, while key B is used when encrypted data is
sent between the workstation in the secured area and the server that is outside the
secured area.