Using Network Encryption

IBM Informix Dynamic Server, Version 9.4 and later, enables encryption of data transmitted over a network using an encryption communication support module. IBM Informix JDBC Driver, Version 2.21.JC5 and later, makes this feature available to all JDBC clients by adding a communication support module (CSM) to the JDBC driver.

IBM Informix JDBC encryption module is com.informix.jdbc.Crypto class that is packaged in the IBM Informix JDBC .jar file. IBM Informix JDBC encryption CSM is a pure Java implementation that uses services from the Java Cryptography provider. For information about the Java Cryptography provider, see the Sun Microsystems web site.

Network Encryption Syntax

To configure network encryption, set the CSM environment variable. The following illustrates the syntax of the CSM environment variable and encryption options:

CSM Environment Variable Syntax
 
>>-CSM=("CLASSNAME=com.informix.jdbc.Crypto"-+-----------------------------+-)-><
                                             '-,--+-option tags----------+-'
                                                  '-config=parameterfile-'
 

IBM Informix JDBC encryption CSM has been tested with the Sun Java Cryptography provider.

Using Option Tags

The option tags that can be passed on to the encryption CSM are the same as the encryption option tags that are specified in the CSM configuration file used by the server or CSDK. There are three option tags: cipher, mac, and switch.

• The cipher tag defines all ciphers that can be used by the session.
• The mac option defines the message authentication code (MAC) key files to be used during the MAC generation and the level of MAC generation utilized.
• The switch tag defines the frequency at which ciphers or secret keys are renegotiated. The longer the secret key and encryption cipher remain in use, the more likely that the encryption rules might be broken by an attacker. To avoid this, cryptologists recommend periodically changing the secret key and cipher on long-term connections. The default for this renegotiation is once an hour. By using the switch tag, you can set the time for this renegotiation in minutes.

For the syntax of these tags, see the Security chapter of the IBM Informix: Administrator's Guide.

Note that encryption CSM option parameters are separated by a comma and not by a semicolon. When using a DataSource, getIfxCSM() and setIfxCSM() methods can be used to get and set CSM as a property. When setting CSM as a property, make sure that you do not enclose the option string in parentheses. The following is an example that correctly sets the CSM as a property:

connProperties.put("CSM","classname=com.informix.jdbc.Crypto,cipher[all],
mac[<builtin>]");

Using Option Parameters

You can configure encryption by creating a file with encryption parameters and then specifying the filename. The encryption parameters are:

• ENCCSM_CIPHERS: Ciphers to be used
• ENCCSM_MAC: MAC level
• ENCCSM_MACFILES: MAC file location
• ENCCSM_SWITCH: CIPHER and KEY change frequency, separated by a comma

For the syntax of these parameters, see the Security chapter of the IBM Informix: Administrator's Guide.

The following is an example that specifies the CSM parameters in a configuration file:

  String newUrl = "jdbc:informix-sqli:
//beacon:8779/test:INFORMIXSERVER=danon950_beacon_encrypt;
user=rdtest;password=test;
csm=(classname=com.informix.jdbc.Crypto,config=test.cfg)";
        try
        {
            Class.forName( "com.informix.jdbc.IfxDriver" );
        }catch( Exception e )
        {
            System.out.println( "ERROR: failed to load
Informix JDBC driver." );
        }
        try
        {
            Connection con = DriverManager.getConnection( newUrl );
        }
        catch( SQLException e )
        {
            System.out.println( "ERROR: failed to connect." );
            e.printStackTrace();
            return;
        }

Configuring the Encryption CSM in the Server

To be able to connect to IBM Informix database servers on an encrypted port, the JDBC client must use JDBC encryption CSM. Also note that when using JDBC encryption CSM, attempts to connect to IBM Informix database servers on a non-encrypted port will fail. An instance of IBM Informix Database server may be configured to listen in on encrypted and non-encrypted ports at the same time. For details regarding configuring Dynamic Server to use encryption CSM, see IBM Informix: Dynamic Server Administrator's Guide.