Home
Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
Security in HCL Informix®
The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
Securing data
Network data encryption
Use network encryption to encrypt data transmitted between server and client, and between server and other server.
Communication support modules for data transmission encryption
You can use the communication support modules (CSMs) to encrypt data transmissions, including distributed queries, over the network.
Enabling encryption with communication support modules
You must modify the concsm.cfg file to use encryption with communication support modules.

Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
- Security in HCL Informix®
  The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
  - Securing data
    - HCL Informix® directory security
      utilities and product directories are secure by default.
    - Network data encryption
      Use network encryption to encrypt data transmitted between server and client, and between server and other server.
      - Communication support modules for data transmission encryption
        You can use the communication support modules (CSMs) to encrypt data transmissions, including distributed queries, over the network.
        Enabling encryption with communication support modules
        You must modify the concsm.cfg file to use encryption with communication support modules.
        CSM configuration file
        To use a communication support module (CSM), you must have a concsm.cfg file.
        Encryption ciphers and modes
        You must specify which ciphers and mode to use during encryption.
        MAC key files
        The MAC key files contain encryption keys that are used to encrypt messages.
        Generating a new MAC key file
        You can generate a new MAC key file to improve the reliability of message verification using encryption.
        MAC levels
        MAC levels determine the type of MAC key generation.
        Switch frequency
        The switch frequency defines when ciphers and or secret keys are renegotiated.
        Network data encryption syntax
        You must specify network encryption libraries and options in the concsm.cfg file.
      - Enterprise replication and high availability network data encryption
        You can configure network data encryption for Enterprise Replication and high availability clusters by using configuration parameters.
      - Background Knowledge on Keystores
        This topic offers some generic insights into keystores and how they are used for secure communications with the TLS (Transport Layer Security) protocol. While the first part provides the theoretical background, the second part shows examples for applying this in practice using OpenSSL.
    - Column-level encryption
      You can use column-level encryption to store sensitive data in an encrypted format. After encrypting sensitive data, such as credit card numbers, only users who can provide a secret password can decrypt the data.
    - Connection security
      You can administer the security of the connections to the database server by using authentication and authorization processes.
    - Discretionary access control
      Discretionary access control verifies whether the user who is attempting to perform an operation has been granted the required privileges to perform that operation.
    - Label-Based Access Control
      You can use label-based access control (LBAC), an implementation of multi-level security (MLS), to control who has read access and who has write access to individual rows and columns of data.
  - Auditing data security

Enabling encryption with communication support modules

You must modify the concsm.cfg file to use encryption with communication support modules.

Before you begin

Verify that the module can use a port that is not shared with an unencrypted connection before you enable network encryption.

About this task

To enable network encryption:

Procedure

Add a line to the concsm.cfg file.
The concsm.cfg file must contain an entry for each communications support module (of the same kind) that you are using.
Add an entry to the options column of the sqlhosts information.
For details about specifying the CSM in the sqlhosts information, see the Informix® Administrator's Guide.