Home
Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
Security in HCL Informix®
The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
Securing data
Network data encryption
Use network encryption to encrypt data transmitted between server and client, and between server and other server.
Communication support modules for data transmission encryption
You can use the communication support modules (CSMs) to encrypt data transmissions, including distributed queries, over the network.
Generating a new MAC key file
You can generate a new MAC key file to improve the reliability of message verification using encryption.

Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
- Security in HCL Informix®
  The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
  - Securing data
    - HCL Informix® directory security
      utilities and product directories are secure by default.
    - Network data encryption
      Use network encryption to encrypt data transmitted between server and client, and between server and other server.
      - Communication support modules for data transmission encryption
        You can use the communication support modules (CSMs) to encrypt data transmissions, including distributed queries, over the network.
        Enabling encryption with communication support modules
        You must modify the concsm.cfg file to use encryption with communication support modules.
        CSM configuration file
        To use a communication support module (CSM), you must have a concsm.cfg file.
        Encryption ciphers and modes
        You must specify which ciphers and mode to use during encryption.
        MAC key files
        The MAC key files contain encryption keys that are used to encrypt messages.
        Generating a new MAC key file
        You can generate a new MAC key file to improve the reliability of message verification using encryption.
        MAC levels
        MAC levels determine the type of MAC key generation.
        Switch frequency
        The switch frequency defines when ciphers and or secret keys are renegotiated.
        Network data encryption syntax
        You must specify network encryption libraries and options in the concsm.cfg file.
      - Enterprise replication and high availability network data encryption
        You can configure network data encryption for Enterprise Replication and high availability clusters by using configuration parameters.
      - Background Knowledge on Keystores
        This topic offers some generic insights into keystores and how they are used for secure communications with the TLS (Transport Layer Security) protocol. While the first part provides the theoretical background, the second part shows examples for applying this in practice using OpenSSL.
    - Column-level encryption
      You can use column-level encryption to store sensitive data in an encrypted format. After encrypting sensitive data, such as credit card numbers, only users who can provide a secret password can decrypt the data.
    - Connection security
      You can administer the security of the connections to the database server by using authentication and authorization processes.
    - Discretionary access control
      Discretionary access control verifies whether the user who is attempting to perform an operation has been granted the required privileges to perform that operation.
    - Label-Based Access Control
      You can use label-based access control (LBAC), an implementation of multi-level security (MLS), to control who has read access and who has write access to individual rows and columns of data.
  - Auditing data security

Generating a new MAC key file

You can generate a new MAC key file to improve the reliability of message verification using encryption.

About this task

To generate a new MAC key file:

Procedure

Run the following command from the command line:
```
GenMacKey -o filename
```
The filename is the path and file name of the new MAC key file.
Update the central server's configuration to include the location of the new MAC key file in one of the following ways:
- Using encryption tags: Edit the relevant line in the concsm.cfg file to add a path and file name to the mac tag.
- Using encryption parameters: Edit the encryption parameters file to alter the value of the ENCCSM_MACFILES parameter.
If necessary, remove old MAC key file entries from the configuration.
Distribute the new MAC key file among all appropriate computers.