Overview
This document describes the installation and advanced configuration options for CTE for AIX, as well as detailed information about how to integrate CTE with Oracle.
CTE Terminology
The CTE documentation set uses the following terminology:
| Term | Description |
|---|---|
| CTE | CipherTrust Transparent Encryption is a suite of products that allow you to encrypt and guard your data. The main software component of CTE is the CTE Agent, which must be installed on every host whose devices you want to protect. Notes: • This suite was originally called Vormetric Transparent Encryption (VTE), and some of the names in the suite still use "Vormetric". • For example, the default installation directory is /opt/vormetric/DataSecurityExpert/agent/. • For example, the default installation directory is /opt/vormetric/DataSecurityExpert/agent/ for Linux and AIX, and C:\Program Files\Vormetric\DataSecurityExpert\agent\ for Windows. |
| CTE Agent | The software that you install on a physical or virtual machine in order to encrypt and protect the data on that machine. After you have installed the CTE Agent on the machine, you can use CTE to protect any number of devices or directories on that machine. |
| key manager | An appliance that stores and manages data encryption keys, data access policies, administrative domains, and administrator profiles. |
| host / client | In this documentation, host and client are used interchangeably to refer to the physical or virtual machine on which the CTE Agent is installed. |
| GuardPoint | A device or directory to which a CTE data protection and encryption policy has been applied. CTE will control access to, and monitor changes in, this device and directory, encrypting new or changed information as needed. |
CTE Components
The CTE solution consists of two parts:
-
The CTE Agent software that resides on each protected virtual or physical machine (host). The CTE Agent performs the required data encryption and enforces the access policies sent to it by the key manager. The communication between the CTE Agent and the key manager is encrypted and secure.
After the CTE Agent has encrypted a device on a host, that device is called a GuardPoint. You can use CTE to create GuardPoints on servers on-site, in the cloud, or a hybrid of both.
-
A key manager that stores and manages data encryption keys, data access policies, administrative domains, and administrator profiles. After you install the CTE Agent on a host and register it with a key manager, you can use the key manager to specify which devices on the host that you want to protect, what encryption keys are used to protect those devices, and what access policies are enforced on those devices.
For a list of CTE versions and supported operating systems, see the CTE Compatibility Portal.
CTE Compliance with AIX Lock Semantics
CTE is compliant with AIX lock semantics. In the following cases, CTE deviates from AIX lock semantics:
-
For a guarded file, an
fclear(2)system call will block if the current process file location and specified fclear number of bytes overlaps an existing file lock. -
For a non-guarded file, the
fclear(2)system call blocks only if the fclear number of bytes falls within the range limits of a specified file lock.
How to Protect Data with CTE
CTE uses policies created in the associated key manager to protect data. You can create policies to specify file encryption, data access, and auditing on specific directories and drives on your protected hosts. Each GuardPoint must have one and only one associated policy, but each policy can be associated with any number of GuardPoints.
Policies specify:
-
Whether or not the resting files are encrypted.
-
Who can access decrypted files and when.
-
What level of file access auditing is applied when generating fine-grained audit trails.
A Security Administrator accesses the key manager through a web browser. You must have administrator privileges to create policies using either key manager. The CTE Agent then implements the policies once they are pushed to the protected host.
CTE can only enforce security and key selection rules on files inside a guarded directory. If a GuardPoint is disabled, access to data in the directory goes undetected and ungoverned. Disabling a GuardPoint and then allowing unrestricted access to that GuardPoint can result in data corruption.
