The Data Transformation Process

Data transformation is used for:

• Initial data transformation — The first time you create a GuardPoint with existing data, you can tell CTE to encrypt the existing data. This means that the clear-text data in the GuardPoint becomes encrypted as ciphertext. Any new data you add to the GuardPoint is also encrypted immediately based on the policy applied to the GuardPoint.

• Rekeying — If you have already encrypted the data in a GuardPoint, you can increase the security of that data by periodically changing the encryption key used to encrypt it. This process is called rekeying.

• Reverse transformation — Decrypting GuardPoint data from cipher-text to clear-text. (Not a common procedure.)

In addition to being disruptive to data center operations, data transformation is complex. It is strongly recommended that you read and understand this section before proceeding to the initial data transformation and rekey sections.

How CipherTrust Protects Files

The CipherTrust Transparent Encryption Agent (CTE Agent) encrypts the data within a file one block at a time. It does not encrypt file metadata such a file’s name or size, thus enabling administrators to manage files without being able to view or modify their contents. Whether initially encrypting files, rekeying them, or decrypting them, the CTE Agent must therefore:

• Read each block of file data to be transformed.

• Transform the block by encrypting, decrypting, or rekeying it.

• Write the transformed block, either to its original location, or to an alternate one.