Data Transformation Techniques
Two basic methods are available for initially encrypting and rekeying files protected by CTE:
-
Copy/Restore — Using the operating system file copy utility, a protected host administrator can copy unprotected files into a location protected by a CTE GuardPoint with a standard production policy. Similarly, files already protected by CTE can be transformed (rekeyed) by copying them from their protected location to another location protected by a different encryption key. For details, see Copy and Restore Transformation Method.
-
The CTE dataxform utility — Every CTE Agent includes a utility program that can encrypt or transform protected files. The dataxform utility encrypts, rekeys, or decrypts data in place. For details, see The CTE dataxform Utility Transformation Method.
Both methods have advantages and limitations that make them suitable in different scenarios.
Notes
-
CTE can also be configured to protect data at the disk level. For data protected in this way, only the copy transformation technique is available for encryption.
-
Do not run more than one instance of dataxform (per file system) for performance reasons.
The table below summarizes the strengths and weaknesses of the two file set transformation methods.
| Issue | Copy Method | Dataxform method |
|---|---|---|
| Temporary storage required | Equal to size of file set. | Sufficient to hold a list of path names of files in file set. |
| Security | File data is unprotected while in copy utility’s buffers. | File data is never outside the CTE GuardPoint. |
| Initial encryption | Files can be copied directly from source directory to a CTE-protected directory. | Files must be in a protected location before transformation. |
| Operational impact | No access to files during transformation. Path names or operating procedures must be adjusted after transformation. | No access to files during transformation. No other impact on operating procedures. |
| Recoverability | Restart copy operation at, or prior to, point of failure. | Files undergoing transformation at point of failure must be discovered from dataxform logs and restored from backup. |
