7. Encryption – is the methodology by which information sent between a browser and web server is scrambled through various algorithms in order to prevent someone from eavesdropping (or sniffing) in the communication and potentially observing the transmitted information. Clearly this is a major issue for communication over public networks, since there is no control over who can see the information on the open net. To combat this issue, the Maintenance Connection architecture fully supports and utilizes the industry standard SSL (Secure Socket Layer) protocol.
Secure Socket Layer (SSL) is the software protocol used by both the browser and the web server to implement the highest possible security levels. The Maintenance Connection server requires that the user’s browser be configured to support both SSL2 and SSL3 protocols (in the security options of the web browser) so that it can encrypt communications with the web server and ensure that information between Maintenance Connection and the user cannot be read by outside parties.
Web servers that run secure sessions require browsers with a minimum of 40-bit encryption to generate session keys used to encrypt/decrypt transmissions between browser and server. Maintenance Connection uses 128-bit encryption whenever possible to ensure privacy. Encryption capabilities are built into most Internet browsers and can be enabled by users. The larger the number of bits contained in the session key used for encryption (40-128 bits), the more difficult (exponentially) it is for an unauthorized person to unscramble the transmission. The 40-bit encryption is known as international level or export-grade encryption. The stronger 128-bit encryption is referred to as U.S. and Canada-only level, or domestic-grade encryption. Until recently, no encryption requiring a key greater than 40-bit was permitted to be exported outside of the United States and Canada.
This restriction has now been partially lifted under certain trade conditions, but 40-bit encryption is still used by many companies doing business internationally.
The Maintenance Connection servers support connections from browsers that employ 40-bit, 56-bit and 128-bit encryption. The stronger 128-bit encryption method may impose performance degradation on less powerful PCs running the browser. Maintenance Connection continually evaluates commercial browsers to ensure that they meet strict security standards. For browser requirements for Maintenance Connection, refer to Maintenance Connection Minimum Requirements.
Maintenance Connection has implemented a rich security architecture to satisfy the most stringent needs of any organization and it is under management control how much or how little security is applied, and therefore, administration can selectively enable or disable the various security measures to tailor security constraints to the organization’s needs.