2. Filtered Browsing Layer – is the extension to the authentication mechanism, enforcing each web page access to use valid credentials. This layer detects whether a user has a valid session, and therefore it will direct users to a login step if either session or credentials have been deemed invalid. This mechanism prevents unauthorized users who might have a bookmark or URL link from gaining direct browsing access to any parts of the system.

3. Roles – provide a dynamic grouping function of permissions associated with data manipulation or specific application level functions. Maintenance Connection has a rich support for user level role definition (defined in the application as access groups), giving managers a fine-grained capability to grant permission to specific features of the system to any users of the Maintenance Connection application. The manager can assign an access group to any individual, thus easily expanding or narrowing access rights as necessary. The built-in access groups can be used, or new ones can be created. Since this security layer is dynamic and real-time, changes to the details of a particular role will take effect immediately. Several functions of the Maintenance Connection application are controlled by means of access groups, therefore users who do not have the appropriate permissions, will not be even aware of the existence of certain features, since the tabs, icons, or buttons will not be present in their view of the application.

4. Process Filter – provides a workflow-based security framework, through which managers can enable and disable application level functions at any given step in the business process flow. For example, a manager may allow a user the ability to create a work order, but not approve, issue, or close it out.

5. Data Access Filter – layer enforces data access policies of the Maintenance Connection application. All data access requests pass through system filters and only allowable data sets are exposed and returned to the user.

6. Audit Trail Container – is the central repository of the history of all changes made by all users of the Maintenance Connection system. The audit log helps reconstruct with accuracy the changes made to any specific data item. The audit log contains the date, time, user who made the change, the value before the change, and the value after the change so that information related disputes can be corroborated.

7. Encryption – is the methodology by which information sent between a browser and web server is scrambled through various algorithms in order to prevent someone from eavesdropping (or sniffing) in the communication and potentially observing the transmitted information. Clearly this is a major issue for communication over public networks, since there is no control over who can see the information on the open net. To combat this issue, the Maintenance Connection architecture fully supports and utilizes the industry standard SSL (Secure Socket Layer) protocol.

Secure Socket Layer (SSL) is the software protocol used by both the browser and the web server to implement the highest possible security levels. The Maintenance Connection server requires that the user’s browser be configured to support both SSL2 and SSL3 protocols (in the security options of the web browser) so that it can encrypt communications with the web server and ensure that information between Maintenance Connection and the user cannot be read by outside parties.

Web servers that run secure sessions require browsers with a minimum of 40-bit encryption to generate session keys used to encrypt/decrypt transmissions between browser and server. Maintenance Connection uses 128-bit encryption whenever possible to ensure privacy. Encryption capabilities are built into most Internet browsers and can be enabled by users. The larger the number of bits contained in the session key used for encryption (40-128 bits), the more difficult (exponentially) it is for an unauthorized person to unscramble the transmission. The 40-bit encryption is known as international level or export-grade encryption. The stronger 128-bit encryption is referred to as U.S. and Canada-only level, or domestic-grade encryption. Until recently, no encryption requiring a key greater than 40-bit was permitted to be exported outside of the United States and Canada.

This restriction has now been partially lifted under certain trade conditions, but 40-bit encryption is still used by many companies doing business internationally.

The Maintenance Connection servers support connections from browsers that employ 40-bit, 56-bit and 128-bit encryption. The stronger 128-bit encryption method may impose performance degradation on less powerful PCs running the browser. Maintenance Connection continually evaluates commercial browsers to ensure that they meet strict security standards. For browser requirements for Maintenance Connection, refer to Maintenance Connection Minimum Requirements.

Maintenance Connection has implemented a rich security architecture to satisfy the most stringent needs of any organization and it is under management control how much or how little security is applied, and therefore, administration can selectively enable or disable the various security measures to tailor security constraints to the organization’s needs.