If you do not want to use SSL/TLS but still want to encrypt data between Export and Import, you might do so using this feature.
SharePlex can be configured to encrypt replicated data across the network. SharePlex uses Advanced Encryption Standard (AES) encryption.
Encryption guidelines
Encryption must be enabled on the source and target systems. You enable encryption and set the size of the key through the Export process. You configure the Import process to ensure that encryption is enabled on the source, so that no data is sent across the network unless it is encrypted.
When configuring encryption, follow these guidelines:
- Use one encryption key for all Export processes in the SharePlex instance.
- To use encryption, SharePlex must be version 9.1 or later.
Encryption procedure
On the source system:
-
Set the Export parameter SP_XPT_ENABLE_AES to 1. This enables encryption.
sp_ctrl> set param sp_xpt_enable_aes 1
-
Run the create encryption key command to create the key.
sp_ctrl> create encryption key
The following is an example key:
E5F5D4CBA329D2C86B5D7ABA096C18600595490129F55A1422AAB0248B28D0E4 -
(Optional) Set the SP_XPT_AES_KEY_LENGTH parameter to increase the key size.
The create encryption key command returns a randomly generated, 256-bit AES key. By default, SharePlex uses 128 bits of that length to encrypt the data.
To increase the key length that SharePlex uses, set the SP_XPT_AES_KEY_LENGTH parameter to 192 or 256 bits. When you increase the length, the key is harder to hack but requires more CPU power.
sp_ctrl> set param sp_xpt_aes_key_length {192 | 256}
Example: set param sp_xpt_aes_key_length 256
-
Run the set encryption key command. This adds the key to the Export configuration.
sp_ctrl> set encryption key key_value
Example: set encryption key E5F5D4CBA329D2C86B5D7ABA096C18600595490129F55A1422AAB0248B28D0E4
-
Restart Export to activate the settings.
sp_ctrl> stop export
sp_ctrl> start export
On the target system:
-
Set the SP_IMP_ENABLE_AES parameter to 1. This prevents SharePlex on the target from accepting data that is not encrypted.
-
Run the set encryption key command with the same key value that you set for Export. The key values on the source and target must match.
sp_ctrl>set encryption key key_value
Example: set encryption key E5F5D4CBA329D2C86B5D7ABA096C18600595490129F55A1422AAB0248B28D0E4
-
Restart Import to activate the settings.
sp_ctrl> stop import
sp_ctrl> start import
View the encryption key
Issue this command on the source and target systems to ensure that both key values match.
sp_ctrl> show encryption key