Data Transformation Engine Intelligent Business Integration Reference Guide

Intelligent Business Integration Reference Guide

Chapter 7 - Securing HTTP

Communications

The two main requirements of a secure environment are the Secure Socket Layer

(SSL) protocol and digital certificates. To activate the SSL capabilities within your

Web server, all you need to do is install a digital certificate on your server. An SSL

server secures an HTTP session by encrypting the information exchanged between

a client and the server.

What is SSL?

SSL is a protocol developed by Netscape Communications Corporation for ensuring

security and privacy in Internet communications by implementing public-key

encryption of data. Because this technology is already incorporated into most Web

servers (such as Microsoft Internet Information Server (IIS) and IBM WebSphere)

and commonly used browsers (such as Internet Explorer and Netscape), they are

ready for SSL implementation.

Note Mercator products support the Privacy Enhanced Mail (PEM) format for digital

certificates and private keys as the Internet standard used for encryption

techniques to ensure the privacy and security of messages.

Encryption

A key system is used to safeguard data sent through the Internet. The sender of a

message encrypts it with a key and in order to read this message, the receiver

must decrypt it with another key. Public and private keys are used together to

encrypt a message. Public keys and corresponding private keys are generated

using encryption software installed on the server hosting the HTTPS URL you are

connecting to. Once a session is initiated between both machines, the server

sends a public key. The public key is given to everyone and therefore, can also be

seen by everyone. When a message is sent to the server, the message is

encrypted with the public key. A private key, installed on the server, is used to

decrypt the message received by the server. And because nobody else has access

to this private key, privacy is ensured and the identity of the sender is

authenticated.