WebXpress^tm

SECURITY METHODOLOGIES

Security involves both data security and content access rights.

INDUSTRY STANDARD SECURITY/ENCRYPTION

HTTP:

Hyper Text Transfer Protocol. Handshake exchanges between web browser and web server. The current web communication standard.

S-HTTP:

Secure Hyper Text Transfer Protocol. Secure version of HTTP Protocol for communication over the Web. Allows for both encryption and digital authentication. Typically referenced as 128 bit encryption.

TCP/IP:

Transmission Control Protocol/Internet Protocol. Provides the ability to connect any computer on the Inter/Intranet to any other computer by routing packets from one system to another.

Digital Certificates:

A digital “ticket” allowing entrance. Also used to establish user workstation validation.

Page Encryption:

Scrambling and “coding” data to ensure un-read-ability.

SSL:

Secure Socket Layer. Provides encryption & digital authentication over the web. Similar to the S-Similar to the S-HTTP protocol, provides “round-trip”.

Firewall:

Hardware or software controlling access, and type of information that enters internal networks from the Internet, or vice versa. Also controls protocols and IP address ranges allowed to pass through its gates. Proxy Servers can also be set up to act as a firewall.

WEBXPRESS APPLICATION SPECIFIC

Easy Access Rights Setup and Administration:

Dynamically restrict Access based on pre-defined report view rights.

Interface Log-in, or existing Authorization/Authentication web screens.

Web “Query” Pages:

Based on access rights. Once access rights are defined, a Query scheme is presented to the user defining those search criteria that will restrict any given user to specific reports and or report content.

Document Code Key: (see fig #1)

A method for validating that the right document is matched to a remote Search Query Results list from which a user is requesting a specific document. Each document linked to one or more Search Query Results list carries a Document Code Key that match a Document Code Key that is hidden in each item shown on the Search Query Results list.

Content Permissing: (see fig #2, 3 & 4)

Permissioning is method to control access to all or a portion of the Document/Report content and is governed by and linked to a specific User Name login values. Permissions are essential to satisfy specific industry Regulatory Agency mandates concerning both “Access” and “Right-to-View” compliance.

Permissions are determined by one of more of the following:

1. Document/Report name or type

2. One or more index values

3. Data content contained in a data Document or Report

Permissioning is administered by the client and is another security element that is defined in conjunction with the User Name and Password values. Permissioning permits both “inclusive” and “exclusive” access control. Inclusive sets “Right-to-View” privileges while exclusive sets “No-Right-to-View privileges.

When permissions are determined to be a requirement, the document/report storage formats are architected to provide long term flexibility. When permissions are based on index database values it is important to carefully examine the index record structure and determine any conflicts that could exist if both document/report name/type and index content permissioning are used simultaneously.

Post Firewall Document Encryption (PDF): (see fig #5)

Requested documents in PDF format are encrypted with user security token dynamically prior to passing through the WebXpress server firewall. The recipient must enter the security token value before the document will open on the destination workstation. Security tokens can be reestablished dynamically depending on security volatility.

Figure #1

Document Code Key w/Document Warehousing

Figure #2

Sample Listing of Users

With

Document & Report Access Level Permissions

Figure #3

Edit a Existing User with Permissions

Figure #4

Add a New User

and

Select an Appropriate Permission Level

Figure #5