Overview

secWall data security system, strong security and easy to use, security technology is not required by secWall user, secWall user even does not attend whether the data using is encrypted or not. secWall can make the user use encrypted files directly, decyption is not required before using encrypted files. Encryption does not change the location of the file, nor the operating method and the user habits. All jobs of wncryption is implied by secWall in the background.

secWall IC is the hardware used by secWall system.

secWall characteristics:

Ø Plug & play encrypted documents

secWall IC uses starndard USB ports, sceWall extends USB plug & play characteristic to the encrypted files. Legal user can via plug IC to use encrypted files without decrypting the file. Encrypted files is hidden when you unplug the IC. This characteristic is implied by secWall real-time encrypt/decrypt technology. Real-time encrypt/decrypt technology does not change file’s location when encrypting the file, decryption is not required before using. Based on this technology, secWall supplied several new characteristics.

ü Enable to encrypt other software’s program and data files

Such as ERP system, CAD system, MIS system,finance system, etc. personal mail box, chat history, internet history, address book, net bank client, etc. This characteristic makes secWall as a security platform.

ü Encrypt unit: file, folder or drive

secWall can encrypt files, you can specify a drive to encrypt. Under secWall environment, Unauthorized user can not access encrypted drive and folder, nor the encrypted files. When secWall security environment is invalidated(eg: uninstalled secWall, connect the hard disk to other system without secWall), encrypted files exists in encoded format, unauthorized user can not read the files contents.

ü Auto encrypt new files

New files and folders in secWall encrypted folder and drive will inherit parent’s encryption attributes. Once the folder or drive is encrypted, all new files in this folder or drive will always keep encrypted. This characteristic make the encryption independent with the operator, security data will not be leak out because the operator’s security consciousness and ability.

ü Enable to encrypt network shared files

“Share can not keep security, Keep security can not share”, this is a long time puzzle. secWall real-time encrypt/decrypt technology also support network file, This is a solution for the enterprise to share security documents in limited range.

Ø Group cipher encryption

secWall uses group cipher according with Advanced Encrypt Standard(AES). Group packet length is 128 bits, and cipher key length is 256 bits.

Ø Multiple certificate support

secWall uses certificate encapsulating encrypt key, 16 certificates can be stored in one secWall IC, each certificate corresponding to one encrypted channel. 16 encrypted channels can work in the same time. Integrates with network real-time encrypt/decrypt supporting, secWall can control the security information access area in the enterprise.

Ø IC manager and IC user, different privilege

secWall supports IC manager centralize all of the IC. Enterprise user can limits IC user’s privilege to enhance the security.

² Lock the computer when unplug the IC

² Logon force IC authentication

² Hide unauthorized encrypted object

² Disable removable storage(Floppy, Flash drive, Smart Card, CD/DVD, Network shared drive, etc.)

² Disable operator’s certificate

² Disable operatior changing logon account

² IC user’s personal identification number(PIN) authentication

Ø Email attachments encryption

secWall supports packing one or more files to one encrypted package file, this encrypted package file can be attached to email to send. secWall mail viewer (SMViewer） can be used to view encrypted mail attachment if the receiver has no secWall system. secWall mail viewer (SMViewer） is free for download.

Warning: Before using secWall system, please read this manual carefully, use secWall following the manual.

Copyright © 2003 – 2007 Mawadata Corporation.

Note:

Windows, Windows 2000, Windows XP, Windows 2003 is the registered trademark of Microsoft Corporation.

Pentium is the registered trademark of Intel Corporation.

Other registered trademark or trademark is provided with each owner.


New feature

1． IC centralization

secWall Professional improves on IC centralization, include new version IC Manager and a new NetSetup.

1） New administrator netsetup

Use netsetup, IC　administrator can customize the client setup. IC manager can specify the client privilege when customizing. In old version, IC manager must set client default privilege one by one after client installation.

For details, please refer to “Net Setup”

2）New version of IC Manager

New version of IC Manager added IC distributing history. Use IC distributing history, IC administrator can restore IC to arbitrarily distributed time.

For more new feature of IC Manager, please refer to “IC Manager”

3）More IC user privilege control

Use IC Manager, IC administrator can set IC user’s privileges. Features in “secWall Settings” tool is associated with IC user’s privilege. IC user’s privilege and “secWall Settings” please refer to “IC Manager” and “secWall Settings”.

2． Interface

1） Document Manager

New version Document Manager displays more items in favorite folder. Now you can add or remove encrypted object’s shortcut in favorite folder.

2） secWall Settings

In secWall Settings, now you can change the logon account binding to the IC.

Note: Privilege of changing logon account is set by IC administrator. If “Change Account” button is disabled, perhaps IC administrator disabled this privilege.


Install secWall

System Requirements

secWall System requirements.

secWall Installation guide

secWall software installation guide.

secWall Administrator Install

Administrator install tool


System Requirements

Ø Operating Systems: Windows 2000/XP/ 2003.

Ø Processor CPU: Intel Pentium 166 or above.

Ø CDROM: CD or compatible driver.

Ø RAM: 32MB or above.

Ø Hard disk space: Minimum 20MB free space.


secWall Installation guide

Note 1:Don't plug the IC into the computer before software installation, The installation program will prompt user to plug-in the IC in the procedure of installationt.

Note 2:secWall installation need Administrator's privilege, Otherwise installation will fail. If you don't have the privilege administrators, please don't run this installation.

(1) Put the secWall software CD into the DVD/CD-ROM driver.(¨Figure 2-1)

Figure 2-1

(2) Normally installation will auto run. If your system disabled auto run feature of the DVD/CDROM. You need to browse the DVD/CD-ROM in the Windows Explorer, find the AutoRun.exe file, double click it running Installation(Figure2-2).

Figure 2-2

(3) Click "Install Mawadata secWall" running the installation, waiting system loading the installation program till display welcome windows (Figure 2-3).

Figure 2-3

(4) Click "Next" button, display the License Agreement (Figure 2-4).

Figure 2-4

Please read the all the terms of the license agreement carefully. You need to accept all the terms of the license agreement. Otherwise you can not install this system.

(5) After your accept the terms of license agreement, click "Next". User could select the location of the install folder(Figure 2-5)

Figure 2-5

(6) Click "Next", Setup program will ready to install (Figure 2-6)

Figure 2-6

(7) Click "Install" button, Installation will copy all the secWall files to you computer (Figure 2-7).

Figure 2-7

(8) After all the files copied, Installation will start the IC setting wizard (Express Version and Standard Version please skip it ,and jump to End directly). If you are the first time using secWall IC, Please plug the IC to USB port, and followed the wizard to install the IC hardware driver (Figure 2-8). If your IC is used and need not to modify the setting, please click "Skip" button to finish the installation (Figure 2-15). After installation user also can use IC manager to set the IC contents (See IC Manager).

Figure 2-8

If you need setting IC, Please plug the secWall IC to any USB port.

If you is not the first time using secWall IC, you can skip it's setting.

If you is first time using IC, system hardware driver wizard will advise you find new hardware (Figure 2-9), and will auto install driver for you (Figure 2-10).

Figure 2-9

Figure 2-10

There some difference of hardware driver wizard in different system. Please select "Install the software automatically (Recommended)" (Figure 2-11). Because the secWall installation have setup the environment, system will install the software automatically (Figure 2-12).

Figure 2-11

Figure 2-12

(9) Click “Next” setup program will setting a account for IC correspond with the system account/password, The IC holder could login the computer system by this account. The IC account/password must be same as the system account/password. If user need to logon to domain, please key in the domain name. Click "Next" continue.

Figure 2-13

(10) After all the file is installed, It's need to be restart the computer.

Figure 2-14


secWall Net Setup(Administrator Install)

Use secWall NetSetup, IC administrator can customize client installation.

Put secWall software CD in CDROM drive, autorun.exe will be started automatically. Click “secWall Administrator Install”. If your computer closed autorun, please click “Explore this CD”, double click on “Autorun.exe” to start it.

Client Option

Ø IC Logon Authentication

If checked, after installation client will use IC auto logon feature. The following two option will be enabled after this option checked.

ü Lock when Unplugged

Lock the computer when unplug the IC.

ü secWall Logo

Display secWall Logo in logon screen.

Ø Hide Unauthorized Object

If check, unauthorized encrypted object will be hidden, otherwise, unauthorized object is displayed, but access is denied.

Ø Storage security settings

Client default storage access privilege after install secWall, include floppy, removable(based on USB, 1394, etc. removable harddisk, flash disk, smard card reader), CD/DVD, network drive.

IC administrator can disable removable storage without IC, then set proper privilege in IC. Privileges set in IC will overwrite default storage privilege setting when IC is connected in the computer.

Ø Target Directory

Client installation folder. If set, client setup will not prompt the user for target directory, otherwise, Client setup will prompt the user for the target directory.

Ø Configure IC User

Prompt the user to configure IC logon account after client installation.

If IC administrator set IC user’s account when distributing the IC, Do not check this option. If IC administrator distribute certificates in IC only, IC user is responded to set logon account, please check this option.

Ø Install IC Manager

Install IC Manager in client

IC Manager is designed for IC administrator, usually does not require to install into client.

Ø Uninstall Protect

If uninstall protect is enabled, uninstall password is required to uninstall secWall software.

Destination Folder

Where to copy customized client installation package. Generally, IC administrator specify a network shared folder to store client installation package, all client can connect to this folder to install client software.


secWall System Settings

After the installation of secWall system, there will add a “secWall System Setting” in “All program”. The current user can use this tool to quickly setup the secWall system. Using this tool, you must plug the IC. If IC can not be identified by secWall system, this tool can't be use.

Click the “Start” menu => “All Programs” => “Mawadata secWall” => “secWall System Setting”

When you run the “secWall System Setting”, you must plug in the IC and pass the PIN code verification (if sets PIN). Otherwise the “secWall Sysetem Setting” Couldn’t be run.

The GUI interface of “secWall System Setting” is different with the different secWall products. For the secWall Professional and secWall DataServer Version , IC administrator could do some setting for the “secWall System Setting” to disable some setting or interface.


IC User

Notes: The secWall express version only have the “IC User” page, without the “Certificate” and “Shell Integration” pages.

Figure 3-1

Ø Logon Setting

secWall IC provide user to auto logon Windows system with IC as well as enter user name and password. User should set the password to same as the system logon password. The password in the secWall IC is automatically synchronization with the operation system, If user need to change the logon password: Press "Ctrl+Alt+Del" to change your logon password if you want.

Ø Force IC Authentification.

Force IC authentification will enhance system security, user can not logon system without IC authorize passed even they input the correct password by keyboard, Only then plug in the proper IC user can using the computer system.

Check on the option: "Force IC Authentification", the edit box of User Name and password which in the logon windows will be disabled. User can not key in user name and password to logon the system. Using the proper IC is the only way to logon the computer.

Note: Changing Logon setting does not take effect until restart computer.

Figure 3-2

Ø PIN Settings:

Set Personal Identifier Number (PIN) is for enhanced security (eg. IC be lost) if you'd like.

When user plug in the IC, system will ask for IC PIN to identify IC holder with PIN verify is checked on.

Figure 3-3

If you need to enable the PIN verification, Please check on the “Enable PIN Verification”

Notes: Please remember your PIN, you’ll couldn't using IC if forgot PIN.


Certificate Setting

Figure3-4

Public certificate can share encrypted files with other user. peoples can access encrypted files with same public certificate.

Certificate Settings include the public certificate's Create/Renew, import, and export.

Ø Create/Renew:

There's no public certificate in IC by default. Click "Create/Renew" button to create/renew a new public certificate.

If there's exists a public certificate, Renew public certificate will replace the old one. Files encrypted by the old certificate will not be available. System will prompt a dialog.

Ø Import certificate:

Click "Import" button will popup the import certificate dialog box (Figure 3-5):

Figure 3-5

Fill in the import certificate file path, user can manually key in or click "Browse..." button to select it. By the same time need to provide the password which the certificate encrypted with when certificate exported. Click "OK" the certificate will import to IC.

Ø Export Certificate

Select those certificates which user need to export, click "Export" will popup export certificate dialog box:

Figure 3-6

Fill in the export certificate file path, user can manually key in or click "Browse..." button to select the file path. Please specify the password at same time, system will using this password to encrypt the export certificates to keep it safety. Click"OK" button the specified certificates will be exported as file, you could backup this file or pass this file to whose who need to use this public certificate.。

Figure 3-7

If there’s no public certificate, the “Export” button is disabled.


Shell Integration

Figure3-8

Shell integration: Include two function options.

Ø Context Menu.

You can operate files or folders by context menu in Windows Explorer, please specified context menu style.

Ø Icon Overlay

Icon overlay identifies encrypted files obviously, select a icon overlay style, as well as not display. This setting will take affect until restart computer.

Figure3-9


Local system security

Figure 7-2

Notes: If IC Administrator checked the “Disable user change secWall local security”, the “System Security” page is invisible (Re “IC Manager”).

System security: include the following option.

Ø IC Authrntication

ü Force IC Authentification when Logon

Force IC authentification when logon will enhance system security, user can not logon or unlock system without IC authorize passed even they input the correct password by keyboard, Only then plug the proper IC use can using the computer system.

Checked on the option: "Force IC Authentification when Logon", the edit box of User Name and password which in the logon windows will be disabled. User can not key in user name and password to logon the system. Using the proper IC is the only way to logon the computer.

ü Force IC Authentification when Unlock

Checked on the option: "Force IC Authentification when Unlock", User can not key in the user name and password when computer is locked. Using the proper IC is the only way to unlock the computer (Figure 7-3).

Figure 7-3

Figure 7-4

ü Don’t Lock while Unplug IC

When using IC authentification, the default behaver of unplug IC will lock the computer. If you do not want to do as this(Example: You are the IC administrator, IC plug/unplug frequently) , check this option.

Ø Auto Hide

If checked on, unauthorized user will not see the encrypted archives. Otherwise, the encrypted file can be listed as normal. For examples: Archive A encrypted with certificate 1, archive B encrypted with certificate 2. If current user without IC plugging, archive A and B can not be show, there are hide. If user's IC is plugged, archive A will be show if there¡¯s certificate 1 in the IC, archive B will be show.

If "Auto Hide" is not checked on, system will show all the encrypted archives.

Ø Removable Storage default policy

If User have the administrator privilege, user could change the storage default policy. Otherwise the setting is disabled (gray).

secWall system could control the devices of removable storage. The removable storage includes Floppy, Removable storage (U disk, MP3, SmartCard, CF, SD et.), DVD/CD-ROM, network driver et....

Local security Option:

Normal: The device would be working as normal.

Read Only: The device just could be do read operation, and can not do write operation.

Disable: The device is disabled.

These security policy made from here is valid for the without IC (or IC hasn’t be identified), the security policy of IC holder (IC has been identified) should be set in the “IC Manager”.

Figure 7-5


Shell integration

Figure 7-6

Shell integration: Include two function options.

Ø Context Menu

You can operate files or folders by context menu in Windows Explorer, please specified context menu style.

Ø Icon Overlay

Icon overlay identifies encrypted files obviously, select a icon overlay style, as well as not display.

Notes: This setting will take affect until logoff current session.

Figure 7-7


IC user

Figure 7-8

Setting IC User name (Figure 7-8)

Ø Account Info:

System identify user by user name, password and domain name, User name just could be set by administrator, normal user can not modify. The password in the secWall IC is automatically synchronization with the operation system, If user need to change the logon password: Press "Ctrl+Alt+Del" to change your logon password if you want. If needs to logon domain, user should specify the domain name (Figure 7-9).

If IC Administrator checked the “Disable the user change the account” option, the “Change Account” button will be disabled (Re “IC Manager”).

Figure 7-9

Ø PIN Settings:

Set Personal Identifier Number (PIN) is for enhanced security (eg. IC be lost) if you'd like. In the IC Manager also can setting the PIN (Re “IC Manager”).

When user plug in the IC, system will ask for IC PIN to identify IC holder with PIN verify is checked on.

Figure 7-10

Note: If user continue key in the wrong PIN code for 3 times, IC will be locked. And administrator could unlock the IC using IC Manger (Re “IC Manager”).

Figure 7-11

There is several PIN verify level.

Disable Verify: secWall system is always believes IC is safe, needn't to verify PIN. User can check on this option when be confirm IC's safety.

After Shutdown or Restart: Need verify PIN only when computer power on or restart.

IC Unplugged XXX Minutes: System need to verify PIN, when IC is plugged after unplugged specified time. User can specified the time in minutes. This option can be used combined with the option of after Shutdown or Restart.

Always Verify: secWall system will verify PIN every time IC is plugged.

When user checked on verify PIN, need to key in a PIN code. The two code must be same, which in the edit box of PIN and Retry. User should remember this PIN, After apply secWall system will take effect the setting.


Certificate settings

Figure 7-12

Certificate Setting includes the certificate add, modify, delete, import, export (Figure 7-12).

The private certificate's content will display directly, and the public certificate's key just show the “*” instead of the content. Public certificate was been distributed by IC administrator (re “IC Manager”).

When administrator checked the “ Disable personal certificate” option in the , in the “IC Manager”, the “Certificate” Page is invisible(Figure 7-13) .

Figure 7-13

Ø Add:

Click "Add" button will popup the dialog box (Figure 7-14), user can key in the certificate name, valid period and key context. The above three items can't be empty. Click "OK" finished the certificates add function.

Click the "<<Auto" button could automatically generate key contents for user.

Figure 7-14

Ø Modify:

Choose the certificate which you need to modify, click "Modify" button, popup the modify dialog box (Figure 7-15).

Figure 7-15

User can modify the certificate's Name, Valid Period and Key. The key's contents could be automatically generated (recommend), and also cant manual key in. Click "OK" to finish modify certificate.

Notes: Please be cautious of modify certificate! Modify certificate normally use for modify the Name and Valid Period, if user modified the key content, the files which encrypted by this certificate couldn’t be open later.

Ø Delete:

Choose the certificate which user wants to delete, click "Delete" button will popup the warning dialog box (Figure 7-16).

Figure 7-16

Click "OK": delete this certificate, click "Cancel" to cancel this operation.

Notes: Once the certificate been deleted, the files which encrypted by this certificate couldn't open later. Please decrypt the files first before delete the certificate.

Ø Import certificate:

Click "Import" button will popup the import certificate dialog box (Figure 7-17):

Figure 7-17

Fill in the import certificate file path, user can manually key in or click "Browse" button to select it. By the same time need to provide the password which the certificate encrypted with when certificate exported. Click "OK" the certificate will add to the certificate list.

Ø Export Certificate

Select those certificates which user need to export, click "Export" will popup export certificate dialog box:

Figure 7-18

Fill in the export certificate file path, user can manually key in or click "Browse" button to select the file path. Please specify the password at same time, system will using this password to encrypt the export certificates to keep it safety. Click "OK" button the specified certificates will be exported as file, you could backup this file or pass this file to whose who need to use these certificate.


Document Manager

Document manager is secWall system integrated user environment. User can use it to manage encrypt archives easily.

Start "Document Manager": Click "Start" -> "Program" -> "Mawadata secWall" -> "secWall Document Manager".

Figure 4-1

The operation process of "Document Manager" is same as Windows Explorer. User can directly key in the file path in the address box or selected from the drop list box (Figure 4-2). The initialize interface of Document Manager will show the "My Favorites" (Encrypted archives list).

Figure 4-2

Document Manager has 5 menus: File, Edit, View, Option, and Help. User can directly Encrypt/Decrypt archive in the Document Manager, especially those objects which could not be encrypted by Context Menu (like: desktop’s shortcut, programs in the start menu).


Encrypt

Choose a folder; user can encrypt it by several ways operation: Document Manager's menu, button on toolbar, context menu.

(1). Document Manager's Menu: Click "File" -> "Encrypt" (Figure 4-3).

Figure 4-3

(2). Tool Bar Button: Click the button "Encrypt" on the tool bar (Figure 4-4).

Figure 4-4

(3).Context Menu: User select an archive-> right click will show the context menu (Figure 4-5).

Figure 4-5

All the above three methods will popup the Encrypt Dialog box(Figure 4-6)

Figure 4-6

Ø Certificate

secWall standard version offers 2 certificate: Private and Public, user can selected a certificate for encryption. If haven't setup public certificate, please create a certificate first.

User can see the encrypted archive's properties by the property item of context menu, select the encrypted archive, "right click" -> "Property"-> "secWall" or click the "Property" button on the tool bar.

Figure 4-7

The properties show the encrypted information:

IC Serial No: The serial no of which IC encrypted this object.

Encrypt Time: The encrypt time of this object.

Write Protect: Encrypting object with checked the “Read only to other IC users” option, this value should be “Yes”, otherwise it would be “No” (The secWall Standard version and secWall Express version haven’t this option).

Download Protect: Encrypting object with checked the “Download protect” option, this value should be “Yes”, otherwise it would be “No” (Only secWall DataServer version have this option).

Certificate Name: The certificate’s name which certificate using for encrypting this object.

Algorithm: The encrypt algorithm using for encrypting this object.

Expire Date: The certificate’s expire date.

Ø Encrypt Option

The Encrypt Option (Figure 4-8):

Figure 4-8

Read only to other IC user: Other IC user just could read the object, couldn’t modify this encrypt object (Read only).

Wipe the source file: When encrypt the object, secWall will wipe the source file entirely, after wipe file. Any information couldn’t be restored.

Skip files already encrypted: secWall do not encrypting the already encrypted file again during the encrypting progress.

Add to common favorite: On the multi-user computer, other user could see the encrypted object’s shortcut in the secWall document’s favorite folder.

Ø Error Handler

If there are errors occurred during encrypting, have 4 option to deal with it(Figure 4-9).

Figure 4-9

Record error and continue encrypt: Recode the error and continue the encrypting operation.

Stop: When error occurred, stop encrypting operation.

Stop and undo all encrypts: When error occurred, stop encrypting operation and undo all encrypts.

Ask me how to do: When error occurred, its will popup a error choice dialog ask user “What are you want to do?” (Figure 4-10).

Figure 4-10


Decrypt

There are also three methods to do the decryption for the encrypted archive in the Document Manager.

(1). Document Manager menu: Click menu "File" -> "Decrypt" (Figure 4-11)

Figure 4-11

(2). "Decrypt" button on the tool bar (Figure 4-9):

Figure 4-12

(3).Context Menu: User select an archive-> right click will show the context menu (Figure 4-13).

Figure 4-13


Pack to Mail

There’re two methods for pack to mail in the Document Manager.

1． Document Manager Menu: Click “File” -> “Pack to Mail” (Figure 4-14).

2． Context Menu ->”Pack to Mail” (Figure 4-15).

Figure 4-14 Figure 4-15

Figure 4-16

Key in or click “Browse…” button to specify a package file path name, and select one proper certificate. Click “OK” button to package a MMP file.

MMP fie is similar to the zip file, could send by attachment.

Notes: secWall Express version couldn’t make encrypted package file.


Pack and Send Mail

Click “File” -> “Pack and Send Mail”, system will popup a dialog (Figure 4-17). After click “OK” button, Document Manager will start the Email send/receive program. The Email send/receive program is depend you r Email software, by default is Outlook Express (Figure 4-14). The packed mail will be send to receiver as the attachment.

Note：secWall Express can’t using encrypted package file.

Figure 4-17


Advance feature

Ø Drag object from secWall Document Manager to Windows Explorer

User can drag the archive from the Document Manager to Windows Explorer, Document Manager will copy the current selection to the position specified by Windows Explorer.

Ø Drag encrypt object from Windows Explorer to secWall Document Manager’ favorite

secWall Document Manager will rebuild this encrypted object’s shortcut.

Ø Fast startup secWall Document Manage from Windows Expleror

Using the context menu in the Windows Explorer to fast start the function encrypt, decrypt and pack and mail function of the Document Manager (re Context Menu).

Double click the MMP file in the Windows Explorer; system will automatically open this file in the secWall Document Manager.


Setting

Click "Option" -> "Setting", system will popup a setting dialog (Figure 4-18):

Figure 4-18

Ø Appearance

"Full row select": When check on this option select files will display full row selected (Figure 4-19).

Figure 4-19

"Adjustable column order": When check on this option user could adjust the order of the column of the list control (Figure 4-20), in the Figure 4-19 the file name is first column, in the Figure 4-20 adjust the file type to the first column.

Figure 4-20

"Grid": When check on this option, list control will show the grid (Figure 4-21):

Figure 4-21

"Hot track": When check on this option, the current selection will follow your cursor's movement.

Ø Action

Figure 4-22

"Enable encrypt read only file": secWall do not encrypt the read only archive by default, when check on this option, secWall can encrypt the read only file.

"Enable encrypt system file": secWall do not encrypt the archive which have system property by default, because these file maybe is the key file of operation system. Perhaps used during system startup. If you confirm encrypt those file which have system property will not affect system startup, you can check on this option, secWall will allow encrypting those file which have system property.

"Use default encrypt when invoked from shell": With check on this option, when user using context menu to encrypt archive in Windows Explorer, secWall will using the default setting to encrypt archive without advise user to modify the encrypt option.

Ø Algorithm

Figure 4-23

Internal: These algorithms are secWall build inside.

Plugin: Third party algorithm.


Context Menu

Using this function need to check on the option of "Enable Context Menu" which in the "IC Setup", please reference the "Shell Integrateion"for detail.

Context Menu Encrypt/Decrypt

Using the context menu of right key to do the Encrypt/Decrypt operate.

Right key drag and drop

Using the right key to do the drag and drop operate in the window’s explorer.


Context Menu Encrypt/Decrypt

Select one or multi archives, right click in the selected archive(s). The context menu will be show (Figure 5-1).

Figure 5-1

Select the item of "Mawadata secWall" in the context menu, there will show the submenu (Figure 5-1).

If the current selection was not encrypted archive(s), there should no "Decrypt" item option.

If the current selection was encrypted archive(s), there should no "Encrypt" item option

Ø Encrypt

Click "Encrypt" system will popup the encrypt dialog box (Figure 5-2).

If user check on the "Use default encrypt when invoked from shell" option in the Document Manager, the encrypt dialog box will not be show, secWall system will encrypt the archive using the default setting.

Figure 5-2

Choose the proper option; please see the operation for detail.

Click "Encrypt" to begin encryption, system will show the encryption process

  Figure 5-3

Ø Decrypt

Click "Decrypt" to decrypt archive, system will show the decryption process (Figure 5-4).

Figure 5-4

Ø Encrypt and Send Mail

Please reference the "Pack and Send Mail" for detail.


Right key drag and drop

Select one or multi archive, using right key drag the selection and drop to other folder. System wills popup the menu (Figure 5-5).

Figure 5-5

Ø Copy and Encrypt

Copy the selection archive to the specified folder, and at the same time encrypted the selected archive. This operation does not do any affect the source archive. Click this menu item system will popup the encrypt dialog (Figure 5-2), please reference the 4.1 for detail.

Ø Move and Encrypt

This function is same as the "Copy and Encrypt", the only difference is the source archive will be deleted, and just keep the encrypted archive.


IC Manager

(IC Manager is one of the secWall Professional/DataServer version’s components, secWall Standard/Express version haven’t IC Manager)

IC Manager is the management tool for IC administrator, which could do all the IC setting, for example: Change Password, Certificate's setting/backup, IC backup.

Startup IC Manager, key in IC administrator password (Figure 8-1). IC manager’s password is used for protect the IC Manager publish history. When the first time using, because there’s no publish history, the default password is blank.

Figure 8-1

If user key in the invalid password, IC Manager will advise user: Can’t logon history database, Please sure the password is correct (Figure 8-2)

If administrator continue key in the invalid password for three times, IC Manager will automatically exit.

Figure 8-2


IC Administrator’s Password

Figure 8-3

〔1〕 Change Password

Click “Change Password” button to Change Password (Figure 8-4).

Figure 8-4

The two passwords must be same, otherwise user can’t change the password (Figure 8-5).

Figure 8-5


Distribute History

Distribute history keep all the distribute records. Using the IC distribute history, the IC administrator could restore the IC information to the specified day in the history records (Figure 8-6).

When administrator changed the IC contents, IC Manager will write one records into distribute history. When the IC contents dos not changed, IC manger dos not add new records. Just modify the old record and modified the distribute time to current system time.

Figure 8-6

1. Extract

Extract on records from distribute history and restore it to Current IC View.

Step:

(1) Select one record.

(2) Click “Extract” button, IC Manager will prompt you extract successfully (Figure 8-7).

图8-7

(3) If want restore the record into current IC, click the “Write IC” on the tool bar.

2. Detail

Select one record, Click “Detail” button. System will show you all the information of the record, includes User, Department, Contact and Comment information (Figure 8-8).

Figure 8-8

3. Backup

Backup the distribute history.

Click “Backup” button, choose the backup file path, and input the backup file password (Figure 8-9).

You can backup the old records, and using the “Clean” function to clean the old records from the distribute history. And also can restore this backup file when you need these history recodes.

Figure 8-9

Step:

(1): Specify backup file path.

(2): Input backup file password.

(3): Click “OK” button to backup current distribute history.

4. Restore

Restore the specify backup file into current distribute history (Figure 8-10)

Figure 8-10

Step:

(1): Specify the backup file path.

(2): Input the backup file password.

(3): Click “OK” button to restore the backup records.

5. Clean

Clean the distribute history.

Click the “Clean” button, IC Manager will prompt a dialog (Figure 8-11), Administrator could specify the date, All the records after the date will be reserved. If no date specified, only the last record of each IC will be reserved.

Figure 8-11


Current IC setting

Current IC setting is for setup the current IC’s Storage Security Policy, IC Information. And also provide the whole IC content import/export function.

Figure 8-12

1. Storage Security Policy

secWall system could control the devices of removable storage. The removable storage includes Floppy, Removable storage (U disk, MP3, SmartCard, CF, SD et.), DVD/CD-ROM, network driver, et.... If the IC Administrator check the “Disable user change secWall local security”, the “System security” page is invisible.

Local security Option:

Normal: The device would be working as normal.

Read Only: The device just could be do read operation, and can not do write operation.

Disable: The device is disabled.

These security policy made from here is valid for the IC holder (IC has been identified), the security policy of without IC (or IC hasn’t be identified) should be set in the “secWall System Setting”.

2. IC Information:

IC information includes the IC status and Expire Date.

Normally the IC status is "Normal", when user PIN verify failed for repeated three times, the IC status will be set to "Locked". Administrator could select "Normal" from the combo box to unlock the IC.

IC user could be identified in the period of validity, If needn’t set the specified expire date, please uncheck the “Expire Date” Option.

3. IC Backup (Import/Export)

The function of IC import/export is provided for user to backup and reproduce IC

² IC Import

Import an outside IC backup file into IC hardware content (The hardware's present content will be replaced by the backup file's content).

Note: Please be carefully before IC Import. The IC hardware's present content will be replaced by the backup file's content.

Operation process:

(1): Input the IC backup file's path.

(2): Input the backup file's password.

(3): Click "OK" button to import the IC backup file.

Figure 8-13

4. IC Export

Export the IC's content to a file for backup this IC. Latter user can use this backup file to import to other IC for duplicate IC.

Note: Please keep your IC backup file in the safe place, and bear in mind the password.

Figure 8-14

Operation process:

(1): Input the IC backup file export path.

(2): Input the backup password, the two passwords must be same.

(3): Click "OK" button to export the IC backup file.


IC user information setting

User information setting is for setup the user name/password which used for logon operation system, valid period, and PIN code.

Figure 8-12

1. User Account Infomation

"User Name", "Password" must be corresponded with the operating system's account and password. If the user information in the IC is different with the user information in current operating system, IC would not be recognized. If user needs to logon the domain, please input the domain name at the same times.

2. Disable the user change the account

If administrator checked this option, the IC user couldn’t modify the account information in the “secWall System Setting”, The “Change Account” button which in the “IC User” page will also be disabled. Otherwise the IC user could modify the account information in the “IC User” page by self (Figure 8-13) (Re “secWall System Setting”->”IC User”).

Figure 8-13

2. Valid Period setting

Click the "Valid Period..." button in the IC User Information window to setup the IC valid period. The IC holder would only be recognized by operation system within the valid period. If needn't to setup the valid period, just to clear the "Expired after" option.

3. PIN Setting.

Personal Identification Number (PIN) is used to identify whether the IC holder is the legal holder (Figure 8-14), current user also set it in the “secWall System Setting”.

Figure 8-14


Certificate Manage

secWall Professional and DataServer IC provide maximize 16 certificates (Figure 5-10).

Figure 8-15

1. Add/Edit Certificate

Click "Add" or "Edit" button to add or edit certificate, also double click row to “Add” or “Edit”.

This certificate’s dialog box have “Public” option, the certificate dialog of “secWall System Setting” do not have. When check this option, secWall System Setting shows the “*” instead of the certificate’s content. And User couldn’t do any modification about this public certificate (re secWall System Setting -> Certificate Setup).

.

Figure 8-16

2. Delete Certificate

Select the certificate(s) which you want to delete, click "Delete" button to delete them. System will popup a dialog box (Figure 8-17) needs user's confirmation, click "Yes", the selected certificate(s) would be deleted.

Figure 8-17

Note: After certificate deleted, the archive will can not be accessed which encrypted with the certificate. Please be confirmed you are no longer need this certificate.

3. Certificate Import

Certificate import/export is a useful function for different IC user to duplicate certificate and distribute. With the same certificate different IC holder could shared to using the archive which encrypted with the certificate (re "secWall System Setting"-> " Ceritificate Setting ").

(1). Click "Import" button, system will popup a "Certificate Import" dialog box (Figure 8-18).

(2). Input the certificate backup file path.

(3). Input the certificate file's password.

(4). Click "OK" to import the certificate(s).

Figure 8-18

System will import the certificate from the backup file to the space position of current certificate list.

If there's same name of imported certificate with the exist certificate in the IC, system will popup a rename dialog box (Figure 8-19) for advise user to rename the certificate's name or skip import it.

Figure 8-19

4. Certificate Export

Certificate export is using for backup certificate or duplicate certificate for distribute to other user (Figure 8-20).(re secWall System Setting ->“Ceritificate Setting

”)

(1).Select the certificate in the certificate list which you want to export.

(2).Click "Export" button, system will popup a "Certificate Export" dialog.

(3).Input the export certificate file path.

(4).Input the certificate password, this password will need to verify when user import this backup file.

Figure 8-20

5. Disable personal certificate

When user checked this option, in the “secWall System Setting” the “Certificate” Page is invisible(Figure 8-21) .

Figure 8-21


IC Read/Write

All the settings which made by IC Manager will be valid until the data have been write into IC. If user haven’t do any change, the “IC Write” menu will be disable (Figure 8-22), If there’s set changes, “IC Write” menu will be enabled (Figure 8-23). By the same time, the “Write IC” button’s status is synchronized with the “IC Write” menu.

IC read use to read the IC’s contents which is plug in the computer, its status synchronize is same as the IC Write (see the figure for detail).

Figure 8-22 Figure 8-23

Figure 8-24

As the administrator exits IC Manager, When IC Manager detected the administrator have changed the settings without write it into IC, It will popup an dialog box to remind the administrator (Figure 8-25), Click “Yes” to write the changes into IC, Click “No” to exit IC Manager without write into IC. Click “Cancel” just to exit this dialog box.

Figure 8-25

When administrator changed the settings, and want return to the IC original status, Click “IC Read” button, the original information will overwrite the current information (Figure 8-26).

Figure 8-26


Settings

Click the “Settings” in the menu “View” of IC Manager (Figure 8-27).

Figure 8-27

⑴. IC Password Generation

There are tow options:

Use current IC Manager’s password. System will get the IC Manager’s password automatically, and make the IC’s password same as the IC Manager’s password.

Fixed Password: Administrator could key in the password, this password could be different from the IC Manager’s password.

⑵. Prompt for associated information when history updates

There are three options:

Do not prompt: IC Manager did not prompt when IC’s information changed.

Only prompt when not exists: IC Manager will prompt for associated information only where’s no current IC information in history records.

Always prompt: IC Manager always prompt as long as IC information changed.

⑶. IC unplugged

Reserve current IC view: When IC unplugged, All of the views of IC Manager are reserved, same as the IC is plugged (Figure 8-28).

Figure 8-28

Delete IC View: When IC unplugged, IC Manager only have the “Distribute History” view. The Current IC, User information, Certificate manager wouldn’t be show (Figure 8-29).

Figure 8-29

If check the “Prompt the user to select” option, when IC unplugged. IC Manager will prompt a dialog to prompt user to make choice (Figure 8-30).

Figure 8-30

If check the “Don't prompt again”, when there’s IC unplugged again, system will make the current choice as the default .


Server Operation

(This chapter is corresponded to secWall Database Server version only)

Server Characteristics

C/S database encryption


Server characteristics

(This chapter is corresponded to secWall Database Server version only)

Ø secWall can encrypts data in the server. If encrypted data shared in network, client can not access these encrypted data without certificates.

Ø Encypted data is read only to the client if it is shared in network, since your share privilege is read-write.

Ø secWall encypted data always holds encypted status when it transmits in network.


C/S database encryption

(This chapter is corresponded to secWall Database Server version only)

C/S(Client/Server) database is managered by database system, database system is the only operator to the database file. Database client send requests to the database server to complete a database read-write operation. secWall can encrypt database file, but secWall can not distinguish different client. secWall is used to protect database file itself only.

Note the following for databse system encryption:

1. Database system always starts in the background with the OS starting and starts no user interface. The database operation result is reflected by the client requests. Client should check the database operation result properly. You can not operates the database if IC had not been authorized.

2. secWall IC is a plug and play devicde, but database manager system can not add database file dynamicly. If you plug IC after the system boot, you may need to restart the database system.

3. Database system uses system table like SQL Server, It is strongly recommended that you do not encrypt system table (master.mdf/master.ldf), because when SQL Server starts, If can not read system table information, SQL Server failed to start. You must start SQL Server manually after system boots.

4. If a database file is being used, you must stop the using if you want to encrypt or decrypt it.


Uninstall secWall

After uninstalling Mawadata secWall, encrypted files will not be protected by secWall, encrypted files will not be hidden. Because the encrypted file contents is encoded, you can not read the encrypted file contents.

It is strongly recommended that you decrypt all secWall encrypted files before uninstalling secWall, otherwise these encrypted files will be lost or damaged permanently.


Uninstall secWall

If you do not required secWall software, you can uninstall it from “Add/Remove Programs” in system control panel

Note: Administrator privilege is required to uninstall secWall.

Figure 6-1

Select “Mawadata secWall”, click “Remove” button, uninstall wizard is started.

A warning message box is displayed to confirm the uninstall operation.

Figure 6-2

Click “OK”, Mawadata secWall will be removed from your computer. You should reboot after uninstall finished to delete locked files.

Figure 6-3

Note: It is strongly recommended that you decrypt all secWall encrypted files before uninstalling secWall, otherwise these encrypted files will be lost or damaged permanently.

If your IC administrator set a uninstall password, you must supply this password to uninstall secWall。

Figure 6-4


Appendix

Real-time encryption/decryption technologies

Summary of the encoding technologies

AES Introduction


About real-time encrypt/decrypt technologies

Real-time encryption/decryption technologies

We first introduce the workflow of the traditional encryption/decryption technologies.

The traditional technology is user must first decrypt the encrypted file into plain file before using it. If the file need to be modified user must encrypt it again after finishing the modification.

Figure1 Workflow of traditional encryption/decryption

Real-time Encrypt/Decrypt (on the fly Encrypt/Decrypt) is a new data encryption concept which appears within these two years. From operators, the biggest character of real-time encrypt/decrypt is that the authenticated users can directly use the encrypted files rather than decrypt them, use them, then encrypt it again after the modification. Real-time encrypt/decrypt must integrate with the operating system so it needs advanced tech. The process of Real-time encrypt/decrypt is hided from the operators so the authenticated user using the encrypted files is as using the unencrypted ones. For an example, the workflow of figure1 can be simplified into the following one figure 2.

Figure2 Workflow of Real-time encryption/decryption

From figure1, in the processing of traditional encryption plain files exist for a long time. In order to protect them the files have to be encrypted. Once they are decrypted into plain files, they cannot be protected properly in any way. This needs users have enough protection consciousness at this period to ensure the absolute safety of these encrypted files. But contrarily the end users mostly do not have the ideas in this so most accidents are happened in this stage. Because no plain files exist in the real-time encrypt/decrypt processing there are no this problem which exists.

An visual figuration is given to describe the relationship between encryption and the thief. The thief is like a fox on the ground and the unencrypted data is like a chicken. The fox can easily catch the chicken. The encrypted data is like a little bird. That is not so easily that the fox wants to catch the bird. But the bird is not always safe. It is the most dangerous when it alights on the ground. When Using the traditional encryption tech to encrypt data, they have been decrypted before using. At that time, data becomes plain data, like the bird and can not protect itself from the fox. To protect the bird, the bird must be always in the sky. The traditional encryption tech can not prevent the bird to alight on the ground. But secWall system can.

If the appearance of the coding tech in the data protection theory is like the invention of plane real-time encrypt/decrypt tech is like the invention of filling the plane up during its flying.

Mawadata secWall's real-time encrypt/decrypt engine is the toppest ones of the world is the only one which can support the distributed network data encryption. Also is the only one which can support the plug-in algorithm.


Summary of the encoding technologies

Encryption is according to the encryption algorithm to encode the plain data into encrypted data. This algorithm is by a group of keys to do some mathematical operations in the original info then get another group of info. Otherwise using the same mathematical operations and keys, we can get the original info from the encrypted info. This is called decryption. This method uses the same keys to do the encryption/decryption so it is also called symmetric encryption algorithm. The characters of this algorithm are that the indensity is very high , the speed is very fast and it is fit for the whole processing encryption. Such as DEC, IDEA, Blowfish, RC5ect belong to this algorithm. Because it use the same group of key during the encryption and decryption, the key is the only way to read the encrypted data, this algorithm must ensure the safety of the key.

There is another algorithm that encryption and decryption use the different keys. One is private key which is used to encrypt data. The other one is public key which is used to decrypted data. Uses can use the public key to decrypt the file to get the original info but they can not use the public key to generate the encrypted files. Because the public keys are public to all users this algorithm is called public key encryption algorithm. For example RSA is most popular one. Its characters are the bits of the key are very long(eg.RSA, most of the keys have more than 1024 bits because it is treated as unsafety that using the key which length is smaller than 768bits), the speed is slow and it is not fit for the large amount of the batch data. It is mainly used in authentication and data signature.

AES algorithm is that the use federal standard authority is collecting the encryption standard around the world from 1997. It belongs to symmetric encryption algorithm and represents the most advanced encoding tech now. The final winner is RijnDael algorithm. Others are CAST256,MARS,RC6,Serpent,Twofish etc.

Perfect encryption algorithm cannot be stolen in theory except for ending listing all the possibilities. But it is not in reality only has the possibility in theory. Even though we use the fastest computer It will cost several billion years to list 128bits keys.


Advanced Encryption Standard(AES)

AES Introduction

AES is the successional keys after DES. NIST started to collect it and working on it from 1997. Because DES has accumulated many popular experiences, AES has attracted many people.

At the beginning there are 15 alternate algorithms, till March 2000, there are 5 algorithms left. They are IBM's "MARS", American RSASecurity research department-american RSA Laboratories's "RC6", Belgium's "Rijndael" , the "Serpent" which English/ Israel/ Norway's companies developed, american's "Twofish" etc. Japanese NTT's "E2" has been selected as an alternate. But at the end it is not at the final.

After more than 3 years selection, the final algorithm is "Rijndael"(pronounce "Rhine-doll". The inventors are Belgium's JoanDaemen and VincentRijmen). Before that the professionals predicted that it was some difficult that only one can be selected as the AES algorithm and maybe several algorithms are determined as the AES algorithm. But at last the AES algorithm is only one.

The AES standard can use the keys of 128bits, 192bits and 256bits.according those keys. The number of them are 3.4*1038,6.2 *1057,1.1*</span!A1077 . comparing with DES, the DES key has 56bits, as about 7.2*1016. so the number of AES 128bit keys is about 3.4 *1038 / 7.2 *1016 =4.7 *1021 times than that of DES 56bit key. In the latest 90's, there was a famous computer named "DES CRACKER". They said it can find the DES key within several hours. Assuming that building one computer that can test 255 keys and find the DES key within one second, it will spend.

As a new FIPS (Federal Information Processing Standard), AES is used as the approved encryption algorithm and to protect the sensitive info by American government. These government organizations may use AES or other authentication algorithms. Other organizations or other non American companies can be invited not restricted to use the AES or other NIST authenticated encryption standards.

For more information about AES standard, please visit NIST official website: http://www.nist.gov.