IDS Forum

Re: Data Encryption

Posted By: Art Kagel
Date: Friday, 13 February 2015, at 11:26 a.m.

In Response To: RE: Data Encryption (Rubinstein, James)

Informix's disk layout on a page level, for data pages is fairly strait
forward. There are four sections of a page:

- A 20 byte header at the beginning of the page with page number, next &

prev pointers for pages that hold rows wider than a page, content flags,

and a checksum.

- A four byte trailer with a "timestamp" at the end of the page which is

a sequential number used by incremental archives to determine which pages

have been modified since the "timestamp" at the time of the last higher

level archive. It is also used along with the checksum in the header to

detect pages that were partially written during a hard crash.

- A "slot table" which grows backwards from the trailing timestamp

towards the header with one entry per row that is homed on the page. The

entry is four bytes per row and contains the row length and location of the

beginning of the row within the page. If a row was moved off of its home

page because the table is variable length and the row outgrew the free

space on the page, then the slot table entry for that row contains a

forwarding point which is the rowid (page and slot #) for the new location

of the row so that its external rowid in indexes remains unchanged.

- Data in natural format. Some internal structure on disk for decimal

and datetime type columns is more compact on disk than in memory and BYTE,

TEXT, BLOB & CLOB, and some UDT type columns only store header information

"in row" but otherwise it is the same as the memory image of the data.

Data pages are gathered into extents of contiguous pages belonging to a
partition (table, index, or a partition of one). The mapping of extents to
partitions is stored in each partition's header page in the tablespace
tablespace (an internal pseudo table that begins at the beginning of each
dbspace) and since v11.70 in partition header expansion pages linked
through that partition header's next pointer.

What else do you want to know. Could someone read the data on disk if it
is not encrypted? Yes. I have multiple times been able recovered most of
the data from a crashed server whose files were too badly damaged to allow
the engine to start up. Figuring out the underlying data structure without
a schema is difficult but not impossible, especially if you have an idea of
what data you expect to see. I did a project to recover data from a
structured data file (IE a private database) for an application whose
documentation and source code had been lost back in 1983 using only "C" and
a three month old report produced before the application started to fail to
run.

Art

Art S. Kagel, President and Principal Consultant
ASK Database Management
www.askdbmgt.com

Blog: http://informix-myview.blogspot.com/

Disclaimer: Please keep in mind that my own opinions are my own opinions
and do not reflect on the IIUG, nor any other organization with which I am
associated either explicitly, implicitly, or by inference. Neither do
those opinions reflect those of other individuals affiliated with any
entity with which I am affiliated nor those of the entities themselves.

On Fri, Feb 13, 2015 at 11:03 AM, Rubinstein, James <JRUBIN@midwestern.edu>
wrote:

> Thanks. I have read a bit about Vormetric. Just at a very high level,
> without
> something like this, how does Informix store its data in the
> dbspace/chunks?
> I'd assume it is in some proprietary format. Can anyone provide a very high
> level description of how Informix stores data and any risks if data is not
> encrypted on disk.
>
> -----Original Message-----
> From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Paul
> Watson
> Sent: Friday, February 13, 2015 8:49 AM
> To: ids@iiug.org
> Subject: RE: Data Encryption [34658]
>
> I have customers using Vormetric - I think it does what you are asking
>
> Cheers
> Paul
>
> > -----Original Message-----
> > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of
> > Rubinstein, James
> > Sent: Friday, February 13, 2015 9:41 AM
> > To: ids@iiug.org
> > Subject: Data Encryption [34657]
> >
> > With the recent rash of data breaches in the news, I'm doing some high
> level
> > research for a presentation on data protection. I know that Informix
> supports
> > network data encryption, column level encryption, and requires certain
> > permissions on $INFORMIXDIR and the chunk files. However, I'm
> > wondering about encryption/protection on the chunk files other than OS
> > level security. On
> the
> > Oracle site, I read this:
> >
> > Oracle Database 11g uses authentication, authorization, and auditing
> > mechanisms to secure data in the database, but not in the operating
> > system data files where data is stored. To protect these data files,
> > Oracle
> Database
> > provides transparent data encryption. This feature enables you to
> > protect sensitive data in database columns stored in operating system
> > files by encrypting it. Then, to prevent unauthorized decryption, it
> > stores
> encryption
> > keys in a security module external to the database.
> >
> > Is there an equivalent to Transparent Data Encryption for Informix
> > databases?
> > I realize that with many of the recent data breaches, the hackers had
> > root/admin level access to the system and encryption probably wouldn't
> > have helped, but I'm trying to understand whether Informix dbspaces
> > and chunks are protected at the OS level assuming someone had access
> > to the disk, but not credentials for the database.
> >
> >
> > **********************************************************
> > *********************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
>
> *******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
>
> *******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>

--001a11c36b6893636f050efaa978

Messages In This Thread

• Data Encryption
  Rubinstein, James -- Friday, 13 February 2015, at 10:40 a.m.
  • RE: Data Encryption
    Paul Watson -- Friday, 13 February 2015, at 10:48 a.m.
    • RE: Data Encryption
      Rubinstein, James -- Friday, 13 February 2015, at 11:03 a.m.
      • RE: Data Encryption
        Paul Watson -- Friday, 13 February 2015, at 11:21 a.m.
      • Re: Data Encryption
        Art Kagel -- Friday, 13 February 2015, at 11:26 a.m.
  • Re: Data Encryption
    Art Kagel -- Friday, 13 February 2015, at 10:59 a.m.
  • Re: Data Encryption
    Fernando Nunes -- Friday, 13 February 2015, at 3:27 p.m.
    • RE: Data Encryption
      Rubinstein, James -- Friday, 13 February 2015, at 5:54 p.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.