Data encryption is used to protect data during transmission and storage. As it enhances data security it is strongly recommended to be used, but since unencrypting and re-encrypting data impacts performance it is possible to elect to not use it if the data being processed does not contain sensitive information and the fastest possible processing is required. The impact on performance depends on the file type, key provider, and volume of data being processed.
Aperture Data Studio supports encrypting exported data files and decrypting imported data files as well as encrypting secrets such as credentials and batches of dataset data elected to be stored within the application, known as data-at-rest.
{tabs}
The supported encrypted file types are:
File encryption (previously referred to as encryption keys) is used for decrypting encrypted source files and encrypting exported files.
Additionally, Aperture Data Studio supports file encryption key management. File encryption keys can be assigned to specific users or roles through RBAC. Users with this capability are able to save, export, and import file encryption keys in a secured manner.
Aperture Data Studio supports password-based encryption for Advanced Encryption Standard (AES) encrypted files.
AES is a symmetric-key algorithm where the same key is used to encrypt and decrypt data.
There is an optional salt value to turn a password into a secret key. Salt is a random value that is used as an additional input to a one-way function that hashes a password.
Data Studio can load data from password-protected Excel (.XLS and .XLSX) files. The files can be protected using an encryption facility based on a specified password. In order to extract the original content from Excel files, the correct password has to be provided.
Aperture Data Studio supports public key encryptions for GNU Privacy Guard (GPG) encrypted files.
GPG is a key-based encryption method which utilizes two cryptographic keys; a public key to encrypt a file and a corresponding private key to decrypt it.
When generating a GPG key pair, a passphrase has to be specified. This is required by the private key; only an authorized user with knowledge of the passphrase can use the private key. This provides a two-layer protection against unauthorized access to the contents of the encrypted file.
Aperture Data Studio also supports GPG digital signatures to ensure file authenticity and integrity. By enabling Verify signature, you can confirm that a file has been signed by a trusted source. To perform this verification, provide the Signature verification public key of the signer. If it is left empty or when verification fails, the system will automatically attempt to extract the public key from the private key.
Aperture Data Studio supports public key encryption for Pretty Good Privacy (PGP) encrypted files.
PGP is a key-based encryption method which utilizes two cryptographic keys; a public key to encrypt a file and a corresponding private key to decrypt it.
When generating a PGP key pair, a passphrase has to be specified. This is required by the private key; only an authorized user with knowledge of the passphrase can use the private key. This provides a two-layer protection against unauthorized access to the contents of the encrypted file.
Aperture Data Studio also supports PGP digital signatures to ensure file authenticity and integrity. By enabling Verify signature, you can confirm that a file has been signed by a trusted source. To perform this verification, provide the Signature verification public key of the signer. If it is left empty or when verification fails, the system will automatically attempt to extract the public key from the private key.
To manage file encryption operations, ensure that:
To create a file encryption key:
To edit a file encryption key:
When importing or exporting any encrypted files, a valid file encryption key is required to ensure that the operation is permitted for the user.
File encryption keys can be pinned to a particular usage in Datasets or Workflows, so that the same file encryption key is used consistently.
When adding a Dataset from an encrypted file, you will need to select an existing file encryption key or enter a new file encryption key to be associated with the Dataset. The file encryption keys available for selection are only those that your user has permission to use.
Once set, this file encryption key will be used whenever the Dataset is refreshed by any user, even for those with no direct permission to access the file encryption key.
File encryption keys are available in different Spaces within the same Environment.
To upload a locally stored encrypted file:
When exporting records using the Export step in the Workflow designer, specify the file encryption key to be used to encrypt the output file. You can also set the required encryption type for the exported file.
Other users with access to the Space can also modify the file encryption key used in the Export step. Once the key has been set, it will be used whenever the Workflow is executed (or scheduled for execution), so will be also accessible to users with no direct permissions to access the file encryption key.
You can also export encrypted files to an external system in the same way. Find out how to export data to an External system.
