Firebird Encryption options

[mikerabat 20]

Hi Folks!

 

I hope anyone can give me some hints on this topic: Firebird Data encryption and encryption of the data sent.

Especially the "over the line" encryption of data is going to be mandatory for our next projects since there are

a few attack vectors we didn't really anticapte that this would ever be a problem: an attacker has access to an internal

network (e.g. a hospital) and reads the communication from between our program and the remote database.

 

So... data encryption ala SSL, TLS would be a great thing to have. So far the FAQ from firebird only suggest to

use an SSH tunnel or similar to connect to the database but ... is this feasable or even performant?

Has anyone any experience with such a problem or is there anything some Delphi components could do?

 

kind regards

   Mike

 

 

[Alexander Elagin 143]

Devart has a Secure Bridge suite of components to protect a database connection (https://www.devart.com/sbridge/). I have not used it but maybe you could have a look if it suits your needs. I'd rather replace a direct client-server solution with a 3-tier one, thus totally isolating the database from network access.

[mikerabat 20]

Thanks for the hint! I will definitely look into that 🙂

[Markus Kinzler 174]

Firebird 3 support over-the-wire encryption out of the box.

 

https://firebirdsql.org/file/documentation/release_notes/html/en/3_0/rnfb30-security-wirecrypt.html

[Arnaud Bouchez 407]

17 hours ago, Alexander Elagin said:

I'd rather replace a direct client-server solution with a 3-tier one, thus totally isolating the database from network access.

Switch to a n-Tier architecure is the way to go.
Keep the database locally on your server computer (or network), then use regular REST/JSON over secure HTTPS for the communication with clients.
HTTPS will be much easier to secure and scale than forcing encryption with the database driver. Certificate management is a difficult think to do - I have seen so many solutions running fine... until a certificate becomes obsolete. 😉
We usually use a nginx server as reverse proxy, with https://letsencrypt.org/ certificate management.

[mikerabat 20]

Cool thanks for the info!