Ingrian Adds SQL Server Support to Cryptographic Appliance

by Alex Woodie

Windows shops looking to secure important data in their SQL Server databases can now use Ingrian Networks' rack-mountable encryption appliances. Ingrian this week announced that its line of DataSecure devices can now read data from Microsoft's SQL Server 2000 database, giving Ingrian full coverage of the three most popular relational database management systems, which also include IBM DB2 and Oracle 9i.

Companies in a variety of industries are dealing with security concerns on multiple levels. Well-publicized holes in operating systems and applications, the increased presence of hackers, viruses, and malware on the Internet, and federal mandates like HIPAA, Sarbanes-Oxley, and the Gramm-Leach-Bliley Act, are combining to focus the attention of administrators and CIOs on security like never before.

With this growing awareness of the security (or lack thereof) of corporate IT systems, Ingrian is hoping to grab a piece of the market for encryption solutions, which is just one component of a good security program, albeit an important one. In 2002, just two years after its founding, the Redwood City, California, company switched its focus to internal corporate security from selling encryption solutions for e-commerce sites, which was booming in 2000, before the bottom fell out of the "new" economy.

Companies with large amounts of data to encrypt, or those with data that needs to be encrypted and spread across a number of different systems, can use Ingrian's flagship offering, the DataSecure Platform, to offload encryption work and keep the primary server from bogging down under processor-intensive cryptographic loads. The devices, all of which include dual Intel Xeon processors and a hardened version of the Linux operating system, also provide centralized key management and authentication. The DataSecure encryption software and engine are written in C.

The DataSecure devices are capable of encrypting data at three different levels: the application, Web server, or database layers. The devices accomplish this by installing connectors into the target product, which intercept calls for data that needs to be encrypted. Before the piece of data, such as a credit card number or Social Security number, is sent to the application or database, the data is first routed through the DataSecure device, which routes the data back to the target platform after it has been encrypted. In addition to improved performance of the target application, offloading encryption means that encryption keys never leave the DataSecure device, which improves security.

Most of Ingrian's customers choose to encrypt their data at the database layer, because this technique requires less risk and affords more flexibility, says Derek Tumulak, director of product marketing. "If you perform encryption at the database layer, the big plus is ease of integration," he says. "If you implement at the database layer, there are no application server or code changes, and no programming at the application or the Web server layer." The only potential modifications required when implementing DataSecure at the database layer are changes made to stored procedures, says Tumulak, who was an engineer with Ingrian before going into marketing.

Ingrian offers four DataSecure devices in two main flavors: one that supports the Federal Information Processing Standard (FIPS) and one that doesn't. All models support multiple methods of encryption, including support for Data Encryption Standard (DES) and the Advanced Encryption Standard (AES). Each device can support multiple instances of databases, including dissimilar relational database management systems.

In the entry-level category is the i211, which comes with a Xeon-based ASIC architecture, 2 GB of RAM, and the capability to process up to 2,000 cryptographic operations per second. A step from the i211 is the i221, which is based on the i211 but adds dual power supplies and fans, automatic failover, and a Gigabit Ethernet interface for added throughput.

The DataSecure devices that are FIPS-compliant include an additional hardware security module for private and public encryption key management. FIPS compliance ensures that cryptographic keys will be destroyed in the event that they ever leave the DataSecure box. In this category, Ingrian offers the i215, which has all the features of the i211, in addition to FIPS 140-2 Level 3 compliance, and it only processes 600 cryptographic operations per second. The Ingrian i225 offers the same redundancy features as the i225, with the addition of the FIPS 140-2 Level 3 compliant hardware security module. The i225 also processes in the 600 cryptographic operations-per-second range.

Ingrian prices its DataSecure devices based on the number of servers its box attaches to and the type of workload the box is doing, in addition to the appliance itself. Pricing for the DataSecure appliance starts at $32,500. For application-server connections, Ingrian charges an additional $10,000, while database attachments cost another $60,000. Most of Ingrian's customers choose to implement redundant DataSecure devices, and the total price tag is typically in the $150,000 to $200,000 range, company officials say. For more information, go to www.ingrian.com.