NNMi Data Encryption

NNMi incorporates data encryption in many areas of the product. For example:

• Application failover encrypts messages sent between cluster nodes.
• NNMi stores passwords for user accounts in the NNMi database in encrypted form.
• Global Network Management (GNM) encrypts messages sent between regional managers and the global manager.

NNMi uses a method of data encryption that spans several NNMi components. NNMi data encryption supports the following encryption types:

• symmetric encryption—both parties share the same secret key
• asymmetric—public and private key encryption where each side has the other side’s public key, but they keep their own private key
• MessageDigest (hash)—one-way encryption (cannot decrypt) where arbitrarily long strings are reduced to fixed size strings

This topic describes the default security configurations for encryption and hashing within NNMi.

• A new installation of NNMi10.30 uses Federal Information Processing Standards (FIPS) 140-2-validated cryptographic module (RSA BSAFE) for encryption and key management.

  In an upgraded NNMi environment, FIPS-compliant ciphers and algorithms are automatically used for most password encryption and network communication procedures. However, some legacy ciphers and algorithms do exist in the upgraded environment that do not meet FIPS guidelines.

• During installation, NNMi generates a self-signed certificate using a 2048-bit encryption key, SHA 256, and RSA.

  Note  recommends using a CA-signed certificate instead of the self-signed certificate provided by NNMi.

• For local authentication into NNMi, NNMi uses a salted SHA-256 password hash for storing NNMi user passwords.

• For encryption of device passwords stored in the NNMi database, NNMi uses the AES 128 algorithm.