Siebel Security Guide > Communications and Data Encryption >

About Configuring Encryption for Web Clients

This topic describes the encryption options available for Web client communications. To use encryption, both the server and the client must enforce encryption in their connection parameters. If these parameters do not match, then connection errors occur.

Siebel Business Applications support the following types of clients:

• Siebel Web Client. This client runs in a standard browser from the client computer and does not require any additional persistent software installed on the client. Encryption settings you make to the SWSE or Siebel Server are automatically recognized by this Web client.

  Siebel Business Applications support the use of the SSL or TLS capabilities of supported Web servers to secure communications between the Siebel Web Client and the Web server. For information on configuring Siebel Business Applications to specify whether or not URLs must use SSL or TLS over HTTP (HTTPS protocol) to access views in a Siebel application, see Configuring a Siebel Web Client to Use HTTPS.

• Siebel Mobile Web Client. This client is designed for local data access, without having to be connected to a server. Periodically, the client must access the Siebel Remote server using a modem, WAN, LAN or other network to synchronize data. You can use either MSCRYPTO or RSA encryption for Mobile Web Client synchronization.

  For information on setting encryption for transmissions between Mobile Web Client and Siebel Remote server, see Configuring Encryption for Mobile Web Client Synchronization. See also Siebel Remote and Replication Manager Administration Guide.

• Siebel Developer Web Client. This client connects directly to the Siebel database for all data access. It does not store any Siebel data locally. With the exception of the database, all layers of the Siebel Business Applications architecture reside on the user's personal computer.

  The encryption technologies available to encrypt communications between the Siebel Developer Web Client and the Siebel database depends on the encryption methods supported by your RDBMS vendor. For information on how to configure communications encryption between the Siebel Developer Web Client and the Siebel database, contact your third-party RDBMS vendor.

• Siebel Handheld Client. This client is a streamlined version of the Siebel Mobile Web Client. Siebel Handheld clients synchronize data between the Siebel Handheld application database and the Siebel Server database. You can secure data during the synchronization process for handheld client applications using SSL or TLS. For additional information, refer to the documentation for Siebel Business Applications that use the Siebel Handheld client on Siebel Bookshelf.

About Session Cookies and Web Clients

The Application Object Manager in the Siebel Server communicates with the Siebel Web Client through the Web server using TCP/IP protocol. An independent session is established to serve incoming connection requests from each client. Siebel Business Applications use session cookies to track the session state. These session cookies persist only within the browser session and are deleted when the browser exits or the user logs off. A session cookie attaches requests and logoff operations to the user session that started at the login page.

Instead of storing the session ID in clear text in the client's browser, Siebel Business Applications create an encrypted session ID and attach an encryption key index to the encrypted session ID. Session cookie encryption uses a 56-bit key by default. In Siebel Remote, the encryption algorithm and key exchange are the same as for session-based components.