 |
|
SciFinder, Security, and the Internet
SciFinder Security and ConnectivitySciFinder is currently available in two versions, using different Internet connections and modes of security.
Web Version of SciFinderThe Web Version of SciFinder, released in early 2008, uses a web browser interface to application servers in a highly secure data center at CAS. All communications between the browser and the data center use HTTPS / SSL with the default Port 443. All communication is with a single socket - https://scifinder.cas.org Full-text linking via CAS Full Text Options uses HTTP with the default Port 80, just as in the client version.
Client Version of SciFinder - SciFinder 2007SciFinder is a TCP/IP (Transmission Control Protocol/Internet Protocol) client/server product that uses the Z39.50 communications protocol. TCP/IP is the communications mechanism used by Internet computers. Z39.50 is an application-level information search and retrieval protocol used primarily by on-line services. The registered port for Z39.50 is Port 210. Common security-related questions that you might have regarding SciFinder include: How secure is SciFinder through my company's firewall? It is recognized that any communications passing through a firewall is a potential concern to the organization behind the firewall, so SciFinder has been designed to be firewall-secure: A network attack in which a "bad" computer is configured to masquerade as a "good" computer is called IP spoofing. For a spoof to be successful, a rogue computer must be able to convince clients that it is the target (good) computer. The more customized a network service is, the more difficult it is to spoof. For this reason, IP spoofing attacks have always targeted general network services such as "telnet", and not highly unique services such as the Z39.50 protocol which is used by the SciFinder client and server for application level communications. Additionally, the goal of a spoof is to attack a computer by exploiting network "trust" in a client/server relationship. ("Trust" in a network context means that one side of a client/server connection implicitly trusts the other side and so does not require the other side to authenticate itself). SciFinder does not use network trust, which is why it is a poor target for a network spoof.
Are my communications private?
To enhance data confidentiality, SciFinder never sends plain-text ASCII data. All network communications are encoded using BER (Basic Encoding Rules). BER performs a translation ("scrambling") of data. Both sides of a SciFinder client/server connection BER-encode their data just prior to sending it. The receiving side decodes the data by inverting the translation.
More information about the Z39.50 protocol is available at its Maintenance Agency Home Page at the Library of Congress:
http://lcweb.loc.gov/z3950/agency
SciFinder BLAST searching launches client software written in SUN Java. The client - server communications use HTTPS (SSL) with 128 bit encryption via Port 443.
CAS offers Business to Business VPN connections for companies wishing to increase the security of their Internet connection to CAS. SciFinder Sales Representatives can provide additional information or contact CAS Customer Care. The Business to Business VPN will require a VPN gateway at your company Internet interface compatible with the CAS CISCO VPN concentrator. The CAS networking and security staff will coordinate setup of the VPN tunnel with your IT staff.
|
