Enable Data Protection to encrypt sensitive information

Enable Data Protection in order to encrypt sensitive information such as the user names and passwords that you use to connect to databases and remote servers.

Before you begin this task, you should note the user names, passwords, and database connection strings that you have already configured in your project. You should also consider backing up your entire project, but that is not absolutely necessary.

There are many places in your project where you configure settings that can be encrypted by Data Protection. These places include but are not limited to:

• In the Email and FTP settings;

• In the project security system, to connect to a LDAP server;

• In a Trend worksheet, to connect to a Historian database;

• In an OPC UA Client worksheet, to connect to an OPC UA server;

• In the settings to run your project as a Windows service; and

• In many other worksheets and screen objects that use the Studio Database Gateway to connect to external databases. For more information, see Database Configuration.

By default, these settings always have some basic protection that is hard-coded into AVEVA Edge, so they cannot be easily intercepted over the network. The settings are not fully encrypted, however, so they might be vulnerable to serious attacks.

The Data Protection file is no longer stored in the project folder; it is stored under the user profile folder with a generic file name (no user or machine name)

• On Windows: %localappdata%\AVEVA Edge\DataProtection\{AppUUID}.dpf. When the project runs as a Windows service, the file is stored for the service account.

• On Windows: %programdata%\<product name>\DataProtection\<AppUUID>.dpf.

It is a simple procedure to enable Data Protection, but actually doing so will deeply affect your project and change how it can be used on other computers. First, all user names, passwords, and database connection strings that you have previously configured will become invalid when you enable Data Protection. You will need to configure these settings again after Data Protection is enabled. The figures below illustrate the difference between previously configured settings before (left) and after (right) Data Protection is enabled.

The first time you open a project with Data Protection on a different computer (for example, after moving the project or restoring a backup), you are prompted for the Data Protection password. If you do not enter it, the encrypted settings cannot be used and must be configured again. You can select Don't ask again to stop the prompt for that project.

Third, you must also enable Data Protection in the Studio Database Gateway that will manage your project's database connections, so that the gateway can communicate securely with the project runtime server during run time. For more information about how to do that, see Studio Database Gateway.

To enable Data Protection in your project settings:

1. On the Project tab of the ribbon, in the Settings group, click Options.

   The Project Settings dialog box is displayed with the Options tab selected.

   

2. Click Data Protection.

   The Data Protection dialog box is displayed.

   

3. By default, the Enable check box is selected..

   The Password and Confirm Password boxes are active.

4. In the Password box, type your desired Data Protection password, and then in the Confirm Password box, type it again.

   A strong password should be at least 8 characters long and include at least 1 special character, 2 alphabetic characters, and 2 numeric characters. If your password does not meet these criteria, it will be accepted but a warning message will be displayed.

   The Next button is disabled until the passwords match or Data Protection is cleared.

5. Click OK.

Data Protection is now enabled. You can disable it at any time simply by clearing the Enable check box; the Data Protection password is not required to do so. However, doing so will have different results depending on when you do it.

When you enable Data Protection, all previously configured user names, passwords, and connection strings become invalid. If you immediately disable Data Protection without making any other changes, the previously configured settings will be restored. Otherwise, you must configure the settings with new values.

In contrast, if you disable Data Protection after you have configured the settings with new values, the settings will remain encrypted and therefore unusable during run time. You will need to either configure the settings again with new values OR re-enable Data Protection with the same password, before you try to run your project.

If you ever change the Data Protection password in your project settings, you must also update the password on the target device(s) to which you download the project, as well as in the Studio Database Gateway.

Historian credentials that you enter with Use Specific User Name and Password are protected by Data Protection. The Studio Database Gateway needs the same Data Protection password. If the passwords differ, the gateway reports the error: "Invalid Data Protection configuration. Please check if the password in the Studio menu (Project->Options->Data Protection) matches with the Studio Database Gateway (File->Data Protection)."

Note: Information that has been encrypted with DPAPI cannot be decrypted without your Data Protection password. If you lose your password, neither Microsoft nor our own Technical Support representatives can recover the information for you. You will need to reconfigure all of the affected project settings.

Project Wizard

The Project Wizard includes a Data Protection option, which is selected by default. Type a password in Password and again in Confirm Password. You cannot continue until the passwords match or you clear the option.

When Data Protection is enabled (the default), user names, passwords, and connection strings stored in the project (including database, Historian, OPC, email, FTP, and LDAP settings) are encrypted with your Data Protection password.

The Data Protection information is stored in the profile of the Windows user, not in the project folder. When the project runs as a Windows service, it is stored for the service account.

Opening the project on another computer

The first time you open a project with Data Protection on a different computer (for example, after moving the project or restoring a backup), you are prompted for the Data Protection password. If you do not enter it, the encrypted settings cannot be used and must be configured again. You can select Don't ask again to stop the prompt for that project.

Projects from earlier versions

When a project created in a previous version is opened with Data Protection disabled, the user is notified about the importance of enabling it and can enable it. Data Protection files that earlier versions stored in the project folder are removed automatically.

Studio Database Gateway

Enable Data Protection in the Gateway with the same password as the project. If the passwords are different, the Gateway cannot connect.

Linux (IoT View)

When Data Protection is enabled, Remote Management sends the Data Protection secret to the target device and Remote Agent stores it under the user folder, protected with symmetric encryption and restrictive permissions.

• On Linux: $HOME/.iotview/dataprotection/<AppUUID>.dpf