Please note that a username and password will be made available upon request. These are necessary to transfer files.

Transcription

1 Transferring Data Using Secure File Transfer Process ASU Center for Health Information and Research (CHiR) data partners can now securely electronically send their data submissions by means of Secure File Transfer Protocol (SFTP). SFTP encrypts both commands and data, preventing passwords and sensitive information from being transmitted in the clear over the network. This method of data transfer meets HIPAA security requirements and ensures security of the data being transmitted. As an added security step, we require that all data submissions are encrypted prior to transferring them via the SFTP. Our GPG keys employ 1024 bit DSA encryption. All participating CHiR data partners are given a public key which they can use to encrypt the data, but the only way to decrypt the data is with the private key, which is held in a secure location by the CHiR. This document provides instructions for installing and implementing both the GPG Encryption software as well as the WinSCP Secure FTP client. Both of these programs are freely available, and copies can be obtained by contacting CHiR, or they may be available in an archived file along with this document. Please note that a username and password will be made available upon request. These are necessary to transfer files. If you have any questions or concerns about this software or file transfer process, please contact Gevork Harootunian at or via at Gevork.Harootunian@asu.edu. Page 1 of 15

2 Step 0: Installing and configuring the encryption software 1. Install gpg4win-light exe (Gnu Privacy Assistant Encryption and key storage program), which will create a GPA shortcut on desktop 2. After installation, click on GPA shortcut icon. 3. When running the program for the first time, you will get the following message. Please click on Do it later button. (You do not need to create a private key - public key pair. CHIR will give a public key to all the data partners for file encryption.) 4. The KeyRing Editor Screen will appear. Click on the Import icon located on the tool bar. This step is to import the CHIR public key. It will not need to be repeated unless a new CHIR public key is sent to you. Page 2 of 15

3 a. Please locate the CHIR public key encryption file (this should have been sent to you by ) within your local directory by clicking on the Folders column. Choose the public key and click Ok. b. The following message will appear: c. Please click Close. At this time, you may exit out of the GPA program. Page 3 of 15

4 Step 1: Encrypting the data 1. File encryption method 1 a. Please locate the file to be encrypted in Explorer. b. Right click on the file and select: 1. GpGee a. Configure. c. Ensure that the box next to Set program path is checked and the correct path (location) of the GPG.exe file is listed (it may be blank when you first view it). The most common Windows path to GPG.exe is shown below. This step will only need to be done once. Please click Ok. Page 4 of 15

5 d. Again, locate the file to be encrypted. e. To encrypt this file, right click on the file and select: 1. GpGee a. Encrypt (PK) Page 5 of 15

6 f. Check the option box next to the Center for Health Information & Research key. Leave all default option boxes checked. Click Ok. The final encrypted file will have.gpg file extension. The encryption process is complete. Repeat step f for each file you want to encrypt with our public key. If the above encryption method doesn t work, you can encrypt a file using GPA s File Manager. 2. File encryption method 2 a. Start the GPA program. Click on the Files icon located on the tool bar of the KeyRing Editor Screen. Page 6 of 15

7 b. Click on the Open icon and locate the file to be encrypted. Select the file and click OK. Use the left pane to navigate through folders. Use the..\ to move up through folders. Page 7 of 15

8 c. The selected file will now appear in the File Manger window. Click on the Encrypt icon located on the tool bar. Page 8 of 15

9 d. Select the Center for Health Information and Research public key then click OK. e. Click on Yes when the Unknown Key message box appears. Page 9 of 15

10 f. The original and final encrypted file will appear in the File Manger screen. The encryption process is complete. Repeat the process for each file you want to encrypt with our public key. Page 10 of 15

11 Step 2: File Transfer 1. Install WinSCP382setup.exe (the SFTP program) which creates WinSCP shortcut on desktop. 2. After installation, click on WinSCP shortcut icon. The WinSCP Login screen will appear. Make sure you have highlighted Stored sessions and ASU-CHIR. 3. Click on Load button and enter username and password (username and password will be provided by CHIR upon request). Page 11 of 15

12 The following message may appear the first time after clicking on the Login button. Please click Yes. 4. WinSCP Transfer Screen. To transfer data via SFTP: a. Locate the encrypted file (.gpg file extension) from your computer / Local directory (Left side of the screen) b. Select the file, then drag and drop the file to the ASU-CHIR server / Remote Server directory (Right side of the screen) Page 12 of 15

13 c. Click Copy button to start the transfer process. ** Please do not click the Transfer on background box. ** During the transfer process, this message may appear. Please wait for few minutes before clicking on the Abort or Retry button. If the message does not disappear, the process has timed out. Please make the appropriate selection. Page 13 of 15

14 d. Transfer process has completed when your file appears on the right side, and no other messages are displayed. You may exit the program at this time it will disconnect / logout on exit. e. Please us at this time to announce that your file has been transferred. Page 14 of 15

15 Other usage notes for WinSCP To check on the progress of the file or size, click on the refresh icon above the right side of the WinSCP window. It is a good idea to check the file size (right side of the window shown above). If you know your file s size, you can confirm that the file moved to our server is finished. Do not create any folders on the server when using SFTP to transfer files. If you make a mistake in transferring a file (i.e., you transfer the wrong file), simply select it from the right side of the WinSCP window and delete it, or simply transfer the correct file. Periodically, the files you transfer to our server will move to a different location. Please do not be alarmed if your file disappears. We strongly encourage you to us after all of your files have finished transferring, telling us what files you transferred. That way, we can confirm that all of the files you sent are the ones we received. Page 15 of 15