The Transact encryption framework has the following key features.

• Every application is identified by a unique Key.

• All the data persisted in HOCR.xml, Batch.xml and index files is stored on disk in encrypted form to avoid any unauthorized access of critical data while processing.

• All the learned samples and learned index files are re-generated whenever there is a change in the encryption algorithm.

• Any change in Batch Class Key without changing the encryption algorithm does not affect the learned files and thus they are not regenerated in such a case.

• Batch Class can be imported using the existing Keys as well as by generating the new key from UI.

• Only authorized user is able to decrypt the encrypted Batch.xml file using web service API. An authorized user is one who belongs to the groups/roles assigned to the batch class on which batches are processed.

• No Batch can be decrypted on an application other than the application on which it was processed.

• Only a super admin can change the encryption key of a batch class.

• Application Key should be generated before applying the encryption algorithm on a batch class.

• The user needs to make a change in the Scripting plugin for the plugin execution.

Keys are generated using Hashing algorithm on the data available for generating Keys.

The AES algorithm is the backbone of the Transact Encryption framework and it is used to encrypt and decrypt the data. Super admin has flexibility to choose the AES-128 or AES-256 bit algorithm. Transact employs the AES-256 cipher, which is an NSA Type 1 approved algorithm (suitable for classified national security information).

The application level key concept is very similar to a digital signature or a digital certificate which uniquely identifies an application/entity/organization/individual. The application level key in Transact identifies an application belonging to a customer uniquely.

The Key (identity) provided for application key is used as a secure password for all the key stores generated throughout the process. The application level key is responsible for validating that the keys/keystores used throughout the application belong to a particular application. Keys/keystores belonging to a particular application will not work on any other unauthorized application.

This key is also responsible for authentication during the Batch XML decryption, which does not allow the Batch XML to decrypt outside the authorized application (unauthorized applications cannot decrypt Batch XML belonging to some other application).

To recover the data in case the application key is lost, it is recommended that a user should store the application key file in a secure storage device. It is also recommended to secure the keystore file unique password (key_password) from the encryption_key_metdata table from the DB.