TeraMail File Encryption Control for TeraKey

Authentication and Administrative Control for TeraKey Users

TeraMail provides the authenticated user and administrative control interface used by the TeraKey application.

When TeraKey is running on a Windows computer, TeraMail operates within the TeraKey application frame. It verifies the user's identity with the TeraCryption service and provides TeraKey with the authenticated user, Company, Group, session, and permission information required to determine whether encryption and decryption functions can be enabled.

Logging into TeraMail does not automatically give someone the ability to use TeraKey encryption on that computer—even if that person is an authorized TeraKey user on another computer.

Book Demo

Two Different Roles — User Verification and Administrative Control

TeraMail performs two distinct functions when working with TeraKey.

For the TeraKey User

TeraMail authenticates the person using the computer and provides verified information to TeraKey as part of the authorization process for encryption and decryption.

For the TeraKey Administrator

TeraMail provides the administrative interface for creating users and Groups, assigning permissions, controlling TeraKey installation authorization, managing security options, and configuring how authorized users work with encrypted files.

How TeraMail Verifies a TeraKey User

When a user starts TeraKey, TeraMail requests the user's username and private password and verifies those credentials with the TeraCryption service.

If two-factor verification has been enabled by the administrator, TeraCryption also sends a verification code to the user's registered phone or email. After successful verification, TeraMail opens within the TeraKey application frame.

But successful TeraMail authentication is only one part of the TeraKey authorization process.

The User Must Also Match the TeraKey Installation

TeraKey verifies whether the user currently authenticated through TeraMail is the same authorized user whose credentials were established when TeraKey was installed on that computer.

If a different person signs into TeraMail, that person can still use TeraMail for authorized message communications.

TeraKey encryption and decryption, however, remain disabled.

The My TeraKey and Share Group folders also do not appear in Windows Explorer.

This remains true even if the person signing in is an authorized TeraKey user on another computer.

Being a TeraKey user does not automatically authorize a person to use TeraKey encryption on every computer where TeraKey is installed.

More Than a Username and Password

After the user has been verified, TeraMail creates a session ID that becomes part of the process used to obtain authorization to encrypt and decrypt files. TeraMail also provides TeraKey with the authenticated Company, Group, and User identification obtained from the TeraCryption service. These additional values provide another level of verification designed to prevent unauthorized or fraudulent requests from attempting to use TeraKey encryption or decryption without a valid authenticated TeraMail session.

What TeraKey Receives From the Authenticated Session

Verified User Identity

Identifies the authenticated TeraKey user.

Company Identity

Associates the user with the authorized company environment.

Group Information

Identifies the security Groups associated with the authenticated user.

Session Identification

Provides session information used as part of the authorization process for encryption and decryption.

User Permissions

Determines which TeraKey functions the authenticated user is permitted to perform.

TeraMail therefore does more than provide a login screen.

It establishes the authenticated control session used by TeraKey to determine whether its protected file functions can be made available to the user.

TeraMail Provides the TeraKey Administrator Control Console

TeraMail also provides the administrative interface used to configure the TeraKey security environment.

An administrator must successfully complete the required identity verification before TeraMail makes its security administration functions available.

Once authenticated as an administrator, TeraMail provides access to the Users and Groups administration areas used to create users, establish Groups, assign users to those Groups, and configure granular permissions governing the use of encrypted files.

Control Users and Groups

The administrator determines which users belong to which security Groups.

TeraMail provides a graphical Group-management interface that allows the administrator to assign users to Groups using drag-and-drop actions.

This allows the company's TeraKey environment to reflect departments, projects, customers, confidential work areas, or other organizational security requirements.

Control File Permissions

TeraMail provides the administrator with the user table and the permissions used to manage how authorized users work with encrypted files.

For example, the administrator can determine whether a user is permitted to become the owner of encrypted files.

The administrator therefore controls not simply who can authenticate, but the security permissions assigned to each authorized user.

Control Where TeraKey Can Be Installed

Being an authorized TeraKey user does not automatically give a person permission to install and use TeraKey on another computer.

The administrator controls TeraKey installation authorization.

For example, an employee may be authorized to install and use TeraKey on a company desktop computer but not be authorized to install TeraKey on a home computer unless the administrator specifically permits it in the user's TeraMail record.

The administrator can also control installation of TeraKey Client applications. If a TeraKey Client user uninstalls the application and later attempts to reinstall it, administrator approval can be required before the reinstallation is permitted.

User authorization and computer authorization are separate controls.

Protect Unattended TeraKey Sessions

The administrator can control whether TeraMail remains logged in after a period of mouse inactivity.

Automatic logout can be used to help prevent another person from using an authenticated TeraMail/TeraKey session when the authorized user leaves the computer unattended.

This gives the organization another administrative control over how authenticated TeraKey sessions are maintained.

Control TeraKey Cloud Storage Options

TeraMail also provides administrative control over TeraKey cloud-storage options.

Depending on the organization's configuration, the administrator can control options including:

My TeraKey Cloud Storage

Allow the My TeraKey folder to be stored in the cloud so encrypted files can be restored if the local folder is lost or becomes unavailable.

Shared Group Cloud Storage

Store shared encrypted files in cloud-based Group folders.

Previous Encrypted File Management

Control whether previous encrypted files are moved to the trash when newer files are saved.

These options allow the administrator to configure how TeraKey users interact with the organization's authorized storage environment.

TeraMail Connects Identity, Permissions and TeraKey

TeraMail for TeraKey brings user authentication and administrative security controls together within the TeraKey environment.

For the user, TeraMail establishes the authenticated session and provides the verified identity, Company, Group, session, and permission information used by TeraKey.

For the administrator, TeraMail provides the control interface for managing users, Groups, permissions, installation authorization, session behavior, and storage options.

The result is a clear separation between three things:

Being able to log into TeraMail.
Being authorized to use TeraKey on a particular computer.
Being permitted to perform specific TeraKey functions.

Only when the required identity and authorization conditions are satisfied are the corresponding TeraKey functions made available.