Security
Security model
Riversoft® STCP Gemini applies managed file transfer (MFT) controls to OFTP exchanges: only authenticated partners exchange files, data travels encrypted, every connection and file is validated against the user’s rules, delivery is confirmed and everything is recorded. Security is organized in layers:
| Layer | How Riversoft STCP Gemini protects |
|---|---|
| Transport | OFTP 2.0 with TLS 1.2 or TLS 1.3; OFTP 1.x can also run over TLS. The Riversoft STCP Gemini API and the Riversoft Console Portal are accessed over HTTPS. See TLS. |
| Partner authentication | Each partner identifies itself with the OFTP credentials registered for the user, and the connection is rejected if the authentication mode or connection mode does not match the configuration. In OFTP 2.0, authentication can use digital certificates. |
| File protection | In OFTP 2.0, files can be encrypted, signed and compressed, with symmetric and asymmetric encryption. Integration with external data protection solutions, such as PGP, GPG and Voltage, is also available. See OFTP. |
| Delivery confirmation | The receiver confirms each file with EERP or refuses it with NERP, giving the reason; confirmations are recorded. |
| Restart | An interrupted transfer resumes from where it stopped, without resending the whole file. |
| Access rules | Each connection and each file is validated against the user’s rules: user lock, connection and session time limits, instance session limit, name and size filters and time window. |
| Management | The Riversoft Console Portal supports SSO and MFA, and the Riversoft STCP Gemini API uses access tokens. See Access and identity. |
| Configuration | Database passwords, keys and secrets are kept in configuration files with access restricted to the service user and group. |
| Traceability | Every session and transfer is recorded with user, direction, file, size, time, hash and result. See Monitoring and auditing. |
Riversoft STCP Gemini transfers files only over the OFTP protocol (OFTP 1.x and OFTP 2.0). Security for the other protocols and connectors, such as SFTP and AS2, is described in Riversoft STCP DirectLink security.
TLS 1.2 and TLS 1.3
TLS (Transport Layer Security) protects OFTP connections and access to the Riversoft STCP Gemini API and the Riversoft Console Portal. TLS 1.2 and TLS 1.3 are supported, with configurable cipher suites and security policies.
| Purpose | Algorithms |
|---|---|
| Authenticity | RSA, ECDSA, EdDSA (Ed25519) |
| Confidentiality | AES-GCM 128/256, ChaCha20-Poly1305 |
| Integrity | SHA-256, SHA-384, SHA-512 |
OFTP 1.x and OFTP 2.0
OFTP 2.0 has its own security mechanisms. OFTP 1.x has no built-in encryption; in Riversoft STCP Gemini, it can run over TLS to protect the connection. Whenever the partner allows it, prefer OFTP 2.0.
In OFTP 2.0, protection includes symmetric and asymmetric encryption, digital certificates, compression, configurable cipher suites and security policies.
| Purpose | Algorithms |
|---|---|
| Authenticity | RSA, ECDSA, EdDSA (Ed25519) |
| Confidentiality | AES-128, AES-256 |
| Integrity | SHA-256, SHA-384, SHA-512 |
Note
Algorithm availability and configuration vary according to the protocol version, the product version and the environment’s security policies.
Access and identity
The features below apply to management: the Riversoft Console Portal and the Riversoft STCP Gemini API.
Single Sign-On
The Riversoft Console Portal supports Single Sign-On (SSO) with corporate identity providers, such as Microsoft Entra ID, Okta, Google, Keycloak, AWS Cognito and other compatible providers. With SSO, operator authentication is centralized in the organization’s provider.
Protocols supported for sign-in: SAML 2.0, OAuth 2.0 and LDAP. JWT providers are used by Riversoft STCP DirectLink for token exchange and do not appear in the Riversoft Console Portal sign-in.
Access tokens
The Riversoft Console Portal and the Riversoft STCP Gemini API use JWT (JSON Web Token) to represent authorizations. Tokens are valid for 60 minutes by default (adjustable in session_duration, up to 720 minutes) and control access to resources according to the permissions of the authenticated operator’s groups. See Riversoft STCP Gemini API authentication.
Multi-factor authentication
The Riversoft Console Portal and the Riversoft STCP Gemini API have their own two-factor authentication (2FA), with a TOTP code generated in an authenticator app (such as Microsoft Authenticator and Google Authenticator). 2FA is enabled in the API registration (API/Supervision). At the first sign-in, the operator registers the account in the app with the QR code shown.
Note
With SSO, the identity provider may require other factors, according to the organization’s policies.
The password policies, also set in the API registration, control minimum length, complexity, validity, password history and the number of failures before the operator is locked.
Access control
Integration with corporate identity mechanisms makes it possible to apply centralized authentication and authorization policies. Define operators, groups, permissions and access policies according to the organization’s security rules.
Transfer user authentication
Transfer users are authenticated by the Riversoft STCP Gemini Server instance. The settings are in the instance registration, in the authentication section:
| Feature | Options |
|---|---|
| Authentication type | Operating system, STCP (native), RSA SecurID or LDAP. |
| Multi-factor authentication | Disabled, authenticator app (TOTP), code by email or code by SMS. It can be disabled for a specific user. |
| Password policies | Minimum length, complexity (lowercase and uppercase letters, digits and symbols), validity, password history and number of failures before locking. |
Password encryption key
Passwords stored in the configuration database are encrypted with a key that must be the same in all modules of the environment. See how to set the key and what to do to change it in Configuration: password encryption key.
Best practices
- Change the default password of the administrator operator (
stcpadmin) on first access to the Portal. - Enable TLS on the Riversoft STCP Gemini API (
ssl: true) with a valid certificate. - Use the same strong, private encryption key in
ApplConfigPassPhrase,applConfigPassPhraseandapi_secret. See Password encryption key. - Restrict access to the configuration files to the service user and group.
- Use OFTP 2.0 with TLS 1.3 and modern cipher suites in partner connections; with OFTP 1.x, use TLS.
- Integrate access with the corporate identity provider and enable MFA.