Exchange of Data using Applicability Statement 2

If not redirected, please click here https://www.thesecuritybuddy.com/data-breaches-prevention/what-is-as2-protocol/

Applicability Statement 2 or AS2 is a specification using which data can be exchanged securely using even an unencrypted HTTP connection. It works like an envelope in which data can be embedded and transferred securely.

AS2 is suitably used for EDI transactions. EDI or Electronic Data Interchange is an electronic communication method using which two different companies or organizations can electronically exchange documents, such as purchase orders, invoices, shipping notices etc. AS2 can be used to make EDI transactions more secure.

Data Exchange using AS2

To exchange data using AS2, both the sender and the receiver need to use a communication software in their systems. Using the software, the sender first digitally signs the document, so that the document cannot be tampered with. After that, the signed document is encrypted and sent to the receiver. The encrypted document also contains a request of receipt from the receiver.

The receiver receives the signed and encrypted document. He first decrypts it and then, verifies the signature of the sender. After successful validation, a signed receipt is sent by the receiver back to the sender.

An HTTP POST is used to send the data to the receiver. The request URI identifies the process which will be used to unpack and handle the data and then to generate a reply. The receipt can be sent either with the HTTP Response body or by using a new HTTP POST operation.

So, to summarize, data exchange using AS2 typically follows the steps below :

• The sender first signs the document using his private key and then, encrypts it using S/MIME.
• The document also specifies that a signed receipt has to be sent back to the sender.
• The signed and encrypted document is then sent through an HTTP connection. Please note that, though an HTTP connection is unsecure, the document remains secured as it is signed and encrypted using strong cryptographic keys.
• The receiver receives the document and decrypts it using his private key.
• The receiver verifies the signature using the public key of the sender.
• On successful validation, the receiver creates a receipt and signs it using his private key. The signed receipt also contains the hash of the received message so that the sender can be sure that the sent document was successfully decrypted and validated by the receiver.

So, even though an HTTP connection is unsecured, secured document can be sent through it using AS2. This article just gives an overview of how data gets exchanged using AS2. Hope you liked it.