Transferring Data Using Secure File Transfer Process
ASU Center for Health Information and Research (CHiR) data partners can now securely electronically send their data submissions by means of Secure File Transfer Protocol (SFTP).
SFTP encrypts both commands and data, preventing passwords and sensitive information from being transmitted in the clear over the network. This method of data transfer meets HIPAA security requirements and ensures security of the data being transmitted.
As an added security step, we require that all data submissions are encrypted prior to transferring them via the SFTP. Our GPG keys employ 1024 bit DSA encryption. All participating CHiR data partners are given a public key which they can use to encrypt the data, but the only way to decrypt the data is with the private key, which is held in a secure location by the CHiR.
This document provides instructions for installing and implementing both the GPG
Encryption software as well as the WinSCP Secure FTP client. Both of these programs are freely available, and copies can be obtained by contacting CHiR, or they may be available in an archived file along with this document.
Please note that a username and password will be made available upon request. These are necessary to transfer files.
If you have any questions or concerns about this software or file transfer process, please contact Gevork Harootunian at 602.496.2008 or via email at
Step 0: Installing and configuring the encryption software
1. Install gpg4win-light-1.0.9.exe (Gnu Privacy Assistant – Encryption and key storage program), which will create a GPA shortcut on desktop
2. After installation, click on GPA shortcut icon.
3. When running the program for the first time, you will get the following message. Please click on “Do it later” button. (You do not need to create a private key - public key pair. CHIR will give a public key to all the data partners for file encryption.)
4. The KeyRing Editor Screen will appear. Click on the “Import” icon located on the tool bar. This step is to import the CHIR public key. It will not need to be
repeated unless a new CHIR public key is sent to you.
a. Please locate the CHIR public key encryption file (this should have been sent to you by e-mail) within your local directory by clicking on the
“Folders” column. Choose the public key and click “Ok”.
b. The following message will appear:
Step 1: Encrypting the data 1. File encryption – method 1
a. Please locate the file to be encrypted in Explorer. b. Right click on the file and select:
1. GpGee
a. Configure.
c. Ensure that the box next to “Set program path” is checked and the correct path (location) of the GPG.exe file is listed (it may be blank when you first view it). The most common Windows path to GPG.exe is shown below. This step will only need to be done once. Please click Ok.
d. Again, locate the file to be encrypted.
e. To encrypt this file, right click on the file and select:
1. GpGee
f. Check the option box next to the Center for Health Information & Research key. Leave all default option boxes checked. Click “Ok”.
The final encrypted file will have .gpg file extension. The encryption process is complete.
Repeat step f for each file you want to encrypt with our public key.
If the above encryption method doesn’t work, you can encrypt a file using GPA’s File Manager.
2. File encryption – method 2
a. Start the GPA program. Click on the “Files” icon located on the tool bar of the KeyRing Editor Screen.
b. Click on the “Open” icon and locate the file to be encrypted. Select the file and click “OK”. Use the left pane to navigate through folders. Use the ..\ to move up through folders.
c. The selected file will now appear in the File Manger window. Click on the “Encrypt” icon located on the tool bar.
d. Select the Center for Health Information and Research public key then click “OK”.
f. The original and final encrypted file will appear in the File Manger screen. The encryption process is complete. Repeat the process for each file you want to encrypt with our public key.
Step 2: File Transfer
1. Install WinSCP382setup.exe (the SFTP program) which creates WinSCP shortcut on desktop.
2. After installation, click on WinSCP shortcut icon. The WinSCP Login screen will appear. Make sure you have highlighted Stored sessions and ASU-CHIR.
3. Click on “Load” button and enter username and password (username and password will be provided by CHIR upon request).
The following message may appear the first time after clicking on the “Login” button. Please click “Yes.”
4. WinSCP Transfer Screen. To transfer data via SFTP:
a. Locate the encrypted file (.gpg file extension) from your computer / Local directory (Left side of the screen)
b. Select the file, then drag and drop the file to the ASU-CHIR server / Remote Server directory (Right side of the screen)
c. Click “Copy” button to start the transfer process. ** Please do not click the “Transfer on background” box. **
During the transfer process, this message may appear. Please wait for few minutes before clicking on the “Abort” or “Retry” button. If the message does not disappear, the process has timed out. Please make the appropriate selection.
d. Transfer process has completed when your file appears on the right side, and no other messages are displayed. You may exit the program at this time – it will disconnect / logout on exit.
e. Please e-mail us at this time to announce that your file has been transferred.
Other usage notes for WinSCP
• To check on the progress of the file or size, click on the “refresh” icon above the right side of the WinSCP window.
• It is a good idea to check the file size (right side of the window shown above). If you know your file’s size, you can confirm that the file moved to our server is finished. • Do not create any folders on the server when using SFTP to transfer files.
• If you make a mistake in transferring a file (i.e., you transfer the wrong file), simply select it from the right side of the WinSCP window and delete it, or simply transfer the correct file.
• Periodically, the files you transfer to our server will move to a different location. Please do not be alarmed if your file “disappears.”
• We strongly encourage you to e-mail us after all of your files have finished
transferring, telling us what files you transferred. That way, we can confirm that all of the files you sent are the ones we received.
