Opening a File in Secure Mode

Security provides users with the ability to shield themselves from applications that are not trusted. In contrast, digital rights is the authors' mechanism for excluding use of specific applications on a protected file.

The combination of File Protection and Security can effectively deal with the conflict between legacy applications and digital rights. Problems occur when a user attempts to open a rights-restricted file when non-right-compliant applications are already loaded on the machine. MicroStation will not open the file in this situation. Secure mode is intended as a temporary way (until a rights–compliant version of the application can be obtained) to prevent these applications from loading so the file can be opened.

The user can set up MicroStation to load only digitally signed MDL applications and VBA macros by setting the MS_SECURITY_LEVEL configuration variable to MEDIUM or HIGH. The default security level is none, in which the security checking is disabled.

MS_SECURITY_LEVEL value	Description
LOW	Allows any MDL or other application to be loaded and used.
MEDIUM	Allows the loading of applications that are digitally signed by Bentley or by any software publishing certificates that are trusted. The user identifies trusted certificates in the MS_SECURITY_SPC configuration variable. MS_SECURITY_SPC contains a List of a wildcard expressions indicating where MicroStation can find the files that contain public copies of software publishing certificates that were used to digitally sign the applications that can be loaded in MEDIUM security level. These files normally have the ".cer" extension. They contain information about certificates and public keys. They do not contain private keys. For example, "c:\mycerts\.cer". The default is "$(_USTN_SITE)SPC\.cer". (MS_SECURITY_SPC).
HIGH	Only loads applications that are digitally signed by Bentley.

Note: The fact that a user trusts an application does not necessarily mean that the application is authorized for use with a given protected file.

Note: Bentley applications that are not signed as rights–compliant are unloaded when you enter a restricted file. For example, if your rights to a file excludes export, the export capabilities will be unloaded while you are in that file.