AS2, AS3, and AS4 Transfers

AS2 (Applicability Statement 2) is a popular protocol specification for transporting critical data securely and reliably over the internet.

Upgraded from the original protocol (AS1) that was created in the 1990s, the AS2 protocol supports the encryption of messages (also known as AS2 messages) that are then exchanged with trading partners and vendors via HTTPS. These messages are built using the S/MIME format.

The AS2 connection helps ease and secure the exchange of data between trading partners.

The messages sent via AS2 are sent over an SSL tunnel, making AS2 a very secure option for transferring files. In addition, with MDNs, AS2 helps ensure messages are delivered as intended. The protocol also helps meet compliance requirements as it uses signed receipts and compares them to the returned message checksum value for a non-repudiation of receipt (NRR). This is considered legal proof of delivery.

GoAnywhere supports AS2 connections by:

• Enforcing strong end-to-end encryption: GoAnywhere automatically encrypts messages and also applies a digital signature via private key.
• Secure transmission: AS2 messages are sent securely over an SSL tunnel.
• Automated message processing: With GoAnywhere, once a file is received, Advanced Workflows can continue processing the message as determined by the admin.
• Error handling: MFT can ensure you know about any message fails before your recipient; can auto-retry; and send other alerts according rules set by the admin.
• Receipt confirmation: MFT returns an MDN to confirm receipt of messages (whether successful, or if transmission failed)

Using the AS2 protocol comes with unique advantages that ensure the streamlining of critical data exchange. These advantages include end-to-end encryption, strong authentication of senders and recipients through the use of digital signatures, and validation of file integrity with successful transfer confirmation.

AS2 is a secure industry standard protocol for sending sensitive data. Organizations who use AS2 often choose it over other file transfer protocols (like FTP or SFTP) because of how easily the protocol helps them meet regulatory compliance requirements and trading partner needs.

Benefits of AS2 & AS2 Software

FTP vs AS2

Both FTP and AS2 are popular file transfer protocols and can serve organizations in distinct ways. Choosing which one is best for your business needs will depend on what level of security your data requires. First, let’s look at FTP.

File Transfer Protocol, or FTP, is the original standard network protocol used to transfer sensitive data between a client and a server on a network. It’s been around since the 1970s and is a common and simple method to transfer files for many organizations.

The FTP protocol works over a TCP/IP-based network on a client-server model and uses two separate channels: The command channel operates over port 21 and the data channel varies depending on whether the FTP connection is passive or active.

Authentication with FTP is via a username and password. However, access may also be possible without a login if the FTP server is configured to allow anonymous access. In addition, data is transmitted in plain text, which is susceptible to attacks and interception (this includes log in credentials such as passwords and usernames).

For these reasons, using more secure protocols such as AS2, FTPS and SFTP is recommended when transferring sensitive data and to protect authentication. FTP may still be fine for file transfer tasks such as website management or backups.

How FTP Differs from AS2

Authentication:

• FTP sends user credentials such as usernames and passwords as plain text and does not encrypt files within the transfer window.
• AS2 authenticates with digital certificates for a higher level of security.

Encryption

• FTP operates over its own set of ports, supporting both active and passive modes
• AS2 leverages the security features of HTTP/HTTPS.

Message receipts/non-repudiation:

• AS2 allows users to request a Message Disposition Notification (MDN), or receipt which can alert the sender that the message was received and decrypted by the intended recipient. This can serve as legal proof that the file sent was received without alteration.
• FTP does not have MDN capabilities.

Digital Signatures:

• AS2 provides digital signatures to help ensure data integrity and authenticity.
• FTP does not use digital signatures.

Communication channels:

• FTP channels are unencrypted, leaving data open and vulnerable to interception.
• AS2 channels are encrypted to keep sensitive data protected.

Compliance:

• FTP lacks encryption functionality so cannot meet compliance requirements.
• AS2 uses encryption such as AS2, which many regulatory bodies require. In addition, as AS2 can deliver acknowledgements and receipts, it helps satisfy auditing and tracking requirements.

Automation:

• GoAnywhere MFT can execute the same automation tasks for both FTP and AS2, as well as for other protocols. Automation can be used for tasks such as monitoring for new files then sending them automatically with the chosen protocol.

In general, while FTP may have been around for a long time and is a simple protocol to use, the more secure options of FTPS and SFTP as well as AS2 offer more protection to sensitive data.

GoAnywhere MFT provides a browser-based interface for configuring and monitoring AS2, AS3, and AS4 protocol file transfers and workflows. Each administrator can be assigned different permissions in GoAnywhere with their own custom dashboards.

• Configure AS2/AS3/AS4 file transfers and workflows using graphical wizards
• Set up AS2/AS3/AS4 trading partners quickly
• Easily create, import, and export X.509 certificates with AS2/AS3/AS4 certificate exchange
• Receive automatic status alerts on AS2/AS3/AS4 transfers
• View AS2/AS3/AS4 audit logs and analytical information
• Exchange sensitive EDI and EDI X12 files with AS2/AS3/AS4 trading partners

Learn more about the GoAnywhere MFT Administrator >

AS2 Client Software Features

Drummond Certified is a label that the Drummond Group (a third-party certification body) gives to products and solutions that have proven their interoperability between AS2 vendors. The certification is extensive and helps ensure that the solution you use will allow you to successfully integrate with your AS2 trading partners.

In order to pass the Drummond Certification process, any product attempting certification must conduct thousands of AS2 protocol test scenarios successfully in the Drummond Group's controlled, vendor-neutral environment. This process uses full matrix interoperability testing between AS2 vendor solutions to verify that important transactions maintain their security and integrity as they are transmitted over the Internet.

GoAnywhere MFT v7.3.1 is Drummond-certified for AS2 and meets the standards of Applicability Statement 2 (AS2) as a secure and widely adopted method for exchanging EDI documents with trading partners. Drummond Certification for AS2 helps ensure compliance and compatibility with other AS2 solutions through extensive interoperability testing. GoAnywhere is also certified for SHA-2, Multiple Attachments, Filename Preservation, and Chunked Transfer Encoding with AS2.

AS3 (Applicability Statement 3) is a standard used to securely transmit virtually any file type. It was originally created to transfer structured data files, like XML and EDI documents, for business-to-business data sent over FTP(S). These messages are structured using the standard S/MIME format.

When and Why to Use AS3

AS3 is a secure protocol for sending sensitive data. Organizations using AS3 often choose it over other common file transfer protocols (like FTP or SFTP) because it simplifies the process to meet compliance requirements and trading partner needs.

Users can request MDNs (Message Disposition Notifications), or receipts to verify that the intended AS3 message as received, either as signed or unsigned.

Benefits of AS3

While AS2 is a transfer protocol, AS3 is a message standard that focuses on message formatting. Where the AS2 protocol requires a dedicated AS2 server and client to send messages, AS3 is flexible: once an AS3 message is composed, it can be transmitted via any other protocol – FTP, SFTP, HTTPS, and more – as long as both the sender and recipient can access the message’s location. Also unlike AS2, AS3 is a push-pull protocol and does not require an ongoing connection.

Keep reading >  

AS4 is a popular file transfer protocol that gives businesses the ability to securely exchange data with their partners. It builds on the foundations set by AS2 to improve security, reliability, and flexibility for delivering and receiving messages. As a Business-to-Business standard, AS4 makes exchanging documents over the internet simple and secure.

How Does AS4 Work?

AS4 is payload agnostic and can also send multiple payloads in one AS4 message. Unlike AS2, AS4 is based on SOAP and Web Services, which many organizations use, making it more compatible with standard environments.

Why Use AS4?

AS4 is a secure B2B and B2C method for exchanging data: encryption, large file transfers, and are managed for you with AS4. AS4 is an EDI-friendly protocol and is sometimes adopted in EDI communities to simplify EDI integration projects.

Benefits of AS4

What’s the Difference Between AS2 and AS4?

AS2 and AS4 are both popular file transfer protocols that allow businesses to exchange data securely with their business partners. AS4 builds on the best of AS2, but works with web services and provides improved delivery notifications.

Keep reading > 

What's the Difference Between AS3 and AS4?

While AS3 and AS4 may not have much in common besides their names, just what makes them so different? Discover the history of these two protocols, and how they work to improve file transfers in different ways.

Keep reading >