SAP HANA Client-Side Data Encryption – by the SAP HANA Academy

Introduction

As we move our data to cloud storage and cloud database services, keeping our data save and protected from unauthorized access is obviously a high priority. To support this concern, the latest SAP HANA 2.0 SPS 03 release introduced a new security feature: client-side data encryption.

Client-side data encryption enables you to encrypt and decrypt column data using an encryption key accessible only by the SAP HANA client. Without client access, the data on the server cannot be decrypted.

If you like to learn how you can configure the SAP HANA client for client-side data encryption, how you can export, import and rotate security keys, and a range of other topics, check out the video tutorials below.

YouTube Playlist

All the video tutorials on the client-side data encryption topic are bundled in a single playlist on our channel:

• https://www.youtube.com/playlist?list=PLkzo92owKnVygoKWpwy4boITfzsJCqgxw

What’s New?

In the first video, the concepts of client-side data encryption are explained.

Tutorial Video

Installation and Configuration

The SAP Common Crypto Library (libsapcrypto.so/sapcrypto.dll) and the sapgenpse(.exe) utility required for client-side encryption are included with the SAP HANA client.

For the latest version of the library, see

• SAP Downloads on the SAP ONE Support Portal – search for COMMONCRYPTOLIB

For the documentation, see

• Configuring the Client for Client-Side Encryption and LDAP

Tutorial Video

Getting Started with Client-Side Data Encryption

In the next two videos, we are going to set client-side encryption up.

For the code, see

• https://github.com/saphanaacademy/cse

For the documentation, see

• Getting Started With Client-Side Encryption
• Client-Side Data Encryption (SAP HANA Security Guide)
• Client-Side Data Encryption (SAP HANA Administration Guide)

Tutorial Video

Using DML with Client-Side Data Encryption

To insert or update data in the employees table, the business user must use prepared statements.

For the code, see

• https://github.com/saphanaacademy/cse

For the documentation, see

• Supported DML With Client-Side Encryption

Tutorial Video

Using DDL with Client-Side Data Encryption

For the code, see

• https://github.com/saphanaacademy/cse

For the documentation, see

• Change Column Encryption Status

Tutorial Video

Rotate the Column Encryption Key

Part of the client-side encryption procedure is to rotate CEKs regularly and re-encrypt your data using the most current CEK. Key copies for the new CEK must be created for users who need access to data.

For the code, see

• https://github.com/saphanaacademy/cse

For the documentation, see

• Rotate Column Encryption Key

Tutorial Video

Exporting Client Key Pairs and Column Encryption Keys

You need to export (and backup, that is, store in a safe place) both the client key pairs and column encryption keys. Although a column encryption key (copy) will be encrypted with a particular key pair, you are not required to backup or store them together. You can always create a copy of the CEK for encryption with a new CPK.

For the code, see

• https://github.com/saphanaacademy/cse

For the documentation, see

• Import and Export Column Encryption Keys

Tutorial Video

Importing Client Key Pairs and Column Encryption Keys

Not surprisingly, importing client key pairs and column encryption keys is very similar to exporting.

For the code, see

• https://github.com/saphanaacademy/cse

For the documentation, see

• Import and Export Column Encryption Keys

Tutorial Video

HDB Key Store

For the code, see

• https://github.com/saphanaacademy/cse

For the documentation, see

• Secure Key Store (hdbkeystore)

Tutorial Video

Thank you for watching

The SAP HANA Academy provides free online video tutorials for the developers, consultants, partners and customers of SAP HANA.

Topics range from practical how-to instructions on administration, data loading and modeling, and integration with other SAP solutions, to more conceptual projects to help build out new solutions using mobile applications or predictive analysis.

For the full library, see SAP HANA Academy Library – by the SAP HANA Academy.

For the full list of blogs, see Blog Posts – by the SAP HANA Academy.

• Subscribe to our YouTube channel for updates
• Join us on LinkedIn: linkedin.com/in/saphanaacademy
• Follow us on Twitter: @saphanaacademy
• Facebook: @saphanaacademy