Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is SAP HANA 2.0 SPS 03 - What's New?
and in this video we will take a look at a new security feature: client-side data encryption.
Hi, I am Denys van Kempen.
With client-side data encryption, as the name clearly indicates, you encrypt (and decrypt)
sensitive data on the client.
This is new, as of SPS 03.
There are different ways, how you can protect data from unauthorized access.
We have secure internal communication.
We have data masking.
We have server-side encryption of data-at-rest
they all have their use case
but they all imply full trust on the server-side.
No problem, typically, for on-premise but not so much, maybe, for cloud environments.
Client-side encryption provides a separation
between those who own the data (and can view it)
and those who manage the data (but should have no access)
database administrators, cloud administrators, and so on.
I am sure, we can all think of a couple of scenarios where that might be useful.
Now, before we start encrypting all of our data on the client (just to be sure)
there are a couple of considerations and also limitations of what we can do.
First of all, you have to set this up properly.
The client will use a key pair for the encryption with the private key stored on the local machine.
If you loose that key, there is no way to decrypt the data.
There are some more topics to consider and they are all documented here for you in the
Client-Side Data Encryption chapter of the SAP HANA Security Guide.
So, make sure to read up on this.
Here we have some prerequisites.
You need to use threat modeling (common security standard) to identify sensitive data
Decide whether to use deterministic or randomized encryption.
Documented here.
Inform applications users of the impact
You need to be selective, like I said, there is no business case to encrypt everything
You need to back up and archive client key pairs
Change them regularly, you need to rotate your keys.
Be careful who you grant key administrator privileges.
If you grant your cloud administrator, DBA (or whoever you do not want to see the data),
key administrator privileges then you are not doing this right.
Also, if the client is hosted in the same cloud environment as the server,
then this is also not going work as intended.
OK
All documented here in the Security Guide.
Now, to illustrate how this works, here we have the data flow.
Users 1,2,3,4 are clicking left, right and center in their app, and the business logic
of the application server will translate this into SQL
select creditcard from wallet where name = (something)
The SQL will go to the SAP HANA server, hosted somewhere
The creditcard column of the wallet table is encrypted.
Cloud admin and DB admin cannot read any of this and we also have a column encryption key
that has been used to encrypt this particular creditcard column, and this key itself is
also encrypted in the HANA catalog.
The database engine will then parse the SQL, create the execution plan and do all the things
it always does and send back the result set to the application server of which the data
for the creditcard will still be encrypted.
Encrypted-at-rest, in-memory, and in-flight.
Cannot be tampered with.
It will also send the encrypted column key.
The SAP HANA client, then, will use its hdbkeystore - also new - to decrypt the column key and
with that key, decrypt the column
The result set, in clear text goes to the application server, which presents it to the user.
What is important is that all keys are created by the SAP HANA client.
We have two types: the column encryption key and the client key pair with public and private key.
The column encryption key, CEK in short, is used to protect the data of a particular column.
It is schema-based and you can have one or you can have more, one for each column,
one for each table, or one for all tables, or any combination.
The column encryption key itself is encrypted and stored in the database.
CEKs are managed (created, deleted, altered) by a user with the
CLIENTSIDE ENCRYPTION COLUMN KEY ADMIN object privilege.
A client key pair (CKP) is protecting the column encryption keys.
They are generated by the SAP HANA client and stored on the client in the HDBKeyStore,
with the public key stored in the SAP HANA catalog.
To manage client key pairs you will need another new system privilege
CREATE CLIENTSIDE ENCRYPTION KEYPAIR
Here we have the procedure.
First, we need to create a key administrator
Next (2) key admin creates a client key pair,
makes a backup and stores it safely.
Then, (3) key admin creates a column encryption key encrypted with the key pair.
Again, export the key and stores in a safe place.
4. We need to encrypt the column data.
This could be a new or existing table, does not matter.
Typically, this will not be done by key admin, he only does key management, but by the data admin.
5. We need to enable access to the encrypted data by creating copies of the column encryption key.
this again, is a key administrator activity and this column key copy will be encrypted
with the keypair of the user that needs to access the data.
This could be a business user, an end-user, connecting with ODBC using Excel, for example,
but this could also be a technical user (more likely scenario) the schema owner of the application
server using JDBC, for example.
Works as well.
That will depend on your implementation of client-side encryption.
So, each (technical) user who needs to access client-side encrypted data will need to have
his or her own key pair.
Finally, under 6, we are reminded to rotate the CEK's, the column encryption keys, regularly.
So much for the concepts, in the next video, I will show you how this all works.
Thanks for watching.
You can find more video tutorials on our YouTube channel.
If you would like to be informed about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates, and if
you are watching this video on YouTube, do not hesitate to leave your comments to the
video page and, if you like, give us your vote on this video.
Thank you for watching.
For more infomation >> Gf 15, Matteo e Alessia si sono baciati: lo scoop di Domenica Live | Wind Zuiden - Duration: 3:34. 
For more infomation >> Primeros pasos para montar vídeos con Camtasia Studio 8 - Duration: 16:09. 
For more infomation >> Monitor Paxton Net2 Entry Premium - CCTV CENTER - Duration: 1:54. 
For more infomation >> Grande Fratello: è scattato il primo bacio tra Matteo e Alessia | Wind Zuiden - Duration: 3:24. 
Không có nhận xét nào:
Đăng nhận xét