Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is SAP HANA 2.0 SPS 03, What’s New? - and in
this video we will take a look at the encryption configuration for tenant databases.
Hi, I am Denys van Kempen.
You may recall from earlier videos that SAP HANA automatically encrypts most of the data
that goes over the network but that to encrypt data-at-rest, data that is persisted, that
is, data that is stored, you need to enable this yourself.
There is always a bit of overhead involved with encryption and if you are 100% positive
that the data-at-rest of your HANA system cannot be accessed, then, of course, there
is no need to encrypt each and every last bit of data.
If you are not that sure - and in fact it is recommended - then you can enable encryption
for the data volume, encryption for the log volume, and encryption for the backups.
Now, before, tenant databases would inherit the encryption configuration of the system database.
This is no longer the case and I will show you where you can configure default settings
for the encryption of tenant databases.
I am connected here with the SAP HANA cockpit to the system database on the Overview page.
Here in the Security section, we would enable encryption for the different services.
If we go up a bit, to the links section, and select Configure system properties, under
DB Administration, we get to the page with all system parameters.
I will filter on ‘database_initial_encryption’.
This is a new section and here we can define how the tenant database encryption should
be configured when the tenant database is created.
As you can see, by default, all encryption services are initially disabled
We can also see that encryption_config_control is set to local_database - also the default setting.
A tenant database administrator can hand over this configuration control to the system administrator
by changing the value of this parameter.
For this, you would use an ALTER SYSTEM.
So, let’s go back.
Open the SQL Console
Connect to the tenant database,
here that’s T02
and, let’s paste this in
ALTER SYSTEM ENCRYPTION CONFIGURATION CONTROLLED BY SYSTEM DATABASE
Run.
Done.
So, now the system administrator, that is, the administrator of the system database,
can also change encryption configuration on this tenant.
By default, this is not possible.
If we return to the system properties page for database_initial_encryption, the value
for encryption_config_control will not have changed as only the tenant database T02 has
returned control for encryption configuration to system.
If you want to know who controls what, you would have to query the view
M_ENCRYPTION_OVERVIEW Let’s take a look and here we can see that
the system database has configuration control.
Should you want to revert that, you would need to connect to the system database and
execute ALTER SYSTEM ENCRYPTION CONFIGURATION CONTROLLED
BY LOCAL DATABASE in singular or LOCAL DATABASES in plural
if you want to give control back to all tenants
and if we then refresh the contents of the view for tenant T02, we can see that it now
has received configuration control back.
OK - Back to database_initial_encryption
As the name implies, these parameters control the initial configuration.
If I change persistence encryption, for the data volume that is, for a tenant database,
T02, for example
and then connect to T02 with cockpit
then data volume encryption will be still be off.
I have not enabled persistence encryption by changing the initial encryption parameter.
However, if we want to overrule the default setting, we would select change layer.
Set system value to on and now if we create a new tenant database.
Let’s call it T03
we have covered this in other videos in the Administration playlist, so I will fast-forward this a bit
you need to add it as a resource in cockpit admin, then connect,
and if we then take a look at the security section, data volume encryption,
you can see that it has been enabled now for this tenant database
because the initial encryption parameter was set to on.
The same would apply to log volume encryption and backup encryption
but we have not changed those parameters at the system level.
OK - that’s it
Initial encryption configuration for database tenants and encryption control.
Thanks for watching.
You can find more video tutorials on our YouTube channel.
If you would like to be informed about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates, and if
you are watching this video on YouTube, do not hesitate to leave your comments to the
video page and, if you like, give us your vote on this video.
Thank you for watching.