SAP HANA provides full support for data-at-rest encryption to secure your data.
Before we go into the different types of data encryption available,
let’s briefly look at how persistent data storage in the SAP HANA database works.
As an in-memory database,
SAP HANA holds the bulk of its data in main memory for maximum performance,
allowing you to process large data volumes at high speed with less administrative effort.
However, to ensure that the database can always be restored to its most recent committed state,
data is automatically saved from memory to disk at regular savepoints.
All data changes are also captured in redo log entries.
If the database is restarted after a power failure, for example,
it returns to its last consistent state by replaying the redo log entries created since the last savepoint.
Creating regular data and log backups protects your data further and ensures fast recoverability
with maximum business continuity in the event of an outage.
While authorization is the primary means for controlling access to data,
encryption provides an additional layer of protection.
SAP HANA supports full encryption in the persistence layer.
Data volume encryption protects the data area on disk.
While redo log encryption protects the log area.
And native backup encryption protects the contents of data backups, delta backups, and log backups.
Native backup encryption can be enabled for both backups written to the file system or
backups written to a third-party backup tool through the Backint for SAP HANA interface.
If you are using a third-party backup tool, you also have a choice between
native SAP HANA encryption or tool-side backup encryption.
In addition to these three encryption services,
the SAP HANA database also provides an internal encryption service,
which is available programmatically to applications requiring encryption.
This internal application encryption service is used in several situations.
For example, SAP HANA’s secure internal credential store uses it to store credentials
required by SAP HANA for outbound connections.
For additional uses of the internal application encryption service, see the SAP HANA Security Guide.
The three data-at-rest encryption services and the internal application encryption service
are available independently in every database in the system,
be it the system database or a tenant database.
The internal application encryption service is always available,
while the data-at-rest encryption services must be individually enabled.
If you require full protection in the persistence layer, we recommend that you use them all.
All services use the AES-256-CBC algorithm to encrypt data.
Each encryption service has its own unique encryption root key,
which is generated when the database itself is created.
All encryption root keys are stored securely in the instance secure store in the file system,
or the instance SSFS.
The instance SSFS is protected by a unique master key.
Since the instance SSFS is stored on disk, all the encryption root keys that it contains
must also be saved somewhere else.
This is to ensure that if you do have to recover your database after a disaster,
you have all the root keys required to restore encrypted data from a backup.
For this reason, you must always save your encryption root keys to a special password-protected file.
The password for the backup file needs to be set manually and is stored in the instance
SSFS along with the other root keys.
The storage of the password in the Instance SSFS allows root key backup files to be created
without the need to provide the password each time.
But as you’ll need the password to retrieve the encryption root keys during a recovery,
you must also store it in a separate safe location.
If you lose it, you may not be able to recover your database.
Although new and unique keys are always created on installation or database creation,
if you received SAP HANA from a hardware or hosting vendor,
you might want to change them to ensure they are not known outside your organization.
You should this immediately after handover.
Afterwards, you should periodically change your keys in line with your security policy.
For more information about configuring encryption and key management,
see the SAP HANA Security and Administration Guides on SAP Help Portal.