Hello and welcome to the SAP HANA Academy.
You are watching the video tutorial series:
What’s New for SAP HANA 2.0 SPS 01.
The topic of this video tutorial is Security.
Hi, I am Denys van Kempen.
OK, before we start a quick reminder of the available documentation.
Here we have our security information map and for a high-level overview of all security topics,
you should go to hana.sap.com/security
There are a couple of guides:
The Security Guide for the concepts and to get an overview.
The HANA Security Checklist and Recommendations Guide for best practices, as a reference.
Then, we have the Administration Guide and the Developer Guide, both more task-oriented,
the same material you can find on the SAP HANA Academy.
You can find all these guides on the SAP Help Portal - help.sap.com -
for the SAP HANA platform.
There is also a playlist dedicated on Security on the Academy
where you can find all the videos relevant for this topic together.
So what has changed with HANA 2.0 SPS 01?
Couple of things.
First, we have encryption.
Data volume encryption was introduced in HANA 1.0 SPS 08, June 2014.
This concerned data at rest, on persistent storage: tables, indexes, and so on.
HANA 2.0 SPS 00 added log volume encryption, the redo log - stores the transaction markers,
what has been updated, inserted, deleted.
If you every opened a redo log with an editor, you will know that you need a good pair of
glasses to figure out what’s in there.
But still, you can encrypted it.
On top, HANA 2.0 SPS 01 now also adds backup encryption both of data and log backups.
So, all data at rest can now be natively encrypted - that is, by HANA internally.
You could already encrypt backups, of course, with any of the supported 3rd party backup tools
using the BACKINT API interface.
SAP HANA file backups are encrypted using a new encryption root key specific to backups
and this key fully integrates into the existing encryption key management architecture.
We discussed this in quite a bit of detail in the What’s New for Security HANA 2.0 SPS 00 video,
so I won’t repeat myself here.
You can review that video, if you are interested.
It is all being done on the SQL level.
Requires the ENCRYPTION ROOT KEY ADMIN system privilege.
You create a new encryption root key with the statement
ALTER SYSTEM BACKUP ENCRYPTION CREATE NEW ROOT KEY
First you need to specify WITHOUT ACTIVATE. Then with
ALTER SYSTEM SET ENCRYPTION ROOT KEYS BACKUP PASSWORD
you backup the encryption root key
and then you can activate the new root key and enable backup encryption
There are two monitoring views, ENCRYPTION_ROOT_KEYS and ENCRYTPION OVERVIEW
that you can query to get the current status, last time stamp, and so on.
At this stage, you can make your backups and have them automatically encrypted.
For this, you could use HANA studio, or HANA cockpit, of course.
Note that there is no UI yet for any of these operations.
It is all in SQL.
For studio this is to be expected, as there will be no more feature development.
But there is nothing yet in HANA cockpit either.
Probably will be added in the next release or so - but this is just my guess.
Slightly related is the topic of data masking.
Also new in SPS 01.
Here we do not really encrypt data but make it look like it is for those users who are not allowed to see it.
Obfuscation is a term that is sometimes used.
It is an authorisation topic.
Data masking can be used with both plain SQL but also in calculation views.
You can still query the data, you do not get an error - not authorised, but it is just rendered meaningless, garbled.
Here we have a simple example.
Create a table, insert a row.
Then we create a view and use the WITH MASK clause
For the mask expressions you can use both constants or built-in functions
and you use them directly in the view definition with a CREATE or ALTER VIEW statement, as you can see here.
When we query the data as owner, we get all the rows.
But if we query the data as regular user, albeit the SYSTEM superuser, the data is masked.
If you want to see the data, you need to find a way to get the new object privilege UNMASKED.
You can find this documented in the Security Guide with some examples.
Two other enhancement on the topic of authorisation and authentication.
First, is that you can now reset the SYSTEM user password of a tenant database from the systemdb using SQL.
As a reminder, this is how you had to do this previously.
Stop the database.
Open a command line interface (not always easy in a cloud environment)
Setup some environment parameters. Execute the indexserver with the resetUserSystem flag.
Enter the new password
and start the database again.
Now with SPS01, just enter the command from a SQL prompt
ALTER DATABASE SYSTEM USER PASSWORD and the new password;
Makes live a little easier.
Well, for the system administrator at least.
The other new feature concerns the password policy.
Here we the policy editor in HANA cockpit.
In the password length and composition section, we can now specify the number of lowercase,
uppercase, numbers of special characters required for the password.
For example, 1 lowercase, 2 uppercase, 3 numbers and 4 special characters
Just to give everybody a headache Ah, see.
the system can even count, because the number exceeds the minimum number set.
So, we need to adjust this to a more reasonable setting.
Now, as a reminder, we do not get this in the password editor of HANA studio.
No more new functionality will be added to studio.
It is getting time to say goodbye to this HANA 1.0 tool.
The password editor of HANA cockpit, strictly considered, is not a HANA 2.0 SPS 01 feature,
as HANA cockpit has its own release cycle, and the latest version is HANA cockpit SP 2,
Support Pack 2
No stack, this time.
and there is more in SP2 for security.
This is, in fact, is a bit of the opposite as we have now have HANA cockpit catching up
with features long available in HANA studio.
Cockpit SP2, for example, introduces Manage Roles.
This is similar to the user editor added in SP1 and, as mentioned, to the role editor of HANA studio.
You can view the contents of a role.
System privileges, object privileges, analytic privileges, and so on,
or, create a new one.
And attach it to a schema, if you want.
This all concerns catalog roles, of course, runtime roles.
Not transportable development artefacts, the design time roles.
Another SP2 new feature, that’s brand new, concerns user authentication for single sign-on.
When creating or changing a database user, you can now configure JSON Web tokens, JWT
or jot, in short, as an authentication mechanism.
When you create a new user, or when you want to change an existing user, you can enable JWT.
Works both for ODBC and JDBC clients, or indirectly through HANA XS, advanced for web clients.
It’s similar to SAML, which is a bit older.
Other HANA authentication mechanisms are the X509 certificates, SAP Logon tickets and Kerberos.
Finally, I should also mention a change in secure communication between SAP HANA and LDAP.
Now, we are back at HANA 2.0 SPS 01.
You may recall that support for LDAP group authorisations was introduced with SPS 00.
For the first release, OpenSSL was used to encrypt the traffic.
As of SPS 01, SAP’s own CommonCryptoLib is now used, the same one used to encrypt
all the other internal and external traffic.
So this simplifies the stack.
You need to make some configuration changes for this to work and you have SAP note
24 38 641 - TLS Connections to LDAP Server to guide you through the steps.
OK Brief recap of what’s new and what's changed
- the cryptographic library has changed for LDAP communication
new is native encryption of the file-based HANA backup
new is data masking for SQL and calculation views
Reset system password of a tenant database using SQL
And for the HANA Cockpit 2.0 SP 2 the role editor,
we have JSON Web Tokens, and an enhancement to the password policy editor
So much for What’s New for SAP HANA 2.0 SPS 01 - Security
You can find more video tutorials on our YouTube channel.
If you would like to be informed about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates.
And we also have a page on Facebook and Google+.
If you are watching this video on YouTube, do not hesitate to leave your comments to
the video page and, if you like, give us your vote on his video.
Thank you for watching.