[Music]
SAP HANA Multitenant Database
containers represent the basis for
multitenancy in SAP HANA. Before we take
a look at the security aspects of multi
tenant systems let's go through the
basic setup of such a system. A
Multitenant system always has one
system database used for central system
administration and any number of
Multitenant Database containers or
tenant databases. All databases in the
system share the same installation of
database system software, the same
computing resources and the same system
administration. However each database is
self-contained and fully isolated with
its own users, database catalog
persistence, backups and so on. With the
exception of the system database access
between tenant databases is generally
not possible. The system database can
access tenants only for monitoring and
administration purposes. It cannot access
business data. Otherwise only if cross
database access is explicitly enabled
between two tenants is communication
possible. In general all standard
security features of the SAP HANA
database apply in Multitenant systems. A
few additional security features are
available especially for tenant
databases. Let's have a look at how the
standard aspects of security are
reflected in a Multitenant system first.
Every database has its own set of
database users and roles including a
database specific super user, system.
Authentication ensures that users from
one database cannot access another
database in the same system. All user
authentication mechanisms supported by
SAP HANA are supported in tenant
databases and can be configured
independently for each database. The only
exception is Kerberos based
authentication. This can only be
configured for the system as a whole.
SAP HANA authorization mechanisms
ensure that only sufficiently privileged
users of a database can preform
operations in that database. Users of the
system database however do have access
to certain data in tenants for
monitoring purposes and with the
privileged database admin can also
perform certain tasks in tenants. For
example stop the tenant or do a backup.
If cross database access is enabled
between two tenants a user in one tenant
database can execute read queries on a
remote database through a user in the
other database. Secure encrypted
communication between tenants and
external clients can be independently
configured for each database as can the
encryption of data and log volumes.
Finally actions performed in each
database are audited separately and the
audit log is by default a local database
table. A number of additional security
measures can be applied in multitenant
systems. To prevent cross tenant attacks
through operating system mechanisms. It
is possible to increase isolation at the
operating system level. As a result the
processes of individual tenants can run
under dedicated OS users belonging to
dedicated OS groups instead of all
running under the single default OS user
SID ADM. Data on the file system is
protected using file and directory
permissions and internal database
communication is authenticated to ensure
that only the processes belong to the
same database can communicate with each
other. To ensure the stability and
performance of the overall system or for
security reasons the system
administrator can prevent certain system
properties from being changed in tenants.
For example properties related to
resource management. A configuration
change blacklist is available in the
form of the multi dpi.ini file. It
contains several critical properties by
default but it can be customized as
required. Finally depending on how the
system is implemented it may be
necessary to disable certain database
features that provide direct access to
the file system, the network or other
resources like import and export
operations or
backups for example. The SystemView M
customizable functionalities provides
information about features that can be
disabled and their status. A system
administrator can disable features in
specific tenant databases in the
customizable functionality section of
the global ini file. For more information
about security and Multitenant Database
containers see the SAP HANA security
and administration guides on SAP help
portal at help.SAP.com forward slash
HANA underscore platform.