Force encrypt HANA data.

[former_member152974]

Hi, Experts,

For an existing HANA database, if I enabled encryption by executing command "alter system persistence encryption on;".

A few questions.

1. How do I check the encryption progress ?

2. I read a note says the data would be encrypted when it reads the data, However, if I'd like to encryption all the data one time, is there a command to force it to do the encryption for the entire database(not only enable encryption but force it to encrypt all the data)?

Thanks

Brian Wang

[former_member152974]

Hi Brian,

1. For checking the encryption status. You can refer this SAP Note https://launchpad.support.sap.com/#/notes/0002767023

2. As per my experience, there is no command where it encrypt entire database at same time.

If your HANA is 2.0, then you can drop the Tenant DB and apply encryption setting and restore the database.

This will achieve encryption at one short.

Regards,

Kiran

[dvankempen]

krnchrn_5

You might want to convert / submit your comment as answer as both are correct.

[dvankempen]

Got the answer to your question? To improve the knowledge base and make the right answers easier to find, please mark the best answer and close the question. Thanks!

Don’t know how? See https://answers.sap.com/questions/13162472/how-to-mark-an-answer-and-how-to-close-a-question.html

For the readers, before you leave, don't forget to up/down vote the answers. You can vote on the question too.

Thanks.

[christoph_heimann · Accepted solution]

Hi Brian,

I agree with Kiran. There is no single command which encrypts the whole data persistence at the same time. If you run the commands

ALTER SYSTEM PERSISTENCE ENCRYPTION ON;

or

ALTER DATABASE <TID> PERSISTENCE ENCRYPTION ON;

an asynchronous process will be started which encrypts the data persistence in the background.

You can monitor the process for each service / database by using the following command in the SYSTEMDB:

SELECT 
    HOST
  , DATABASE_NAME
  , PORT
  , ENCRYPTION_ACTIVE
  , DATA_CONVERSION_ACTIVE
FROM 
  SYS_DATABASES.M_PERSISTENCE_ENCRYPTION_STATUS;

The column DATA_CONVERSION_ACTIVE provides the information if the encryption process is still running or if the conversion is done.

If you want to encrypt the whole database from the beginning you have two options from my point of view:

1. Using the HANA database parameter(s) of the database_initial_encryption section on global.ini configuration file e.g:

• Install the HANA instance without a tenant database (Only SYSTEMDB)
• Set the following parameter in the global.ini file:

ALTER SYSTEM ALTER CONFIGURATION ('global.ini','SYSTEM') SET ('database_initial_encryption','persistence_encryption') = 'on' WITH RECONFIGURE;

• Create a new tenant database
• Load your initial data into the tenant database e.g. installing the application stack, system copy or similar

2. Activate the database data and log encryption from the beginning by installing the HANA instance in batch mode using a configuration file. In this case you have to set the volume_encryption parameter equals true.

• Please be aware that this option is only available with HANA 2.0 SPS 05 and higher
• This will also turn on the redo log encryption from the beginning
• Please take care for a proper key management (backup ...)
• Please check also this link

[former_member697536 · Accepted solution]

Thank you so much, I am clear now.