HANA Column Level Encryption

[Former Member]

Hi Lars,

Can we implement HANA column level data encryption and decryption (by role) / HANA SQL?

Below is what I am trying to design: please review and advise. Thanks.

–Need the functionality to encrypt column level data in SLT during read/write operation and store encrypted value in HANA table column, decrypt data using HANA security roles for SAP ECC ( ISU and CRM) Data –

–Need the functionality to encrypt column level data within HANA during data transformation ( table to table ) and decrypt data back using HANA security roles for any HANA table.column

[Former Member]

Hi,

I see that you try to find out an encryption and decryption feature for a column, I see that you have visited the same places I've been. On the last link there is half the answer for encryption. Did you manage to solve it?

Thank you

Alejandro Raitarsky

[rama_shankar3]

Thanks Guys. I have developed a custom solution for the encrypt and decrypt feature. FYI - from HANA 20 SP2, the procedure and functions source code can be encrypted. This is a big plus to application developers who build 3rd party applications on HANA platform.

I hope SAP soon releases standard encrypt and decrypt for table column data which can be customized by AP's and/or roles.

Cheers!

[lbreddemann]

Two remarks to this:

1. If your encryption/decryption solution is based on a secret mechanism in an encrypted procedure, it's not secure. Not sure, if you meant to indicate that this is the case, but your mentioning of the source encryption makes it look like it is.
2. The code encryption for sqlscript in HANA 2 SP2 only covers the runtime-objects. So, to hide the source code from anyone, the usual transport mechanisms cannot be used, since the unencrypted source code then shows up in the repository.
   That means a person who is allowed to know the source code has to run a SQL script manually on every database that should have the encrypted code. Not sure how your distribution model works, but this clearly puts limits to a product that should be installed/maintained on more than a couple of instances.
   Also: in case you have multiple versions of an encrypted procedure, there's no built-in way to identify which version is present in a database - not too nice for supporting this code in production.