Help Required - Encryption in PI and Decryption in ABAP

[Former Member]

Hello Experts,

We are working on a customer engagement where we need to implement the following scenario.

Scenario:

The credit card file is sent from the external bank to PI and then PI sends it to ERP for processing.

Requirement:

The requirement is to encrypt the credit card number field when PI processes the received file in the PI file sender communication channel via custom adapter module (Adapter Engine in Java stack). Then PI sends this message with encrypted credit card number field to ERP via ABAP proxy then the credit card number field needs to be decrypted via ABAP before processing within ERP.

Challenge:

We are able to encrypt the credit card number field in PI using symmetric key algorithm like DES. This is done by custom java code in the custom adapter module using Java Cryptography Extension.

We are facing the challenge in implementing symmetric key algorithm such as DES in ABAP to decrypt the credit card number field using SAP Cryptography Library.

We seek your help/advice on how should we go about implementing this solution in ABAP. We are open to use any secure symmetric key algorithm in ABAP.

With the use of the Secure Store and Forward Mechanism (SSF) provided by SAP in ABAP which uses the SAP Cryptographic Library, we are able to use symmetric key algorithm but not able to specify the static key thatu2019s been used in PI for encryption.

Please help us if you have experienced similar requirement at your customer engagement and also let us know if there is any workaround / suggestions.

Warm Regards,

Nilesh Kumar

[Former Member]

Triplicate cross-post of spec-dump.

Thread locked.

[Former Member]

The credit card file is sent from the external bank to PI and then PI sends it to ERP for processing.

I agree with Stefan on this. Apart from the risk that PI system admin will have access to this critical information, the data is being sent from an external system and should be encrypted from the source itself.

Regards,

Neetesh

[stefan_grube]

> The requirement is to encrypt the credit card number field when PI processes the received file in the PI file sender communication channel via custom adapter module (Adapter Engine in Java stack). Then PI sends this message with encrypted credit card number field to ERP via ABAP proxy then the credit card number field needs to be decrypted via ABAP before processing within ERP.

If you want to avoid system admin of PI reding the credit card number, you have to encrypt this before entering the file adapter, so the best solution would be the provider of the file encrypts this.

Otherwise the sys admin can see the credit card number in message monitoring for adapter engine, as the message is stored before the adapter module is performed. And of coure, the sys admin can read the file directly.