Refreshes and copies with Volume encryption enabled.

[donald_voorhees]

Hi everyone -

Was wondering if there was a good paper/SAP note or admin guide available with regard to volume encryption being enabled.  We have been asked to encrypt our data at rest, which is simple enough - but we need to test copies, refreshes, and restores.   Thus far I've not been able to find much on the subject.

My initial suspicion is that the data moved through the backup process is decrypted as it's passed through the in memeory processing for the backup - so it can be used with no further steps, but would like to read it somewhere before I start testing.

Thanks!

[AtulKumarJain · Accepted solution]

Hi Donald,

There is sap note for HANA backup FAQ:

1642148 - FAQ: SAP HANA Database Backup & Recovery

As per this note

43. Are backups encrypted?
Currently, SAP HANA database does not offer backup encryption. However, third-party backup tools normally offer backup encryption. If you are using a third-party backup tool, contact your tool vendor about what encryption options are offered.

BR

AKJ

[donald_voorhees · Accepted solution]

Thanks - My concern was mostly around the fact that we currently have volume encryption enabled in a test sceatio.  This note doesnt really address whether anything is different once you have volume encrytion enabled. 

All signs seem to point to the data being decrypted once taken off persistance for the backup, so I am assuming that the backup itself can be used just like any other backup.  Would like to see it confirmed by SAP though.

Thanks!!    

[donald_voorhees]

Thanks for the reply.

[Former Member]

Please refer to the SPS09 SAP HANA Security Guide under the below link http://help.sap.com/hana/SAP_HANA_Security_Guide_en.pdf  __________Refer to section below______________ Data Storage Security in SAP HANA--> Data Volume Encryption You have details on how the Data volume Encryption works and confirmation that the backups in such a case are not encrypted___ The data volume encryption feature does not encrypt the following data: ● Database redo log files If database redo log files need to be protected, we recommend using operating system facilities, such as encryption at the file system level. ● Database backups In general, the contents of both data and log backups are not encrypted. Only data that has been encrypted internally in the database (that is, independently of the data volume encryption feature) remains encrypted in backups. This applies to data stored in the secure internal credential store. I hope you get more details on this document and it will be helpful