Show TOC

Procedure documentationEncrypting Message Content on Database Level (Local IE) Locate this document in the navigation structure

 

This section describes all the configuration steps to be performed to enable message encryption at the database level in business systems with a local Integration Engine.

Note Note

All SAP systems based on Application Server ABAP release 6.20 or higher contain a local Integration Engine, also when used as an application system. This local Integration Engine enables the system (when used as an application system) to connect to another system via an SAP NetWeaver PI runtime engine. This kind of connectivity is also referred to as connectivity based on the proxy runtime. All other systems – either SAP or third-party – connect to the SAP NetWeaver PI runtime using adapters.

End of the note.

Procedure

Configuration Tasks

Define the encryption keys and maintain the Personal Security Environment (PSE):

  1. Call transaction SSFA.

  2. Choose New Entries.

  3. Select the SSF application PI Key1 DB Message Encryption.

    Note Note

    This SSF application is predelivered.

    End of the note.

  4. For Encryption Algorithm, select the value TRIPLE-DES.

  5. Save your changes.

    Caution Caution

    SAP recommends not to change the name of the PSE file (field Private Address Book). In case you nevertheless like to change the name, consider the fact that the maximum name length is 25 characters. The reason for that is that the ENCRYPTION_KEY parameter value is restricted to this length.

    End of the caution.

  6. Repeat these steps for the SSF application PI Key 2 DB Message Encryption.

  7. Call transaction STRUST.

  8. Position the cursor on the entry SSF PI Key 1 DB Message Encryption.

  9. In the context menu, choose Create.

  10. For Algorithm, select the value RSA.

  11. Repeat these steps for the entry SSF PI Key 2 DB Message Encryption.

  12. Check if entries for all application servers are indicated as ok (green traffic light).

Note Note

Note the following recommendations related to your activities using transaction STRUST:

  • Choose a suitable key length (recommendation: 2048 bytes).

  • As far as the requirements of the scenario allow, choose a suitably long validity period for the key. Otherwise take suitable measures to prepare your business processes and systems for key expiration.

  • Create backups of the keys by exporting them. Furthermore, be careful when deleting keys. There might still be messages stored in the database that cannot be read without the key.

End of the note.

Finish encryption configuration on the Integration Engine and prepare to activate encryption for the sensitive service interface.

  1. Call transaction SXMSIF.

  2. Choose New Entry.

  3. Enter an ID for the service interface (field Sender/Receiver ID).

  4. Call the input help to select the sender service interface for which encryption should be activated (fields Interface Name and Interface Namespace).

    You can select the service interfaces from the Enterprise Services Repository.

  5. Under Component, enter *.

  6. Note the value of Sender/Receiver ID for the following steps.

Depending on your scenario, you need to perform the same steps for the receiver service interface.

To finish Integration Engine configuration, perform the following steps:

  1. Call transaction SXMB_ADM.

  2. Choose Integration Engine Configuration.

  3. As Category, choose Runtime.

  4. Choose Configuration.

  5. Create a new entry with the following settings:

    • In the Parameters column, select ENCRYPTION_KEY.

    • In the Current Value column, select the key that was defined previously using transaction STRUST.

    Use the input help to make your selections.

  6. Create another entry with the following settings:

    • In the Parameters column, select ENCRYPTION_ACTIVE.

    • In the Subparameter column, select the ID defined (for the service interface) previously using transaction SXMSIF.

    • In the Current Value column, enter 1.

Checking Usage of Keys

You can find out for each key which messages are encrypted by this key.

Example Example

If a key has been compromised, the administrator can find out if the key is still in use for message encryption.

End of the example.

To do this, perform the following steps:

  1. Call transaction SXMB_CHK_ENCKEY.

    Note Note

    You can alternatively call the Object Navigator (transaction SE80) and then start program RSXMB_CHECK_ENCKEY_USAGE.

    End of the note.

  2. You can display a list of messages encrypted either for a specific key or for all keys in use.