SAP Security

Dr. Michael Woitass Version 02/04

Security in SAP Systems

FIST Conference26th of November 2004

BarcelonaDr. Michael Woitass

2


Agenda

Security risks

High-level security in SAP systems

Single Sign-On to SAP

Secure Network Communication (SNC) in SAP

Digital signature of documents (SSF) in SAP

3


Information security

¿Do organisations need cryptographic solutions?

The competitive advantage of many companies and institutions results from obtaining ad managing information.

The loss of information can generate a serious risk for these organisations.

Without protection internal data may be accessible via the network:

Personal data

Financial data

Customers and providers

Product and service prices

Intellectual proprietary

Confidential corporate information.

4


SAP systems environment

R/3

SAPgui / SAPlogon

SAPlpd

rfc accessSAP RouterSAP Router

WEB Browser

Internet

SAP WEBApplication Server

WEBBrowser

Internet

ITSWEB Server

Insecurenetwork

SAP data are transmitted by an insecure network.

5


Security of SAP systems

Standard SAP:

The security of SAP systems depends on the security of the network.

The login information (userid and password) can be captured during transmission.

SAP data are transmitted as legible text.

R/3SAPgui / SAPlogon

6


Security risks

Attack Security purpose

• Man-in-the-middle Authentication• Unauthorised modification Data integrity• Unauthenticated sender Proof of origin• Wiretapping Confidentiality

Appropriate security purposes eliminate the risks.

7


Security technology

Security purpose Technology

• Autentication Strong authentication• Data integrity Digital signature• Proof of origin Digital signature• Confidentiality Encryption

Asymmetric cryptography provides the technology to guarantee high-level security.

8


Basics: asymmetric encryption

Encryption and decryptionwith public-key-cryptography

9


Basics: hybrid encryption

Encryption and decryptionwith hybrid cryptography

10


Basics: digital signature

Digital signature and its verification

11


Cryptographic solutions facilitate

Secure Single Sign-On to SAP (SSO)

Encryption of data communications in SAP (SNC)

Digital signature of SAP documents (SSF)

SAP Security

12






SAP Security

13


Authenticationwith certificateSecure Sign-On

Secure access to SAP

SecurityLibrary

SecurityLibrary

NetworkInterface

SAPguiClient

NetworkInterface

SAP R/3Server

Single Sign-On by means of:

Crypto libraries at client and server side Strong authentication using digital certificates

14


Secure Login with certificates

User Server

Generates anarbitrary message

B

Signs the messagefrom the user

Generates anotherarbitrary message

B

Verifies the signatureof the server

Signs the messageof the server A

A

Verifies the signatureof the user

Strong authentication between SAP clients and servers

15


Secure Single Sign-On

Secure Single Sign-On to all SAP servers

16


Single Sign-On with smartcards

Certificate and private key

IdentificationwithPIN

Access

17


Motivation:

• The company wants to establish a Single Sign-On via the logon to the network (e.g. Windows Active Directory authentication, one-time tokens).

• The company uses SAP systems.

• The objective is to implement a certificate-based Single Sign-On to SAP without the need to have a PKI installed.

SSO Integration

18


Architecture

Windows Logon

Secure LoginClient

UserID, Domain, Password1

Secure LoginServer

scalable

2 5

GenerateCertificate

4

Soft Token

6

3

scalable

Active Directory

19


Architecture

SecurityLibrary

SNC

Soft Token

SAP GUI – SAP Server

Single Sign-On Secure Communication

SAP GUIClient

SecurityLibrary

SAP R/3Server

GSS-API GSS-API

20


Architecture

Web Browser – Web Server

Single Sign-On Secure Communication

CSP

SSL

Soft Token

InternetExplorer WEB

ServerMicrosoftCrypto

API

21


Advantages

High User AcceptanceThe user doesn’t need to learn a new software.The user will not be afflicted to enter his login data again and again.

High SecuritySecure authentication and communication in SAP applications via SNC.Secure authentication and communication in Web applications via SSL.

Reduced AdministrationNo overhead of a Public Key Infrastructure, nevertheless certificate-based login to SAP applications and Web applications.

Reduced CostsReuse of established authentication method.Single Sign-On assures an optimized workflow.

22






SAP Security

23


SecurityLibrary

Architecture

Protocol

SNC

GSS APIGeneric Security Services

Compression

Workprocess

Integration in SAP with Secure Network Communication (SNC)

24


Authenticationwith certificate

Secure network

SecurityLibrary

SecurityLibrary

NetworkInterface

SAPguiClient

GSSAPI

GSSAPI

SNC NetworkInterface

SAP R/3Server

End-to-End security by means of:

Crypto libraries at client and server side SAP standard interface SNC

25


SecurityLibrary

Architecture

Protocol

SNC

GSS APIGeneric Security Services

Compression

Workprocess

Secure Network Communications (SNC) in SAP

Application Programming Interface standardised by the IETFAbstraction from mechanisms used behind the APICertification within SAP‘s CSP Program (BC-SNC Interface)

26


Integration on the R/3 server side

SNC configuration: central user administration

27


Integration in SAPlogon

SNC configuration: selection of the security level

28


Requerimientos:

La LOPD (Ley Orgánica de Protección de Datos) entró en vigor el 1 de julio de 2002.

La ley exige medidas de seguridad de nivel alto, entre ellos el cifrado de los datos.

Las empresas y administraciones públicas españoles que tienen SAP R/3 y tratan datos de nivel alto de seguridad deberán cumplir con la ley.

Example: Spanish Data Protection Law

29


Medidas de seguridad de nivel alto:

Los ficheros que contengan determinados datos personales requerirán la implantación de medidas de nivel alto:

– ideología, religion, creencias– origen racial, salud o vida sexual de las personas físicas– datos recabados para fines policiales.

Principalmente, estas medidas consisten en:– el cifrado previo de los datos– el almacenamiento de la información relativa al acceso a los ficheros durante al menos dos años– el almacenamiento de las copias de seguridad en un lugar distinto a donde se encuentren los equipos informáticos.

Example: Spanish Data Protection Law

30






SAP Security

31


Digital signature of SAP documents

The digital signature guarantees

the identity of the user

and

the integrity of the data.

Digital signature in SAP

DigitalDigitalsignaturesignature

Data Data extractionextraction

EncryptionEncryption RSA Algorithm RSA Algorithm with asymmetricwith asymmetric

1.024 Bits1.024 Bitsencryptionencryption

Extraction ofExtraction ofsigned datasigned data

Private keyPrivate key

32


Example: Project ArchiSig

Electronic Signature of Medical Documents – Integration and Evaluation of a Public Key Infrastructure (PKI) in Hospitals

33


Workflow in SAP IS-H*MED

SAP IS-H Med SECUDE SecurityLibrary

The secretary writesA medical document.

The Workflow passes the document to the daprtment head.

IXOS-eCONserver

The medical document and the signatures are transferred to the archiving system.

The department head countersigns.

The doctor signs the document.

Time stamp

34


Document workflow: create, modify, sign, verify

„My letters“

Crear un expediente

Determinar el siguiente paso

Mostrar pdf

Función de firma

Firmar el documento

Enviar a la secretaria

- Tareas

- Lista de documentos

Archivo del documento

Historial de firmas

Verificación

35


Integration of the signature in SAP IS-H*MED

36


Certificate-based security technology facilitates:

Secure Single Sign-On to SAP

Encryption of SAP data

Digital signature of SAP documents.

Resume


Security in SAP Systems

¡Muchas gracias por su atención!

Michael Woitass [email protected]