SAP HANA Cloud Integration CUSTOMER

Transcription

1 CUSTOMER

2 Table of Contents 1 Introduction from a Bird s Eye Perspective Integration Capabilities Connectivity Options Using Predefined Integration Content Security Transport Level Security Message Level Security Message Level Security Based on PKCS#7/CMS Enveloped Data and Signed Data Tenant Isolation SAP AG or an SAP affiliate company. All rights reserved. Table of Contents

3 1 Introduction This document provides an overview of the process integration-related capabilities of SAP HANA Cloud Integration - Application Edition. Introduction 2013 SAP AG or an SAP affiliate company. All rights reserved. 3

4 2 from a Bird s Eye Perspective This document provides an overview of the process integration capabilities of. is a platform hosted in the SAP HANA Cloud. It facilitates the integration of business processes spanning different companies, organizations, or departments within an organization. It supports endto-end process integration across cloud-based and on-premise applications (cloud-cloud and cloud-on-premise integration). It also provides data integration capabilities that allow you to efficiently and securely move data between onpremise systems and the cloud. Note This document provides an overview of the process integration-related capabilities of SAP HANA Cloud Integration. comprises the following key features: Core runtime for processing, transformation, and routing of messages to be exchanged between the involved participants Message processing at runtime is performed by a cluster of virtual machines running on SAP HANA Cloud. Here, the platform ensures that data related to different customers connected to SAP HANA Cloud Integration is isolated. This is important, for example, when using for businessto-business scenarios. Out-of-the-box connectivity support (IDoc, SFTP, SOAP/HTTPS) Security features such as content encryption and certificate-based communication Customers who want to use have to first set up the connection between their backend systems and SAP HANA Cloud. This process referred to as the onboarding process involves a tight and coordinated cooperation of experts at SAP and on customer's side. SAP provides continuous guidance and support during the whole onboarding process. The current version of is available for customers and partners as an Application Edition, especially for a dedicated set of SAP OnDemand solutions (SAP Customer OnDemand, SuccessFactors BizX, SAP Financial Services Network). Upon purchase, predefined, ready-to-use prepackaged integration content can be made available by SAP without the immediate need for additional hardware or integration skills on the customer s side. This drastically reduces integration project lead times and lowers resource consumption significantly. For reasons of simplicity, we refer to all kinds of parties, back-end systems, or applications that exchange messages with each other using under the generalized term participant. offers full flexibility in how participants can exchange messages by the following: Leveraging preconfigured integration patterns. These integration patterns provide different options for configuring the data flow between participants, for example, by using routing rules. Using various connectivity options. This covers a set of adapters (or endpoint types) that allow participants to connect with different communication protocols to SAP AG or an SAP affiliate company. All rights reserved. from a Bird s Eye Perspective

5 3 Integration Capabilities This section summarizes various ways in which participants exchange messages with each other when running an integration scenario based on. The following figure illustrates an example of the routing capability, where a message from one participant is forwarded by to three different receivers. The following table summarizes all integration patterns supported by. Integration Capability Routing Description Forwards (routes) a message to one or more receivers. also supports routing that depends on the content of the message (contentbased routing). For example, detects that a message has a particular field value, and forwards it to the specific receiver participant that handles requests from the sender participant. Mapping Transforms (maps) sender into receiver data structures. In scenarios spanning different application systems or different organizations and enterprises, it is very likely Integration Capabilities 2013 SAP AG or an SAP affiliate company. All rights reserved. 5

6 Integration Capability Description that the structure of the data exchanged between two participants will differ on both sides of a connection due to business-related reasons. To enable a seamless exchange of data, the data structures on both sides of a connection have to be transformed (or: mapped) into each other. allows structural mapping of XML documents. You can re-use existing on-premise content (service interfaces / message mappings / operation mappings / XSLT based mappings) from an SAP Enterprise Services Repository (EHP 1 for SAP NetWeaver 7.3). Value mappings allow you to map different representations of an object to each other. Value mappings are useful when performing a dynamic value lookup of an object that has different representations in different contexts. In value mappings, you map these different representations of an object to each other by setting mapping rules in a value mapping table. Note For example: You can use a value mappingto map a Merchant ID to a Customer ID, where Merchant ID is an external application representation of a customer, while Customer ID is an internal SAP representation. Content enricher Content filter Encoder/decoder (Base64) Splitter Extends the message content with additional information (constant, xpath, header, expression). Filters information by extracting a specific node from the incoming message. Encodes message content using an encoding scheme. This function is useful where secure content transfer over the network is required. Breaks down a composite message into multiple individual messages and sends them to a receiver SAP AG or an SAP affiliate company. All rights reserved. Integration Capabilities

7 4 Connectivity Options Various connectivity options also referred to as adapters allow you to connect to different kinds of technical communication protocols. The following table summarizes all adapters provided by. Connectivity Option SFTP client adapter Description Enables you to connect an SFTP server to SAP HANA Cloud Integration (which acts as a client). This enables you to use Secure Shell File Transfer Protocol (SSH File Transfer Protocol, abbreviated to SFTP). This option is particularly useful for secure communication between and non-sap system environments. The following versions are supported: SSH version 2 (as specified at tools.ietf.org/html/rfc4251) SSH File Transfer Protocol (SFTP) version 3 or higher IDoc (IDoc SOAP) adapter Enables you to set up reliable communication of IDoc XML documents via SOAP/HTTPS with enabled back ends of the SAP Business Suite. This option allows integration with on-premise SAP back-end systems in customers' corporate networks. SOAP adapter Enables you to exchange SOAP messages between remote clients or Web service servers and SAP HANA Cloud Integration. Connectivity Options 2013 SAP AG or an SAP affiliate company. All rights reserved. 7

8 5 Using Predefined Integration Content allows the participating organizations to develop, deploy, and consume services in a standardized manner. SAP provides a predefined set of integration content that covers most of the integration needs for a particular scenario. Customers can use the predefined integration contentto implement their integration scenarios with less time and effort. To accomplish this, however, customers need to register with SAP HANA Cloud Integration and complete the onboarding process as recommended by SAP. Customers can re-use existing on-premise content (message mappings / operation mappings / XSLT based mappings) from an SAP Enterprise Services Repository (EHP 1 for SAP NetWeaver 7.3). Note In the current version of, content is adjusted by SAP only (based on customer requirements) SAP AG or an SAP affiliate company. All rights reserved. Using Predefined Integration Content

9 6 Security 6.1 Transport Level Security The chosen connectivity option (adapter) and transport protocol determine the transport level security. Table 1: Adapter Transport Protocol Transport Level Security SFTP client adapter SSH SFTP (Secure Shell File Transfer Protocol) IDoc (IDoc SOAP) adapter HTTP HTTPS (SSL) SOAP adapter HTTP HTTPS (SSL) Secure data transfer with SFTP is based on a combination of symmetric and asymmetric keys. Symmetric (session) keys are used to encrypt and decrypt data within a session. Asymmetric key pairs (on the client and server side) are used to encrypt and decrypt the session keys. When asymmetric key pairs are used, SFTP also ensures that only authorized public keys are used by the involved participants. Supports SSL-based transport level security (X.509 certificate-based authentication and authorization). Supports SSL-based transport level security (X.509 certificate-based authentication and authorization). 6.2 Message Level Security You have the following option to configure message level security. Security 2013 SAP AG or an SAP affiliate company. All rights reserved. 9

10 Table 2: Transport Protocol Transport Level Security Message Level Security SSH HTTP SFTP HTTPS PKCS#7/CMS Enveloped Data and Signed Data Encryption/decryption of message content Signing/verifying messages Message Level Security Based on PKCS#7/CMS Enveloped Data and Signed Data In addition to security at the transport protocol level, security can also be configured at the message level, based on PKCS#7/CMS Enveloped Data and Signed Data. The CMS specification can be found at: html/rfc5652 Note This option can be implemented independently of and on top of the applied transport level security. This option supports the following use cases: Signing and verifying a message Encrypting and decrypting the content of a message Note Digitally signing a message within is based on the CMS type Signed Data. Digitally encrypting or decrypting the content of a message is based on the CMS type Enveloped Data. can be configured so that messages are decrypted and re-encrypted by SAP HANA Cloud Integration on their way between the sender and receiver participants. The same applies to signing and verifying signatures. This can be useful if the services and the recipient do not have a direct communication channel, but can only communicate using an untrusted intermediary. 6.3 Tenant Isolation At runtime, processes the data that is exchanged between the involved participants on a cluster of different virtual machines hosted in the SAP cloud. Note SAP AG or an SAP affiliate company. All rights reserved. Security

11 A virtual machine (VM) is a software implementation of a machine that executes a program like a physical machine. is designed so that the involved virtual machines are strictly separated from each other with regard to the related participants. In other words, separate resources ( memory, CPU, and file system) of the cloud-based integration platform are allocated to each participant although all participants might share the same hardware. In addition, each tenant uses a separate database schema, which guarantees that the data of the different participants is strictly separated. This separation is also referred to as tenant isolation. The following figure illustrates this concept for two participants communicating with each other using SAP HANA Cloud Integration. Security 2013 SAP AG or an SAP affiliate company. All rights reserved. 11

12 SAP AG or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Please see index.epx for additional trademark information and notices.