How to implement SAP SNC (Secure Network Communication) for ARM64?

203 views Asked by At

I'm currently using SAP's JCo Java Connector and SNC (Secure Network Communication) libraries. This works great on x86 but I would like to run this on ARM processors.

SAP provides an out of the box Java Connector for ARM available here as "Linux for AArch64 compatible processors":

https://support.sap.com/en/product/connectors/jco.html?anchorId=section_2129803369

However, I have not been able to find a SNC library for ARM. Does one exist?

Alternately, is there a protocol specification or open source implementation of SNC that can be used directly or to port?

It would be great for there to be a Java implementation, but any reference would be helpful.

Here is some additional information on the SNC protocol which describes the 3 levels of settings. I'm interested in the Privacy protection setting with encryption.

Configuring Secure Network Communications for SAP

SNC secures the data communication paths between the various SAP System components. There are three levels of security protection you can apply.

  • Authentication only — When using the Authentication only protection level, the system verifies the identity of the communication partners. This is the minimum protection level offered by SNC.

  • Integrity protection — When using Integrity protection, the system detects any changes or manipulation of the data which may have occurred between the two end points of a communication.

  • Privacy protection — When using Privacy protection, the system encrypts the messages being transferred to make eavesdropping useless. Privacy protection also includes integrity protection of the data. This is the maximum level of protection provided by SNC.

I ran across the following SNC implementation in Python but it does not appear to support encryption.

https://github.com/OWASP/pysap/blob/master/pysap/SAPSNC.py

2

There are 2 answers

0
Trixx On

As far as I know, supported SNC libraries have to implement the GSS-API (Generic Security Service Application Program Interface) Version 2, for example Kerberos. But for RFC SNC communication you typically have to use the same SNC library on both sides, i.e. on ABAP backend server and on Connector client side. So you usually do not have a free choice which library to use, unless you are entitled to also decide which SNC library shall be installed and used on ABAP system side as well. Most SAP systems are set up with SAP's own Common Crypto Library for SNC.

A pure SNC Java implementation would be nice, but would not run together with JCo as it will only load a native library for doing SNC and call appropriate GSS C APIs.

I'd be patient and wait for the SAP Common Crypto Library to be released for Linux on ARM as well. I guess, it's just a matter of time.

0
Trixx On

The wait is over.

Today, SAP published their Common Crypto Library version 8.5.54 also for Linux on ARM64 and for macOS on ARM64, paving the way for using SNC on these platforms as well now.

The SAP Common Crypto Library can be downloaded from SAP's Software Download Center.