Skip to main content
Complete the following steps to deploy the SAP HANA Transparent Data Protection service in CryptoHub.
1
Log in to the CryptoHub under dual control using your administrator identities.
2
Select the SAP HANA service and select [ Deploy ].
3
Configure the Service Setup settings:
  • Service Name: The name of the service. Leave as default.
  • Service Category: The category the service falls under. Leave as default.
  • Select [ Next ].
4
Configure the Access Control settings:
  • Authorized Resources: The role you are logged in with has access to the service by default.
  • Add Additional Resources: Optional.
  • Select [ Next ].
5
Configure the Path Rules that determine which files are encrypted and which identities may access them.
  • Select [ Add Path Rule ].
  • For Users, enter the SAP HANA administrator user (for example, <sid>adm).
  • For Groups, enter the SAP HANA group (sapsys).
  • For the path, use Advanced Setup with the ** wildcard to recursively match every file under the protected directory.
  • Select [ Add ].
6
Select [ Deploy ].

​
Choose the path rule for the data directory

Protecting the SAP HANA data directory is the primary purpose of this integration, so add a path rule that covers it.
On Linux, a TDP path rule must target the backing directory — the physical location where fesfifs stores ciphertext — not the mount that SAP HANA reads and writes through. A rule written against the mount path loads cleanly but silently matches nothing, because the kernel driver passes the backing path to the policy agent. The result is raw passthrough: files are written in the clear with no error. This guide uses a backing directory of /enc/hana-data for the data volume; adjust to match your deployment.
For a data directory whose backing store is /enc/hana-data, add a path rule with:
  • Path: /enc/hana-data/**
  • Groups: sapsys
  • Users: <sid>adm
To also protect the log volumes and native backups, add path rules for their backing directories in the same way — for example /enc/hana-log/** and /enc/hana-backup/** — each scoped to the same sapsys group and <sid>adm user.
Note the correspondence between the mount and its backing directory. SAP HANA reads and writes through the mount (for example, /hana/shared/data), while the path rule and the ciphertext at rest live in the backing directory (for example, /enc/hana-data). You configure this pairing when you mount the encrypted filesystem.