Confirm the data is encrypted at rest
Read a data-volume file directly from the backing directory (not the mount). Encrypted files begin with the FESFMONADNOCK__SODS header.
1
List the data-volume files in the backing directory:
2
Inspect the start of a data-volume file in the backing directory:
The file begins with
M O N A D N O C K _ _ S O D S, confirming the data volume is stored as ciphertext at rest.Confirm SAP HANA reads the data transparently
The same files are transparently decrypted when read through the mount by the SAP HANA administrator user.1
Read the same file through the mount path as the SAP HANA administrator user:
Through the mount, the file does not show the
MONADNOCK__SODS header — it returns the real, decrypted content. Ciphertext at rest, transparent plaintext through the mount, confirms TDP is protecting the data directory.Confirm SAP HANA operates on the encrypted data directory
Finally, confirm the database itself runs correctly against the encrypted mount.1
Start SAP HANA and confirm all services reach a running state:
The name server, index server, compile server, and web dispatcher all reach a running state, confirming SAP HANA started against the encrypted data directory.
2
Confirm read and write access with a simple SQL round trip:
The row inserts and reads back successfully, confirming SAP HANA reads and writes its data directory transparently while it is encrypted at rest.