C H A P T E R
15
Encryption Model
Encryption Strength and Coverage
199
Two Classes of Encryption Strength
199
Two Contexts for Encryption Coverage
199
Default Settings for On-Disk Encryption
199
Default Settings for Over-the-Wire Encryption
200
About SAS/SECURE
201
What Does SAS/SECURE Provide?
201
How Are SAS/SECURE Features Surfaced?
201
Licensing and Availability of SAS/SECURE
202
Encryption Strength and Coverage
Two Classes of Encryption Strength
SAS offers two classes of encryption strength:
3
If you don’t have SAS/SECURE, you can use only the SASProprietary algorithm.
SASProprietary encoding uses 32-bit keys and is appropriate for preventing accidental exposure of information. SASProprietary is licensed with Base SAS software and is available in all deployments.
3
If you have SAS/SECURE, you can use an industry-standard encryption algorithm such as AES. SAS/SECURE is an add-on product that is licensed separately and offers maximum protection.
Two Contexts for Encryption Coverage
SAS provides encryption in two contexts:
3
On-disk encryption protects data at rest. The emphasis is on protection of passwords, both in configuration files and in the metadata repository.
3
Over-the-wire encryption protects data while in transit. The emphasis is on protection of credentials, but you can also choose to protect all traffic in transit.
Default Settings for On-Disk Encryption
On-disk encryption protects data at rest. The following table describes initial support:
199
200 Default Settings for Over-the-Wire Encryption
4 Chapter 15
Table 15.1
On-Disk Encryption and Encoding
Content and Context
Password on disk in the metadata
Password on disk in a configuration file
Most other metadata on disk
SAS data sets on disk
Algorithm
AES
1
Configuration
Controlled by the STOREPASSWORDS option in the metadata server’s omaconfig.xml file.
SASProprietary If you have SAS/SECURE, you can upgrade to
AES. See “Password Updates for Service
Accounts” on page 14.
None Not configurable.
None To apply encryption, use the ENCRYPT= data set option.
2
1 If you don’t have SAS/SECURE, SASProprietary is used.
2 The ENCRYPT= data set option uses a proprietary encryption algorithm that is not the same as the SASProprietary algorithm. See the SAS Language Reference: Dictionary.
Note:
Configuration files and metadata repository data sets should also be host protected.
4
Default Settings for Over-the-Wire Encryption
Over-the-wire encryption protects data while in transit. The following table describes initial support:
Table 15.2
Over-the-Wire Encryption and Encoding
Content and Context
Password in transit when a user logs on to a SAS desktop application
Password in transit when a user connects directly to the OLAP server
(for example, from a SAS data provider)
Password in transit when a user connects to the metadata server from a
Base SAS session
Password in transit when a client retrieves a stored password from the metadata
Password in transit when a client sends a password to the metadata for storage
Algorithm
AES
1
AES
1
Configuration
NETENCRALG option in the metadata server’s invocation command.
NETENCRALG option in the server’s invocation command.
AES
1
NETENCRALG option in the server’s invocation command. Can be affected by the METAENCRYPTALG option in the client session.
SASProprietary RETURNPASSWORDS option in the metadata server’s omaconfig.xml file.
If you have SAS/SECURE, you can upgrade to AES. See “How to Increase
Encryption Strength for Outbound
Passwords in Transit” on page 206.
SASProprietary Not configurable.
Encryption Model
4 How Are SAS/SECURE Features Surfaced?
201
Content and Context
Other data in transit to and from SAS servers
Data (including passwords) in transit between a Web browser and a Web application server
Algorithm
None
None
Configuration
CEL object server parameter.
See the SAS Intelligence Platform: Web
Application Administration Guide.
1 If you don’t have SAS/SECURE, SASProprietary is used.
About SAS/SECURE
What Does SAS/SECURE Provide?
SAS/SECURE makes industry-standard encryption algorithms available for use in the SAS Intelligence Platform as follows:
3
SAS/SECURE enables you to provide stronger protection for data in transit than is provided by SASProprietary encoding. This affects communications among SAS servers and between SAS servers and SAS desktop clients. Here are the supported algorithms by host:
3
3
On UNIX and z/OS, SAS/SECURE supports AES (Advanced Encryption
Standard), AES predecessors (DES and TDES), and the RC4 and RC2 algorithms.
On Windows, SAS/SECURE supports algorithms that are included in the
Microsoft Cryptographic API.
3
SAS/SECURE enables you to provide stronger protection for stored passwords than is provided by SASProprietary encoding. This affects both passwords that are stored in the metadata and passwords that are included in configuration files. The only supported industry-standard algorithm for stored passwords is AES (SAS003).
CAUTION:
Passwords that are stored in SAS003 format become unusable and inaccessible if
SAS/SECURE is unavailable.
If SAS/SECURE is installed, the default format for stored passwords is SAS003. It is important to keep your SAS/SECURE license current. If you choose to discontinue use of SAS/SECURE, you must revert all stored passwords to SAS002 format before uninstalling the software. To revert passwords, set STOREPASSWORDS="SAS002", restart the metadata server, and use SAS Management Console to re-enter passwords in any logins that need to include passwords.
4
Note:
In the SAS Intelligence Platform, SAS/SECURE provides only encryption features. Other security features (such as metadata authorization, single sign-on, and use of SSL by SAS applications that run in a third-party Web application server) are not related to SAS/SECURE.
4
How Are SAS/SECURE Features Surfaced?
SAS/SECURE isn’t an interactive software product (like SAS Management Console) or a product that has its own SAS language elements (like SAS/ACCESS). In the SAS
Intelligence Platform, SAS/SECURE features are surfaced as follows:
202 Licensing and Availability of SAS/SECURE
4 Chapter 15
3
3
In server invocation commands, the -netencralg option support values other than
SASProprietary only if you have SAS/SECURE.
In SAS Management Console, server encryption algorithm values other than
SASProprietary are supported only if you have SAS/SECURE.
Note:
All algorithms are listed regardless of whether you have SAS/SECURE. Do not select a value other than SASProprietary unless you have licensed SAS/
SECURE. Use the same algorithm and level on all servers.
4
3
3
In the PWENCODE procedure, the METHOD option supports the SAS003 value
(AES) only if you have SAS/SECURE.
In the RETURNPASSWORDS and STOREPASSWORDS options in the metadata server’s omaconfig.xml file, the SAS003 value (AES) is supported only if you have
SAS/SECURE.
Licensing and Availability of SAS/SECURE
Licensing and availability for SAS/SECURE is as follows:
3
Although SAS/SECURE is automatically included in all deployment plan files that include Base SAS, SAS/SECURE is not licensed as part of Base SAS. SAS/
SECURE requires a separate license on each SAS server machine. Client-side licenses are not needed.
3
3
Availability of SAS/SECURE is subject to import and export restrictions. Some countries have import restrictions on products that contain encryption. The U.S.
has export restrictions on products that contain encryption.
SAS/SECURE is not supported on VMS.
See Also:
Chapter 16, “Encryption Tasks,” on page 203
Encryption in SAS
