Encryption Model. SAS 9.2 Security Administration Guide

C H A P T E R

15

Encryption Model

Encryption Strength and Coverage

199

Two Classes of Encryption Strength

199

Two Contexts for Encryption Coverage

199

Default Settings for On-Disk Encryption

199

Default Settings for Over-the-Wire Encryption

200

About SAS/SECURE

201

What Does SAS/SECURE Provide?

201

How Are SAS/SECURE Features Surfaced?

201

Licensing and Availability of SAS/SECURE

202

Encryption Strength and Coverage

Two Classes of Encryption Strength

SAS offers two classes of encryption strength:

3

If you don’t have SAS/SECURE, you can use only the SASProprietary algorithm.

SASProprietary encoding uses 32-bit keys and is appropriate for preventing accidental exposure of information. SASProprietary is licensed with Base SAS software and is available in all deployments.

3

If you have SAS/SECURE, you can use an industry-standard encryption algorithm such as AES. SAS/SECURE is an add-on product that is licensed separately and offers maximum protection.

Two Contexts for Encryption Coverage

SAS provides encryption in two contexts:

3

On-disk encryption protects data at rest. The emphasis is on protection of passwords, both in configuration files and in the metadata repository.

3

Over-the-wire encryption protects data while in transit. The emphasis is on protection of credentials, but you can also choose to protect all traffic in transit.

Default Settings for On-Disk Encryption

On-disk encryption protects data at rest. The following table describes initial support:

199

200 Default Settings for Over-the-Wire Encryption

4 Chapter 15

Table 15.1

On-Disk Encryption and Encoding

Content and Context

Password on disk in the metadata

Password on disk in a configuration file

Most other metadata on disk

SAS data sets on disk

Algorithm

AES

1

Configuration

Controlled by the STOREPASSWORDS option in the metadata server’s omaconfig.xml file.

SASProprietary If you have SAS/SECURE, you can upgrade to

AES. See “Password Updates for Service

Accounts” on page 14.

None Not configurable.

None To apply encryption, use the ENCRYPT= data set option.

2

1 If you don’t have SAS/SECURE, SASProprietary is used.

2 The ENCRYPT= data set option uses a proprietary encryption algorithm that is not the same as the SASProprietary algorithm. See the SAS Language Reference: Dictionary.

Note:

Configuration files and metadata repository data sets should also be host protected.

4

Default Settings for Over-the-Wire Encryption

Over-the-wire encryption protects data while in transit. The following table describes initial support:

Table 15.2

Over-the-Wire Encryption and Encoding

Content and Context

Password in transit when a user logs on to a SAS desktop application

Password in transit when a user connects directly to the OLAP server

(for example, from a SAS data provider)

Password in transit when a user connects to the metadata server from a

Base SAS session

Password in transit when a client retrieves a stored password from the metadata

Password in transit when a client sends a password to the metadata for storage

Algorithm

AES

1

AES

1

Configuration

NETENCRALG option in the metadata server’s invocation command.

NETENCRALG option in the server’s invocation command.

AES

1

NETENCRALG option in the server’s invocation command. Can be affected by the METAENCRYPTALG option in the client session.

SASProprietary RETURNPASSWORDS option in the metadata server’s omaconfig.xml file.

If you have SAS/SECURE, you can upgrade to AES. See “How to Increase

Encryption Strength for Outbound

Passwords in Transit” on page 206.

SASProprietary Not configurable.

Encryption Model

4 How Are SAS/SECURE Features Surfaced?

201

Content and Context

Other data in transit to and from SAS servers

Data (including passwords) in transit between a Web browser and a Web application server

Algorithm

None

None

Configuration

CEL object server parameter.

See the SAS Intelligence Platform: Web

Application Administration Guide.

1 If you don’t have SAS/SECURE, SASProprietary is used.

About SAS/SECURE

What Does SAS/SECURE Provide?

SAS/SECURE makes industry-standard encryption algorithms available for use in the SAS Intelligence Platform as follows:

3

SAS/SECURE enables you to provide stronger protection for data in transit than is provided by SASProprietary encoding. This affects communications among SAS servers and between SAS servers and SAS desktop clients. Here are the supported algorithms by host:

3

3

On UNIX and z/OS, SAS/SECURE supports AES (Advanced Encryption

Standard), AES predecessors (DES and TDES), and the RC4 and RC2 algorithms.

On Windows, SAS/SECURE supports algorithms that are included in the

Microsoft Cryptographic API.

3

SAS/SECURE enables you to provide stronger protection for stored passwords than is provided by SASProprietary encoding. This affects both passwords that are stored in the metadata and passwords that are included in configuration files. The only supported industry-standard algorithm for stored passwords is AES (SAS003).

CAUTION:

Passwords that are stored in SAS003 format become unusable and inaccessible if

SAS/SECURE is unavailable.

If SAS/SECURE is installed, the default format for stored passwords is SAS003. It is important to keep your SAS/SECURE license current. If you choose to discontinue use of SAS/SECURE, you must revert all stored passwords to SAS002 format before uninstalling the software. To revert passwords, set STOREPASSWORDS="SAS002", restart the metadata server, and use SAS Management Console to re-enter passwords in any logins that need to include passwords.

4

Note:

In the SAS Intelligence Platform, SAS/SECURE provides only encryption features. Other security features (such as metadata authorization, single sign-on, and use of SSL by SAS applications that run in a third-party Web application server) are not related to SAS/SECURE.

4

How Are SAS/SECURE Features Surfaced?

SAS/SECURE isn’t an interactive software product (like SAS Management Console) or a product that has its own SAS language elements (like SAS/ACCESS). In the SAS

Intelligence Platform, SAS/SECURE features are surfaced as follows:

202 Licensing and Availability of SAS/SECURE

4 Chapter 15

3

3

In server invocation commands, the -netencralg option support values other than

SASProprietary only if you have SAS/SECURE.

In SAS Management Console, server encryption algorithm values other than

SASProprietary are supported only if you have SAS/SECURE.

Note:

All algorithms are listed regardless of whether you have SAS/SECURE. Do not select a value other than SASProprietary unless you have licensed SAS/

SECURE. Use the same algorithm and level on all servers.

4

3

3

In the PWENCODE procedure, the METHOD option supports the SAS003 value

(AES) only if you have SAS/SECURE.

In the RETURNPASSWORDS and STOREPASSWORDS options in the metadata server’s omaconfig.xml file, the SAS003 value (AES) is supported only if you have

SAS/SECURE.

Licensing and Availability of SAS/SECURE

Licensing and availability for SAS/SECURE is as follows:

3

Although SAS/SECURE is automatically included in all deployment plan files that include Base SAS, SAS/SECURE is not licensed as part of Base SAS. SAS/

SECURE requires a separate license on each SAS server machine. Client-side licenses are not needed.

3

3

Availability of SAS/SECURE is subject to import and export restrictions. Some countries have import restrictions on products that contain encryption. The U.S.

has export restrictions on products that contain encryption.

SAS/SECURE is not supported on VMS.

See Also:

Chapter 16, “Encryption Tasks,” on page 203

Encryption in SAS