Encrypted RFC Connections between biz²ScanServer and SAP
The document processing server biz²ScanServer can now be extended with SAP SNC encryption. If you run your SAP system in the cloud-based RISE environment, you implement SAP’s security recommendation and add an extra layer of protection to the communication between biz²ScanServer and SAP.
biz²ScanServer at a Glance
biz²ScanServer is the central entry point for all documents that reach your company. Paper mail is scanned, while electronic input such as PDF files, email attachments or XML files is taken over directly. biz²ScanServer then automatically identifies each document, classifies it and passes it on to the appropriate business process in SAP. Manual sorting and distribution of incoming mail is no longer necessary.
SAP’s Security Recommendation for RISE
RISE with SAP is SAP’s subscription-based cloud offering. It bundles the ERP system SAP S/4HANA Cloud, the infrastructure in an SAP data center or with a hyperscaler, and technical operations by SAP. This means that the SAP system no longer runs in your own data center but in a cloud environment operated by SAP.
For RISE with SAP, SAP recommends establishing RFC connections via SNC parameters rather than a combination of user name and password. This recommendation applies to all applications that communicate with an SAP system in RISE via RFC – including biz²ScanServer, whose RFC connection is already well protected by existing security measures.
What Is SAP SNC?
Secure Network Communications (SNC) is a security layer in the SAP system. It integrates a security product – such as SAP Single Sign-On or a third-party solution – that provides the cryptographic functions for protected communication. SNC secures connections using the SAP protocols RFC and DIAG: RFC (Remote Function Call) covers system access, for example by biz²ScanServer, while DIAG (Dynamic Information and Action Gateway) covers user access via SAP GUI. Three levels of protection are available:
- Authentication: Both communication partners verify their identity.
- Integrity protection: Any changes to the transmitted data are detected.
- Privacy protection: The data is transmitted in encrypted form. For connections using standard protocols such as HTTP, TLS performs this task.
The SNC Extension for biz²ScanServer
SNC does not replace existing security measures – it complements them. Within a uniformly protected network segment, the RFC connection is often already secured by network segmentation, firewall rules and a technical user with minimal authorizations.
However, when connections cross trust boundaries – for example via public networks or between systems with different security levels – encryption at application level is recommended. This is where the new encryption extension comes in: With the add-on module, biz²ScanServer establishes the RFC connection to the SAP system via SAP SNC instead of user name and password.
Your Benefits at a Glance
- Implementation of SAP’s security recommendation for RISE with SAP
- Encryption of RFC communication at application level – end to end from biz²ScanServer to the SAP system
- No more user name/password combination in the RFC connection
- Future-proof operation of your inbound document processing in RISE environments
Do you run your SAP system in RISE, are you planning to migrate, or would you like to add extra protection to your biz²ScanServer’s RFC communication?
Contact us – we will be happy to advise you on the encryption extension and support you with the setup.