Credit Card Encryption through RFC calls to third party software

Question

Dear All,
   I am working on credit card encryption in CRM. At our firm, we have SAP R/3 which is integrated with third party server for performing credit card encryption using RFC calls. We want to perform similar thing in SAP CRM. I was looking into SAP standard mechanism to perform encryption and it seems they use class CL_PCA_SECURITY -> External Encryption to encrypt credit card. Are there any BADIs available for me to change behaviour of this call and call our listeners (for third party server) instead of what standard SAP is calling. Here is what in the code:
call C function 'SSFENVELOPE'
  CALL 'SSF_ABAP_SERVICE'                                 "#EC CI_CCALL
       ID 'OPCODE'             FIELD   SSF_OPCODES-ENVELOPE
       ID 'SECTOOLKIT'         FIELD   SSFTOOLKIT
       ID 'STRFORMAT'          FIELD   STR_FORMAT
       ID 'STRFORMATL'         FIELD   STR_FORMAT_L
       ID 'BINENC'             FIELD   B_INENC
       ID 'IOSPEC'             FIELD   IO_SPEC
       ID 'OSTRINPUTDATAL'     FIELD   OSTR_INPUT_DATA_L
       ID 'STRPAB'             FIELD   STR_PAB
       ID 'STRPABL'            FIELD   STR_PAB_L
       ID 'STRPABPASSWORD'     FIELD   STR_PAB_PASSWORD
       ID 'STRPABPASSWORDL'    FIELD   STR_PAB_PASSWORD_L
       ID 'OSTRENVELOPEDDATAL' FIELD   OSTR_ENVELOPED_DATA_L
       ID 'CRC'                FIELD   CRC
       ID 'OSTRINPUTDATA'      FIELD   OSTR_INPUT_DATA-SYS
       ID 'RECIPIENTLIST'      FIELD   RCPTAB-SYS
       ID 'OSTRENVELOPEDDATA'  FIELD   OSTR_ENVELOPED_DATA-SYS
       ID 'STRSYMENCRALG'      FIELD   STR_SYM_ENCR_ALG
       ID 'STRSYMENCRALGL'     FIELD   STR_SYM_ENCR_ALG_L.

Answer 1

Vivek,
While it may be technically possible to accomplish what you are suggesting (leveraging the encryption functionality provided by your third-party server) I would recommend strongly that you consider a token-based solution instead.  You can learn more about tokenization on this [blog|/people/eric.bushman4/blog/2009/01/02/tokenization-as-a-means-of-securing-credit-card-numbers ].
There are many reasons why a token-based solution is superior to using application specific encryption (as outlined in the blog), but specifically in the case you describe where an SAP CRM and SAP R/3 are involved there is one specific reason to consider:
When order data is replicated between SAP CRM and SAP R/3 the systems will attempt to decrypt the credit card numbers prior to passing the data and therefore the RAW card number will be stored in the middleware logs.  This is especially true when using SAP's native credit card encryption logic in the CRM and R/3-ECC applications. 
For example, let's say a user enters a credit card as the form of payment during Order Creation in CRM.  At Order Save the system will send the credit card information to your third-party server for an authorization attempt and the results will be returned to CRM.  As the Order is saved and committed to the CRM database the standard SAP encryption functionality can be leveraged to encrypt the card data.  Based on your middleware configuration, eventually the Order data (including the credit card details) will be sent to the R/3 or ECC system.  In order to do so the CRM system will first decrypt the card number meaning that the CRM middleware logs will contain RAW card numbers.  When the Order is created in R/3 or ECC the native credit card encryption functionality in R/3 or ECC could be used to encrypt the card number prior to the Order being stored in the database.
Should you choose to use a third-party server you may find, depending on how the third-party vendor's logic works in SAP, that you must utilize a BADI to decrypt the card number in CRM so that the CRM middleware has a RAW card and so that when the Orders is saved in the R/3 or ECC system it can be encrypted again with the third-party vendor solution.  In either case the RAW card number is present in all systems for some period of time and potentially stored in logs thus exposing your systems to risk and greater PCI audit scrutiny.
Eric Bushman
VP, Solutions Engineering
[Paymetric|https://www.paymetric.com]