What does the Service Connector do, in technical terms?

Question

Hello,
My client is implementing SAP for the first time, and we're setting up the SAP remote support infrastructure (SNC over Internet).
The security team is concerned with the step where the Service Connector is run on a PC to open the network connection (if not already open).
I understand the Service Connector is downloading the stfk.oez file from SAP Support web site, and then executes an RFC call through the SAP Routers.
But question is - what does this RFC call actually do, technically speaking? Is it actually making some configuration changes in the SAP Routers? If so, is there any security mechanism in Service Connector preventing an unauthorized person to make a configuration change remotely on the SAP Router(s) ?
Or is the Service COnnector merely "pinging" SAP support backbone in order to "kickstart" the connection? I can't imagine why this would be required, normally you don't need to estblish a "network connection" in this way.
Or is the RFC call creating some kind of "RFC tunnel" (??) between SAP Router and SAP support backbone, that will allow SAP to access and reuse the very same RFC connection thread with their different protocols (SAP Gui, telnet, whatever...)
I've read all dokumentation at service.sap.com/access-support and e.g. related SAP notes e.g. 35010.
Nowhere is it explained what the Service Connector actually does and what is meant by "open network connection".
Another way to ask this question is:
- In SAP Support web site only an authorized person can configure the "service connection" and define a time window when SAP can access the systems
- Why is there a second step needed to open the "network connection", initiated from customer's PC. Why is this step required at all?
Anybody out there who can elobarate on an answer for this?
Thanks,
Lars

Answer 1

Hi Lars,
Would the information in the link below help you?
https://websmp208.sap-ag.de/~sapidb/011000358700002294272006E
From what I understand, the only thing that Service Connector does is to "give the approval and the connection parameters" to your local SAP Router to initiate a network tunnel between your local SAP Router and SAP's SAP Router.
I hope this helps.