This document discusses security concerns with web-based ERP systems. It outlines several security issues including physical security, transmission security, storage security, access security, and data security. It also describes common security problems like resource protection, data confidentiality, and authentication. The document then provides an overview of ERP architecture and the typical 3-tier architecture before examining current security solutions like role-based access control. It analyzes security in SAP/R3 systems and proposes an open security model for the future.

1. Security concerns in Web ERP
Manoj Jhawar
MBA 2nd year
12125027

2. Overview
• ERP is experiencing the transformation that
will make it much more intelligent,
collaborative, web enabled, highly integrated
may become wireless
• ERP solutions worked upon common use of
distributed application which causes security
problems

3. Security issues
•
•
•
•
•
•
Physical Security
Transmission Security
Storage Security
Access Security
Data Security
Application Security

4. Several security problems are
•
•
•
•
•
•
•
Resource protection
Data confidentiality
Data integrity
Authentication of user
Non repudiation of transaction
Reliability of user
Anonymity of user

5. ERP Architecture
• Integration—various components are integrated and
seamless data flow occurs between components to
collaborate as a single function.
• Flexible—system is flexible, compatible and expandable
with the old systems, changes to the business processes
and strategies are easy to accomplish.
• Real-time—different components works in online, real time
and batch processing modes should be presented.
• Componentization—different business functional
requirement are designed as different components.
• Tailorable—system should be simply configured according
to the enterprise’s requirements.

6. 3 tier Architecture
•
•
•
1. Front layer of Presentation Layer:
A combined Graphical User Interface
(GUI) or any browser that collects
data, generates requests, and
proceeds the results back to the user.
2. Middle layer of Application:
Application programs that collects
the requirements from the
Presentation layer and further routes
the request based on the business
function, rules or logic.
3. Database Layer (Back): Data Base
Management Systems that manages
the business and operational data
throughout the entire enterprise.

7. Current security solutions in ERP
• Role-Based
Access Control
–
–
–
–
Roles
Permissions
Users
Constraints

8. Security in SAP/R3
• Authorization object- This represents the authorization concept and
consists of some authorization fields.
• Authorization- This is an instance of one authorization object and defines
permitted value range of each authorization field of the authorization
object.
• Authorization profile- This contains some authorizations which are
assigned to the user by an administrator.
• Authorization check- This is used to protect the transactions or data we
choose and is embedded in program logic. When authorization check is
performed then authorization profile will be used for comparing the
required values needed to run the specific transaction.
• User master record- This enables the users to log on to R/3 system and
grant limited entry to the transactions and data.
• Profile generator- This is the component which helps the administrators
create, generate, and assign authorization profiles using activity groups
and user

9. Diagram of SAP R/3 Authorization

10. Open security Model
•
•
•
1. XML encryption 2. XML
signature 3. SAMLconfiguration parameters.
Constructing a new security
layer and connecting it into
the
already
existing
architecture,
requires
considering
different
provision
of
individual
security needs
Appropriate profile processor
is able to audit all incoming
messages
for
security
fulfillments on the own
security profile and also to
extend all outgoing messages
according to the security
policy of remote peer.

11. Future security features
• Intelligent
• Knowledgebased
• Heterogeneous
• Collaborative
• Wireless

12. Conclusion
• Existing security solutions like RBAC or SAP R/3 are based on
the features of the current ERP system and since ERP reveals
more and more new features that may be supported in the
future, present security mechanism needs to be retrofitted
and new security issues have to be identified
• In open security model proposed above we see that the
division of transport data and content is the key-note area
of the introduced security model
• The prefixed article builds an open architecture which will
not only considers the integration of existing security
standards such as XML encryption or XML signature or SAML
but will also aids future developments like Trusted Platforms