Integrating Cryptar with SAP: A Step-by-Step Guide

For manufacturers running SAP ERP and PLM systems, integrating cryptographic verification capabilities doesn't require replacing existing infrastructure. This guide walks through the technical steps for adding Cryptar protocol support to SAP S/4HANA and SAP Product Lifecycle Management.

Architecture Overview

The integration follows a sidecar pattern: SAP remains the system of record for product and manufacturing data, while Cryptar provides cryptographic sealing and verification as a complementary service. Data flows in one direction—from SAP to Cryptar—preserving SAP as the authoritative source.

Integration Points

• Master data: Product specifications, material declarations, supplier information
• Manufacturing execution: Batch records, quality test results, assembly traceability
• Supply chain: Incoming material certificates, supplier declarations

Step 1: API Connectivity

SAP's Cloud Platform Integration (CPI) provides the connectivity layer. Create an integration flow that:

1. Listens for relevant business events (e.g., goods receipt, quality inspection complete)
2. Extracts necessary data from SAP using OData or BAPI calls
3. Transforms the data into the JSON-LD structure required by Cryptar's API
4. Invokes the Cryptar sealing endpoint
5. Stores the returned evidence file reference in SAP as a document attachment

Code Example

// Groovy script for SAP CPI
import com.sap.gateway.ip.core.customdev.util.Message

def Message processData(Message message) {
    // Extract batch data from SAP
    def body = message.getBody(String)
    def batchData = new groovy.json.JsonSlurper().parseText(body)

    // Transform to Cryptar format
    def evidenceRequest = [
        subject: "urn:batch:${batchData.BatchNumber}",
        claims: [
            material: batchData.MaterialNumber,
            quantity: batchData.ProducedQuantity,
            qualityStatus: batchData.InspectionResult
        ],
        metadata: [
            plant: batchData.ProductionPlant,
            timestamp: batchData.ProductionDate
        ]
    ]

    message.setBody(groovy.json.JsonOutput.toJson(evidenceRequest))
    return message
}

Step 2: Event Triggers

Configure SAP Event Mesh to trigger sealing for relevant business events:

• Quality notification status change to "Approved"
• Production order confirmation with final status
• Goods receipt with incoming inspection

Event Filter Example

{
  "Source": "SAP/QM/QualityNotification",
  "Type": "StatusChanged",
  "Filter": {
    "NewStatus": "APPROVED",
    "DPPRelevant": true
  }
}

Step 3: Evidence File Storage

Store Cryptar evidence files using SAP Document Management Service (DMS). Create a custom document type "DPP_EVIDENCE" with metadata fields:

• Evidence File ID
• Seal Timestamp
• Related Business Object (Material, Batch, etc.)
• Verification URL

Step 4: User Interface Extensions

Extend SAP Fiori applications to display verification status. For Material Master, add a "Sustainability Evidence" section showing:

• List of sealed data points (recycled content, carbon footprint, etc.)
• Seal timestamp and status (valid/expired)
• One-click verification link

Fiori Extension Code

// SAPUI5 controller extension
onVerifyEvidence: function(oEvent) {
    var sEvidenceId = oEvent.getSource().data("evidenceId");

    // Call Cryptar verification API
    $.ajax({
        url: "https://api.cryptar.de/v1/verify/" + sEvidenceId,
        method: "GET",
        success: function(result) {
            if (result.valid) {
                sap.m.MessageToast.show("Evidence verified successfully");
            } else {
                sap.m.MessageBox.error("Evidence verification failed: " + result.reason);
            }
        }
    });
}

Step 5: Batch Processing for Historical Data

For existing products, create a one-time migration program that:

1. Identifies DPP-relevant materials
2. Extracts current sustainability data from SAP
3. Seals the data with appropriate effective dates
4. Links evidence files to material master records

Performance Considerations

Sealing operations introduce minimal latency (typically 200-500ms). For high-volume scenarios, implement asynchronous processing:

• Queue sealing requests in SAP Event Mesh
• Process in batches during off-peak hours
• Update SAP records with evidence file references asynchronously

Security Architecture

API authentication uses OAuth 2.0 client credentials flow. Store credentials in SAP Credential Store, not in integration flow code. Rotate credentials every 90 days using automated scripts.

Network Security

• Use SAP Cloud Connector for on-premise SAP systems
• Configure IP allowlisting for Cryptar API access
• Enable TLS 1.3 with certificate pinning

Monitoring and Operations

Configure SAP Cloud ALM to monitor:

• Sealing operation success rate
• API response times
• Evidence file storage growth
• Verification request volumes

Set up alerts for sealing failures to ensure continuous DPP compliance coverage.

Total Implementation Timeline

Based on multiple customer implementations, expect:

• Weeks 1-2: Architecture design and SAP system analysis
• Weeks 3-4: CPI integration flow development
• Weeks 5-6: Fiori UI extensions and testing
• Weeks 7-8: User acceptance testing and pilot rollout
• Week 9: Production deployment

Post-implementation, most manufacturers find that the system operates with minimal ongoing maintenance, requiring attention only when adding new product categories or adjusting data capture points.