## 13.13.4.2.3  Insurance Product Engine msg.PMQ
With the insurance product engine msg.PMQ, you can define and calculate insurance products. msg.PMQ consists of the following:
- PMQ.Designer
During the product development, a multi-layered security concept for the protection of the product data against unauthorized access is effective.
Product data are copied for processing into the local file system of the computer on which PMQ.Designer is installed. It should be ensured administratively by operating system means that exclusively the user that has copied those data may access them. On the supported systems, e.g. that is often already achieved by storing the data inside the home directory of the user. Beyond that for protection against hardware theft it is recommended to encrypt the volume on which the product data are stored.
During the local processing of product data, the user may modify all product data files, either by PMQ.Designer means or by external tools (e.g. text editors). For that purpose PMQ.Designer does not have an own user and permissions management. By integration with a version control system, however that functionality is provided implicitely.
For central storage and for distributed processing of product data, it is mandatory to connect PMQ.Designer with a version control system. On the level of the version control system, security mechanisms are effective that prevent unauthorized retrieval and transfer back respectively modification of the product data. All modern version control systems offer a user management for that purpose and allow the fine-grained granting of read and write permissions on the product data for individual users or user groups. The granting of user permissions ensues administratively by the means of the respectively used version control system. It is recommended to define all permitted users and their permissions at least on the top level of every repository of the version control system. It is not recommended to permit anonymous access to the product data, neither for read operations.
The communication between PMQ.Designer and a version control system usually takes place via webbased protocols (HTTP). It is recommended only to use secured connections for this purpose. If other protocols are used, an adequate encryption should be used.
## · MSGPMCON
The msg.PM connection (MSGPMCON) is the link between msg.PMQ and Insurance Policy Management (FS-PM) as part of SAP S/4HANA.
- TOMATOSJ
TOMATOSJ has to be secured on operational level against unauthorized accesses.
On the one hand, installation and administration of TOMATOSJ XSA instances should be permitted for authorized user groups only. This has to be ensured administratively by mechanisms of the XSA platform. Furthermore, the access to all file system directories that are configured for TOMATOSJ, should be restricted to authorized user groups by operating system means. This is especially valid for the directory in which the product data are stored.
Particularly to highlight is that TOMATOSJ should only be executed in an especially protected network area (high-security area).
The communication with TOMATOSJ for calculation requests takes place via web-based services (REST services). For that purpose exclusively secured connections are recommended. A web interface or other accesses (e.g. for administration) are not provided. Because of that on the level of the services no user group-specific accesses are neither necessary nor provided.
TOMATOSJ does not change nor save data of Policy Management (FS-PM). As a result of calculation requests only new respectively derived data are being created and returned to FS-PM. The further processing of the result data falls to FS-PM.
For more information, see the attachments in SAP Note 2635866 .