We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byLexus Forte
Modified over 2 years ago
© 2006 IBM Corporation Introduction to z/OS Security Lesson 4: There’s more to it than RACF
© 2006 IBM Corporation 2 Objectives At the completion of this topic the student should be able to provide a brief overview of the security related elements of the z/OS operating system
© 2006 IBM Corporation 3 Key terms SAF RACF PKI Services ITDS for z/OS ICSF OCSF OCEP EIM
© 2006 IBM Corporation 4 Introduction This lesson briefly discusses the key elements of z/OS that address different security needs. Technologies such as Secure Sockets Layer (SSL), Kerberos V5, Public Key Infrastructure, multilevel security and exploitation of IBM mainframe cryptographic features are available in z/OS. Integrated Cryptographic Service Facility (ICSF) is a part of z/OS which provides cryptographic functions for data security, data integrity, personal identification, digital signatures and the management of cryptographic keys. Together with cryptography features of System z9 and zSeries servers, z/OS provides high- performance SSL.
© 2006 IBM Corporation 5 Introduction z/OS provides support for digital certificates, including the ability to provide full life-cycle management. With Public Key Infrastructure Services in z/OS, customers can create and manage digital certificates, leveraging their existing z/OS mainframe investments. z/OS, together with DB2 Universal Database™ for z/OS Version 8, provides a solution for multilevel security on the System z mainframe. This support provides row-level security labeling in DB2 and protection in z/OS designed to meet the stringent security requirements of multi-agency access to data. This solution leverages System z leadership to enable highly secure single database hosting.
© 2006 IBM Corporation 6 SAF SAF is the System Access Facility element of z/OS. Its purpose is to provide the interface between those products requesting security services and the external security manager installed on the z/OS system. SAF is NOT part of RACF SAF is a component of MVS (z/OS BCP) SAF provides an installation with centralized control over system security processing by using a system service called the SAF router. The SAF router provides a focal point and a common system interface for all products providing resource control. External security managers (ESMs) provide tables to SAF which direct specific calls for security functions to specific routines within the ESM. The use of these tables allows z/OS to provide support for pluggable ESMs giving the installation the flexibility to determine which ESM to use. SAF and the SAF router are present on all z/OS systems regardless of whether an ESM is installed
© 2006 IBM Corporation 7 The SAF Router For each request type presented to SAF, a different routine is accessed. The location of these routines are in the SAF Routing Table
© 2006 IBM Corporation 8 RACF RACF is the Resource Access Control Facility. It is NOT an entitlement of the z/OS operating system, but is a priced feature. Customers pay extra for RACF. RACF provides the capability to uniquely describe resources, users, and the relationships between them. When users attempt to access a resource the system calls RACF to indicate whether or not that user has the requested access permissions. It is then the system's decision, not RACF's, to allow or deny the access request.
© 2006 IBM Corporation 9 PKI Services The z/OS PKI Server is a complete Certification Authority package, always enabled independently of the installed security manager. The Certification Authority keys are located in a secure file or within the ESM (like RACF). The z/OS PKI can be a root CA or an intermediate CA. It provides these functions to implement and perform full certificate life cycle management: –User request driven via customizable Web pages –Automatic or administrator approval process –End user / administrator revocation process With PKI Services, z/OS installations have the capability to establish a PKI infrastructure and serve as a certificate authority for internal and external users.
© 2006 IBM Corporation 10 ITDS for z/OS (LDAP) LDAP defines a standard method for accessing and updating information in a directory. LDAP has gained wide acceptance as the directory access method of the Internet and is therefore also becoming strategic within corporate intranets. It is being supported by a growing number of software vendors and is being incorporated into a growing number of applications. Netscape and Microsoft Internet Explorer, as well as application middleware, such as the IBM WebSphere Application Server or the IBM HTTP server, support LDAP functionality as a base feature. ITDS = IBM Tivoli Directory Services
© 2006 IBM Corporation 11 ICSF The Integrated Cryptographic Services Facility acts as the device interface for the cryptographic hardware on z systems. ICSF provides support for the following: –The Commercial Data Masking Facility (CDMF), an exportable version of DES cryptography –DES and Triple DES encryption for privacy –The transport of data keys through the use of the RSA public key algorithm –The generation and verification of digital signatures through the use of both the RSA and the Digital Signature Standard (DSS) algorithm –The generation of RSA and DSS key. –The SET Secure Electronic Transaction standard, which was created by Visa International and MasterCard –The PKA Encrypt and PKA Decrypt callable services that can be used to enhance the security and performance of Secure Sockets Layer (SSL) security protocol applications
© 2006 IBM Corporation 12 System SSL Secure Sockets Layer (SSL) is a communications protocol that provides secure communications over an open communications network (for example, the Internet). The SSL protocol is a layered protocol that is intended to be used on top of a reliable transport, such as Transmission Control Protocol (TCP/IP). SSL provides data privacy and integrity as well as server and client authentication based on public key certificates. Once an SSL connection is established between a client and server, data communications between client and server are transparent to the encryption and integrity added by the SSL protocol. System SSL supports the SSL V2.0, SSL V3.0 and TLS (Transport Layer Security) V1.0 protocols. TLS V1.0 is the latest version of the secure sockets layer protocol.
© 2006 IBM Corporation 13 OCSF Open Cryptographic Service Facility (OCSF) These components work together to provide software based encryption to z/OS The OCSF Architecture consists of a set of layered security services and associated programming interfaces designed to furnish an integrated set of information and communication security capabilities. The security services available in the OCSF are defined by the categories of service provider modules that the architecture accommodates. These service providers are: –Cryptographic Services –Trust Policy Libraries –Certificate Libraries –Data Storage Libraries.
© 2006 IBM Corporation 14 OCEP OCEP consists of two service provider modules (which are also called "plug-ins") that are intended to be used with the Open Cryptographic Services Facility (OCSF) Framework: –Trust Policy –Data Storage Library These service provider modules enable applications to use z/OS Security Server (RACF), or equivalent product, to provide security functions for digital certificates and key rings. The OCEP service provider modules implement a subset of the application programming interfaces (APIs) that are defined by OCSF. Applications can use these OCEP service provider modules, and their supported APIs, to retrieve and use digital certificates and private keys that are stored in the RACF database on an z/OS system. In addition to the OCSF Framework, the OCEP service provider modules are intended to work with the OCSF Certificate Library and Cryptographic Service Provider modules.
© 2006 IBM Corporation 15 EIM The problem: Too many Identities –Today's network environments are made up of a complex group of systems and applications, resulting in the need to manage multiple user registries. Dealing with multiple user registries quickly grows into a large administrative problem that affects users, administrators, and application developers. The solution: Enterprise Identity Mapping –EIM allows administrators and application developers to address this problem more easily and inexpensively than previously possible. –EIM allows one-to-many mappings (in other words, a single user with more than one user identity in a single user registry). –EIM also allows many-to-one mappings (in other words, multiple users mapped to a single user identity in a single user registry).
© 2006 IBM Corporation 16 Summary z/OS provides many different elements that address different security needs. Installations can use user IDs and passwords, UIDs, and digital certificates to provide mechanisms to authenticate an identity. z/OS can be a Certificate Authority, dispensing digital certificate and the accompanying public and private keys for large scale secure infrastructures Hardware and software work together to provide encryption facilities through ICSF and OCSF, independent of the underlying cryptographic facilities Communications can be secured, whether inbound or outbound, through secure sockets from or to any other platform. The problem of multiple identities for a single user can be addressed by mapping the constructs together in a single application that can be queried from anywhere in the enterprise
Washington System Center © 2005 IBM Corporation August 25, 2005 RDS Training Secure Socket Layer (SSL) Overview z/Series Security (Mary Sweat, Greg Boyd)
70-293: MCSE Guide to Planning a Microsoft Windows Server 2003 Network, Enhanced Chapter 9: Planning and Managing Certificate Services.
Module 9: Fundamentals of Securing Network Communication.
Building Security into Your System Bill Major Gregory Ponto.
Chapter 23 Internet Authentication Applications Kerberos Overview Initially developed at MIT Software utility available in both the public domain and.
Creating and Managing Digital Certificates Chapter Eleven.
E-Commerce Security Technologies : Theft of credit card numbers Denial of service attacks (System not availability ) Consumer privacy (Confidentiality.
Security Protocols and E-commerce University of Palestine Eng. Wisam Zaqoot April 2010 ITSS 4201 Internet Insurance and Information Hiding.
ELECTROINC COMMERCE TOOLS Chapter 6. Outline 6.0 Introduction 6.1 PUBLIC KEY INFRASTRUCTURE (PKI) AND CERTIFICATE AUTHORITIES (CAs) TRUST
Chapter 9: Using and Managing Keys Security+ Guide to Network Security Fundamentals Second Edition.
1.1 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 1: Introducing Windows Server.
Chapter 10 Encryption: A Matter of Trust. Awad –Electronic Commerce 1/e © 2002 Prentice Hall 2 OBJECTIVES What is Encryption? Basic Cryptographic Algorithm.
11 DESIGNING A PUBLIC KEY INFRASTRUCTURE Chapter 9.
Module 2: Introducing Windows 2000 Security. Overview Introducing Security Features in Active Directory Authenticating User Accounts Securing Access to.
Java Security Model Lab#1 I. Omaima Al-Matrafi. Safety features built into the JVM Type-safe reference casting Structured memory access (no pointer arithmetic)
Wolfgang Schneider NSI: A Client-Server-Model for PKI Services.
CP3397 ECommerce. Today’s Lecture Authentication using passwords SSL / TLS SET.
1 Introduction to Microsoft Windows 2000 Windows 2000 Overview Windows 2000 Architecture Overview Windows 2000 Directory Services Overview Logging On to.
Principles of Information Security, 2nd edition1 Cryptography.
Security fundamentals Topic 5 Using a Public Key Infrastructure.
16.1 © 2004 Pearson Education, Inc. Exam Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure.
Module 13: Enterprise PKI Active Directory Certificate Services (AD CS)
SECURITY IN E-COMMERCE VARNA FREE UNIVERSITY Prof. Teodora Bakardjieva.
1 Chapter 7 WEB Security. 2 Outline Web Security Considerations Secure Socket Layer (SSL) and Transport Layer Security (TLS) Secure Electronic Transaction.
Simplify and Strengthen Security with Oracle Application Server Allan L Haensgen Senior Principal Instructor Oracle Corporation Session id:
Active Directory. Computers in organizations Computers are linked together for communication and sharing of resources There is always a need to administer.
1 SSL - Secure Sockets Layer The Internet Engineering Task Force (IETF) standard called Transport Layer Security (TLS) is based on SSL.
Cryptography Chapter 7 Part 4 Pages 833 to 874. PKI Public Key Infrastructure Framework for Public Key Cryptography and for Secret key exchange.
Sentry: A Scalable Solution Margie Cashwell Senior Sales Engineer Sept 2000 Margie Cashwell Senior Sales Engineer
Lesson 12 Cryptography for E-Commerce. Approaches to Network Security Separate Security Protocol--SSL Application-Specific Security--SHTTP Security with.
Securing the Borderless Network March 21, 2000 Ted Barlow.
Lecture 23 Internet Authentication Applications modified from slides of Lawrie Brown.
May 30 th – 31 st, 2006 Sheraton Ottawa. Microsoft Certificate Lifecycle Manager Saleem Kanji Technology Solutions Professional - Windows Server Microsoft.
Encrypting Wireless Data with VPN Techniques. Topics Objectives VPN Overview Common VPN Protocols Conclusion.
Computer communications The exchange of information between computers for the purpose of cooperative action Computer network Two or more computers interconnected.
1 Pertemuan 12 Authentication, Encryption, Digital Payments, and Digital Money Matakuliah: M0284/Teknologi & Infrastruktur E-Business Tahun: 2005 Versi:
MCITP Guide to Microsoft Windows Server 2008 Server Administration (Exam #70-646) Chapter 9 Deploying IIS and Active Directory Certificate Services.
1 Chapter Overview Password Protection Security Models Firewalls Security Protocols.
Traditional Security Issues Confidentiality –Prevent unauthorized access or reading of information Integrity –Insure that writing or operations are allowed.
1. 2 Overview In Exchange security is managed by assigning permissions in Active Directory Exchange objects are secured with DACL and ACEs Permissions.
Microsoft Active Directory(AD) A presentation by Robert, Jasmine, Val and Scott IMT546 December 11, 2004.
JVM Tehnologic Company profile & core business Founded: February 1992; –Core business: design and implementation of large software applications mainly.
Unit 1: Protection and Security for Grid Computing Part 2
© 2017 SlidePlayer.com Inc. All rights reserved.