z/OS Security and PKI services

More documents

Recommendations

Info

z/OS PKI Services ArchitecturePKI Administrator15RACFDBEnd UserOCSPRequesterSAF R_PKIServRACFServicesHTTP server for z/OSHTTPDOCSP CGI *RACF Glue RtnSMFAuditRecordsPCCGI ScriptsSMFUnloadStaticWebPagesPKI ExitSystem SSLICSFz/OS PKIServices DaemonCombined RA/CAprocessOCSFPKITPLDAPDLInstall/Config:SMP/E Installz/OSLDAPDirectoryPost ApplyScript/JobRACF Set upEXECVSAMRequestQueueVSAMIssuedCert List* OCSP responder with z/OS R.707.04.2006 IBM SystemsIdentrus PKITo Identrus RootIssuing ParticipantRelying Participantz/OS CA - PKI ServicesRegistrationCertificationRegistrationAuthority (CA)(RA) Authority(RA)CertificationAuthority(CA)ValidationAuthority(VA)OCSPResponderIdentrus FIEnvironmentLocal RAClient(LRA)FinanceBackendSystemsIdent Pay...WarrTransaction Coordinator (TC)Identrus FIEnvironmentFinance BackendSystemsIdent Pay...WarrTransaction Coordinator (TC)Smart Card(SC)LDAP- z/OS PKI ServicesSigning Interface Library(SIL)SC ReaderClient AppsWeb browserIdent Pay...WarrDigital Signature MessagingSystem (DSMS)Web App.Srv.HSMe-business Apps- Other VendorSubscriberRelying CustomerPKI Services at z/OS V1R5 and higher received Identrus official certification in July 200516http://www.identrus.com/company/press_releases/release_050706.html07.04.2006 IBM Systems
z/OS R.7 – enhanced functions• Enhanced Certificate Revocation List (CRL) Distribution Points► location of the CRL is self-contained in the extension• Create Authority Revocation List (ARL) Distribution Point► create ARL Distribution Point and put the extension in the CA certificate• Online Certificate Status Protocol (OCSP) responder► PKI Services will provide the OCSP responder function itself● support to create the AuthorityInfoAccess certificate extensionThis is the extension that identifies the OCSP responder that should be called to checkrevocation. The responder would read the CRLs produced by PKI Services in order todetermine the revocation status.● OCSP responder is enabled when OCSPType is set to basic in the CertPolicy sectionof the PKI Services configuration file► None of the z/OS servers support OCSP yet.● System SSL is working on supporting OCSP in a future release.1807.04.2006 IBM Systemsz/OS R.8 - Multiple CA support1907.04.2006 IBM Systems
Page 1: z/OS Security andPKI servicesThomas
Page 5 and 6: Tutorial907.04.2006 IBM SystemsWhat
Page 7: Certificate Life Cycle - this is wh
Page 12 and 13: Technical detail of Encryption Serv
Page 14 and 15: Agenda• z/OS 1.7 - Integrated IP
Page 16 and 17: Build DB2 user exit• “Data Encr
Page 18 and 19: IBM Security Strategy• Mainframe

z/OS Security and PKI services

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?