Overview

Data set encryption is provided by z/OS® V2R3 or later through the base Data Facility Storage Management Subsystem (DFSMS) component.

Introduction to z/OS data set encryption

Data set encryption enables encryption through the DFSMS access methods.

Planning

Considerations and guidelines for use of encrypted data sets.

Setup

Steps for setting up the environment and creating encrypted data sets.

Overview

IBM Enterprise Key Management Foundation – Web Edition V2.0 (EKMF Web) provides centralized key management for IBM z/OS data set encryption on IBM Z servers.

Learn more about EKMF Web 2.0

The use of AES Cipher keys, supported with z/OS Pervasive Encryption, provides additional attributes that are bound to the key itself such as export controls and supports stronger key wrapping when used in conjunction with EKMF.

IBM recommends using Cipher Keys for Pervasive Encryption whenever there is a need for keys to remain controlled under equivalently high security, even during key management operations like transfer between systems. For example, as is required by the Payment Card Industry Hardware Security Module Requirements (PCI HSM V1.0 #B2)

Requirements

The minimum system requirements for using AES Cipher keys for z/OS Pervasive Encryption are z14 with CEX6 and ICSF HCR77C1.

All production, development, test, QA, and disaster recovery systems accessing z/OS data sets encrypted with AES Cipher keys must meet the minimum system requirements.

Overview

Coupling facility encryption is provided by z/OS V2R3 or later releases. Coupling facility resource management (CFRM) policy statements are used to enable encryption on a structure-by-structure basis.

Ensure system security, Integrated Cryptographic Service Facility (ICSF) configuration, and cryptographic hardware requirements are met.

Planning

Consider impacts to dump data sets with coupling facility structure data and cryptographic key management.

Setup

Overview

Identifying where and how network traffic is protected is labor-intensive. z/OS Encryption Readiness Technology (zERT) eases network discovery by monitoring and recording details about your z/OS cryptographic network protection.

Things you should know about zERT

Requirements

• z/OS V2R3 or later releases
• IBM Connect:Direct users must ensure Connect:Direct APAR PI77316 is applied
• IBM zERT Network Analyzer requires Db2 for z/OS (Db2 11 or later releases)

Planning

zERT Capabilities

Discovery

Discovers the network encryption attributes for each TCP and Enterprise Extender connection.

Aggregation

Summarizes the repetitive use of security sessions over time. Retains the key details about the network encryption attributes. Greatly reduces the number of zERT SMF records in many cases.

IBM zERT Network Analyzer

A web-based graphical user interface to analyze and report on data reported in zERT summary records.

zERT concepts

• What does zERT manage and collect?
• How does zERT summarize and provide the information?

• zERT connection detail record (subtype 11)
• zERT summary record (subtype 12)

zERT-enabled cryptographic protocol providers

• ZERTJSSE (IBM SDK, Java Technology Edition 8.0.0)

• z/OS System SSL (including z/OS AT-TLS)
• z/OS V2R3 OpenSSH
• z/OS IPSec support

zERT limitations

Setup

Discovery

• Enabling zERT discovery
• Selecting a destination for zERT discovery SMF records

Aggregation

• Enabling zERT aggregation
• Selecting a destination for zERT aggregation SMF records

zERT Network Analyzer

• Updating z/OS for the IBM zERT Network Analyzer Plug-in
• IBM zERT Network Analyzer tutorial

Linux encryption for data at-rest

Videos

Pervasive Encryption for Data Volumes (04:57)

Coming soon: Setting up Data Volumes for Pervasive Encryption - In less than ten minutes

Publications

Linux on Z and LinuxONE: Pervasive Encryption for Data Volumes

Linux on Z and LinuxONE: How to set an AES Masterkey

Redbook: Getting Started with Linux on Z Encryption for Data At-Rest

Linux on IBM Z

Linux encryption for data in-flight

Linux is well equipped for encrypting all data in-flight using protocols like TLS, IPSec, or SSH.

Exploiting the excellent cryptographic performance of the IBM z15™ (all models), IBM LinuxONE Emperor II and LinuxONE Rockhopper II, Linux users can afford to pervasively encrypt their network traffic in a transparent manner using OpenSSL, OpenSSH, and IPSec.

Linux encryption for virtualization

All data volumes assigned to guest operating systems can use pervasive encryption. This applies to:

• z/VM guests
• KVM guests*
• All volumes except boot volumes

z/VM and KVM guests apply pervasive encryption to each piece of guest data at-rest, be it read from or written to a disk.The protected-key dm-crypt technology used protects volume encryption keys from being accessed in plain text format.This protection extends to swap volumes.

Alternatively, a KVM hypervisor can encrypt data at-rest on all volumes, except boot volumes, with dm-crypt technology. Thus, its KVM guests are supplied with encrypted virtual block devices, resulting in transparent data at-rest encryption for all guests.

* Available with Red Hat Enterprise Linux 8.0 and newer distributions, IBM is working with the other Linux distribution partners to include support.