Ata Encryption For Databases Understanding The Crypto Hardware

IBM ^ zSeries Technical Training
Data Encryption for Databases :

Understanding the Crypto Hardware Support
Marilyn Allmond
© 2006 IBM Corporation

IBM Advanced Technical Support
zSeries Sales and Technical Education
Trademarks
The following are trademarks of the International Business Machines Corporation in the United States and/or other countries.
AIX* Database 2 MVS Resource Link
e-business logo* MVS/DFP
AIX/ESA* DB2* RMF
e(logo)server* MVS/ESA
C/MVS DB2 Connect S/390*
ESCON OS/2*
C/370 developerWorks* FICON* S/390 Parallel Enterprise Server
CICS* DFSMS/MVS* OS/2 WARP* WebSphere*
ibm.com* OS/390*Parallel Sysplex*
CICS/ESA* DFSMSdfp z/Architecture
IBMLink Processor Resource/Systems Manager
CICS/MVS* DFSMSdss z/OS*
MQSeries* PR/SM
COBOL/370 DFSMShsm Multiprise* z/VM*
* Registered trademarks of IBM Corporation RACF* zSeries*
The following are trademarks or registered trademarks of other companies.
Linux is a registered trademark of Linus Torvalds

Penguin (Tux) compliments of Larry Ewing
Java and all Java-related trademarks and logos are trademarks of Sun Microsystems, Inc., in the United States and other countries
UNIX is a registered trademark of The Open Group in the United States and other countries.
Microsoft, Windows and Windows NT are registered trademarks of Microsoft Corporation.
SET and Secure Electronic Transaction are trademarks owned by SET Secure Electronic Transaction LLC.
Intel, Intel Inside (logos), MMX and Pentium are trademarks of Intel Corporation in the United States, other countries, or both.
MasterCard is a registered trademark of MasterCard International

RSA BSAFE is a registered trademark of RSA Data Security
RSA is a registered trademark of RSA Inc.
Visa is a register trademark of Visa international
* All other products may be trademarks or registered trademarks of their respective companies.
Notes :
Performance is in Internal Throughput Rate (ITR) ratio based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput that any user will
experience will vary depending upon considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore,
no assurance can be given that an individual user will achieve throughput improvements equivalent to the performance ratios stated here.
IBM hardware products are manufactured from new parts, or new and serviceable used parts. Regardless, our warranty terms apply.
All customer examples cited or described in this presentation are presented as illustrations of the manner in which some customers have used IBM products and the results they may have achieved. Actual
environmental costs and performance characteristics will vary depending on individual customer configurations and conditions.
This publication was produced in the United States. IBM may not offer the products, services or features discussed in this document in other countries, and the information may be subject to change without
notice. Consult your local IBM business contact for information on the product or services available in your area.
All statements regarding IBM's future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only.
Information about non-IBM products is obtained from the manufacturers of those products or their published announcements. IBM has not tested those products and cannot confirm the performance,
compatibility, or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.
Prices subject to change without notice. Contact your IBM representative or Business Partner for the most current pricing in your geography.
z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation
04/04/06 1-2 of 15
Discussion Topics
Drivers and Need

Where basic understanding of industry (client) requirements can
lead to more opportunity
Product History
Product Overviews
Product Setup
Things to Watch and Prepare (Educate the Client) for
Success
Things that make Bumps in the Night
Product Requirements
Comments from Those Who Have Gone Before
Data Encryption Driven by Demand: Driven by Law
Solutions targeting requirements driven by

Sarbanes-Oxley (SOX) Health Insurance Portability and
UK's Data Protection Act Accountability Act (HIPAA) of 1996
SEC 17a-4 CA's Pers Info Prot & Elec Doc Act
Privacy Act Graham-Leach-Bliley Act of 1999 (GLBA)
Not perfect, any solution has challenges in this environment
Performance overhead Key maintenance
Key management Archival requirements & issues
Application changes Disaster recovery issues
IBM Database solutions address part of the need
Tie with comprehensive understanding and very good consulting
skills and knowledge
Management acceptance of responsibility for risk and asset
definition and balance
Consulting opportunity lead that can be introduced during product
sale and implementation cycle
04/04/06 3-4 of 15
Is Only Encryption Needed
By examining the various regulatory legislation and industry

mandates (not all that may be applicable are mentioned) certain
cryptographic and/or other security mechanisms can be found. With
those other mechanisms you can
Strengthen the case for one or more of the IBM database encryption
solutions
Drive need for additional server processing
Plant the seeds for future opportunities or the enhancement of the one
being addressed
Where to find some of these documents?
A quick Google search using the legislative name and overview usually
provides a good list from which to select - further define by including org
as a keyword
http://www.isaca.org/AMTemplate.cfm?Section=Sarbanes-Oxley2&Template=/ContentManagement
/ContentDisplay.cfm&ContentID=11247
http://www.ziplip.com/solutions/SARBOX.html
http://www.deloitte.com/dtt/cda/doc/content/Sarbanes%20Oxley%20Act%202002.pdf
http://techrepublic.com.com/5100-10878_11-5034345.html
Brief Look at the Some of the Legislative Requirements
Sarbanes-Oxley (SOX)
requires internal controls on information to ensure completeness,
correctness, and quick access
addresses the deliberate alteration or destruction of a record or document with
the intent to obstruct an investigation
requires that strict records retention policies and procedures exist
dictates publicly traded companies must have policies and controls in place to
secure, document, and process material information dealing with their financial
results
Health Insurance Portability and Accountability Act (HIPPA)
must guard “confidentiality, integrity & availability” of individual health data.
To accomplish this, each provider is required to meet three conditions:
Must “assess potential risks and vulnerabilities to the individual health data in its
possession” …
Must …“develop, implement, and maintain appropriate security measures”
Integrity
Availability
Confidentiality
Must insure these measures are “documented and kept current”
04/04/06 5-6 of 15
Brief Look at the Some of the Legislative Requirements . . .
Graham-Leach-Bliley Act (GLBA)

Both non-public and public information must be protected
insure the security and confidentiality of customer records and information;
protect against any anticipated threats or hazards to the security or integrity
of such records; and
protect against unauthorized access to or use of such records or information
which could result in substantial harm or inconvenience
Data should be encrypted in storage and in transit
European Union legislation addresses similar safeguards as HIPPA
Basel II addresses similar safeguards as GLBA
Summary : All Legal Directives include requirements to protect personal

data against
accidental or unlawful destruction or accidental loss,
alteration,
unauthorized disclosure or
access
Data Encryption History on IBM Mainframes for Databases
Application enablers allowed clients to code confidentiality into

applications where needed
First wave included
Programmed Cryptographic Facility (PCF)
Customer Unit Support Program (CUSP) and its hardware, 3848
IDCAMS REPRO
Second wave included
Transaction Security System family of products
ICSF and ICRF (first versions of S/390 crypto hardware with ICSF)
ICSF and CCF (second version of S/390 and zSeries crypto
hardware)
Third wave included
4758 PCI Coprocessor
PCICC, PCICA (second version of S/390 and zSeries crypto
hardware)
Fourth wave includes PCIXCC and Crypto Express2
04/04/06 7-8 of 15
IBM Data Encryption Solutions for Databases Beyond

Application Enablers
Data Encryption for IMS and DB2 Databases First Edition
Offered as PRPQ, 5799-GWD
Announced December 2002
Implemented encryption via Segment Edit/Compression exit and
EDITPROC exit, respectively (1 exit per database type)
Supported IMS V6 and DB2 V6 and later
Used secure key thus requiring secure crypto hardware
Data Encryption for IMS and DB2 Databases Second Edition

Offered as product, 5655-P03
Released as Version 1 Release 1 in the February 2003
same as above
Pub update done in March 2004, SC18-7336-01
IBM Data Encryption Solutions for Databases Beyond

Application Enablers . . .
Data Encryption for IMS and DB2 Databases Third Edition
Offered as product, 5655-P03 FMID(H29F110)
Released as Version 1 Release 1 updated in the September 2004
same as above (2 exits per database type)
Uses secure key OR new clear key
DB2 Version 8
Offers data encryption through built-in functions
Allows column encryption rather than row encryption
Requires change to column definitions for targeted data
May encrypt data using 2 methods
Defining encryption at the column level
Defining encryption at the value level
Encryption key is referred to as PASSWORD in DB2 Admin Guide
04/04/06 9-10 of 15
Data Encryption for IMS and DB2 (Emphasis on DB2)
DB2 Databases
Implemented via EDITPROC exit
DECENC00 secure key implemented
DECENA00 clear key implemented
Specified in the EDITPROC clause of the SQL CREATE TABLE
statement
IMS Databases
Implemented via Segment/Compression exit
DECENC01 secure key implemented
DECENA01 clear key implemented
Specified in the DBD COMPRTN parameter
The DECENC0n routines exploit secure key crypto via ICSF
services, CSNBENC and CSNBDEC
The DECENA0n routines exploit clear key crypto (CPACF)
DB2 uses the problem state instruction (KMC)
IMS uses the ICSF APIs, CSNBSYE and CSNBSYD
These exits must initially encrypt the database and

Are used in future calls where an application processes a table or
segment for which encryption or decryption has been specified.
Data stays encrypted during channel I/O, when the DBMS gains
control it invokes the exit to decrypt based on read processing or
encrypt based on write processing
ISPF panel interface to assist in setting up JCL parameters for exit
creation or use SAMPLIB JCL samples
The JCL will link-edit the product-supplied exit into the user's exit
library
The JOB takes the encryption key indicated by label in the JCL and
stores it in the exit
Once installed existing objects need to be unloaded, redefined, and
reloaded
04/04/06 11-12 of 15
Data Encryption for IMS and DB2 Databases Third Edition

Offered as product, 5655-P03
Released as Version 1 Release 1 updated in the September 2004
same as above (2 exits per database type)
Used secure key OR new clear key
Encrypts at row level
DB2 Version 8
Offers data encryption through built-in functions
Allows column encryption rather than row encryption
Requires change to column definitions for targeted data
May encrypt data using 2 methods
Defining encryption at the column level
Defining encryption at the value level
Encryption key is referred to as PASSWORD in DB2 Admin Guide
General Limitations to Consider
Using encryption and the IBM crypto hardware requires

knowledge of the relationships between the ICSF calls (software
service requests) and the various types of crypto hardware
3 methods of requesting encryption ICSF
CSNBENC requires CCF or PCIXCC or Crypto Express2
configured as a coprocessor, ICSF active, & Master Keys loaded
CSNBSYE requires CPACF which is only available on z990/890
and higher servers, ICSF active, & Master Keys loaded
Problem state machine instruction where only the Key Record
Read is the only ICSF API used requires CPACF
CSNBSYE and the problem state machine instruction references a
different key than one that is referenced with CSNBENC
Secure
CCF, CEX2
DB2KEY.....DATA PCIXCC
Clear DB2KEY.....CLRDES CPACF
64 bytes of label padded with blanks + 8 bytes of key type
Must have unique key label
04/04/06 13-14 of 15
General Limitations to Consider . . .
Performance varies but is faster than software encryption

Using CPACF with clear key functions is fastest
Using Secure key on CCF systems is faster than on PCIXCC and
CEX2 systems
Storage time for database backups and impact of key life
ICSF is a single address space shared by other users on z/OS
When using multiple keys for different tables/segments the DBA or
data owners need to ensure the longevity of keys associated with
backup data and/or create a process to change keys
Cannot encrypt DB2 indexes so may need to change table
structures
Using encryption means managing data in 8 bytes or multiple of 8
so tables may need to expand
Use of compression will be impacted
DB2 compression is done after encryption which has no benefit
IMS can only do compression OR encryption not both
General Limitations to Consider . . .
Only one exit of either database can be associated with a segment

or table at one time, if any exit exists alternative code will be
required
What cannot be encrypted
IMS: HIDAM index databases
DB2: Indexes
Tables with ROWIDs or LOBs
These exits must have APF authorization
ICSF settings can influence performance (CHECKAUTH,
KEYAUTH)
If CKDS is initialized on z990/890 or z9 and the DR processor is
an earlier processor, the CKDS will not work
IMS: a different encryption key may exist for different segments,
each segment will have its own exit association
DB2: only 1 key may exist
04/04/06 15-16 of 15
IBM Data Encryption Tool: HW & SW Assurance Chart

Server IMS Tool DB2 Tool Crypto Special
SW Reqd
Type Exit Name Exit Name HW Reqd PTFs
IMS V6 or later
DB2 UDB Server for
S/390 DECENC01 DECENC00 CCF OS/390 V6 or later
ICSF
IMS V6 or later
zSeries DB2 UDB Server for
DECENC01 DECENC00 CCF OS/390 V6 or later
z900/800
ICSF
PCIXCC IMS V6 or later

(0868) or UK00049
zSeries DECENC01 DECENC00 CEX2 DB2 UDB Server for
z990/890 DECENA01 DECENA00 OS/390 V6 or later UA156__
CPACF ICSF
77/78/79
(3863) HCR770A/0B/20/30
(0868) or UK00049
zSeries DECENC01 DECENC00 CEX2 DB2 UDB Server for
z9 DECENA01 DECENA00 OS/390 V6 or later UA156__
CPACF ICSF 77/78/79
(3863) HCR770A/0B/20/30
IBM Data Encryption Tool: Usage Assurance

Server IMS Tool DB2 Tool Crypto Special
SW Reqd
Type Exit Name Exit Name HW Reqd PTFs
zSeries IMS V6 or later

DB2 UDB Server for
z900/800 DECENC01 DECENC00 CCF OS/390 V6 or later
and earlier ICSF

zSeries (0868) or UK00049
DECENC01 DECENC00 CEX2 DB2 UDB Server for
z990/890 OS/390 V6 or later
DECENA01 DECENA00 UA156__
and z9 CPACF ICSF 77/78/79
(3863) HCR770A/0B/20/30
Address DR implications
Machine type impact (CPACF or secure key)
Key availability (CKDS key storage and CKDS accessibility)
Naming convention for key labels
Storage and archiving requirements
Accountability issues
Performance
04/04/06 17-18 of 15
IBM Data Encryption for IMS and DB2
Documentation
IBM Data Encryption for IMS and DB2 Databases User ’s Guide
V1R1, SC18-7336-02
For enciphered data to be processed else where the other
machine must have crypto capability and access to same key
value as used to encrypt that data
Tested in DB2 and IMS environments ensure compatibility
with all interfaces
IMS Exit Processing
IMS Encryption
Program passes a segment REPL, ISRT, or LOAD request to IMS
control region
IMS determines, using the DBD, that a Segment Edit/Compression
exit is required
IMS loads and calls the exit, passing it the unencrypted segment
Exit invokes ICSF services
IMS puts the encrypted segment into the database
IMS Decryption
IMS application program passes segment GET request to the IMS
control region
IMS determines, from the DBD, that a Segment Edit/Compression
exit is required
IMS loads and calls the exit, passing it the encrypted segment
IMS passes the decrypted segment back to the application
04/04/06 19-20 of 15
DB2 Exit Processing
DB2 Encryption
DB2 application program passes a row to DB2.
DB2 determines, by presence of EDITPROC on the table, exit is
required
DB2 loads and calls the exit, passing it the unencrypted row
DB2 puts the encrypted row into the table
DB2 Decryption
DB2 application program requests data from DB2
DB2 determines, by presence of EDITPROC on the table, exit is
required
DB2 loads and calls the exit, passing it the unencrypted row
DB2 passes the decrypted row back to the application
Prerequisites for Use
Required Crypto hardware must be activated

CCF and PCIXCC
Configuration loaded
LPAR associations must be made
Master Keys must be loaded
CPACF must be enabled via Feature Code 3863
Required Software
IMS Version 6 or higher, and/or DB2 for OS/390 Version 6 or
higher
ICSF must be activated
Base element of z/OS and OS/390
Key(s) to be used for data protection must be defined
Security issue!!
Do not look for step-by-step directions
Should understand this process in order to explain decisions to auditors
Should understand crypto concepts and IBM Crypto
04/04/06 21-22 of 15
Generic Installation Steps for DE for IMS and DB2
Set up and validate crypto hardware

Validate? If from ICSF menu, Utility option for Random Number
works, ICSF and secure crypto hardware works
Generate and then store (in the CKDS) a triple DES
encryption key for use
Use ICSF Key Generation Utility Program, KGUP
Read ICSF Administrator's Guide
Build the IMS or DB2 user exit, specifying the key name
defined in step above
Back up your data
Unload your data
Create/install the exit
Reload the data, during which process the data is encrypted
Validate your output
Specific Exit Installation Notes
IMS
Provides sample job DECIMSJB in PDS smphlq.SDECSAMP
DB2
Provides sample job DECDB2JB in PDS smphlq.SDECSAMP
Generic to either database
Replace the yyyyyyyyyy (at the end of the job) with encryption
key label built by the security analyst
Also, provides an alternate in the form of a panel interface to
create the user exit
ex ’smphlq.SDECCEXE(DECENC04)’’smphlq ’
For a more user-friendly key entry process allowing key
knowledge separation use
PRS189 ICSF Key Part Entry Sample Application for ISPF
Panels from www.ibm.com/support/techdocs
04/04/06 23-24 of 15
Brief Highlight of Crypto in DB2 V8
Provides encryption at column and cell or value level

Provides basic keywords to control the encrypt/decrypt process
ENCRYPT to encrypt data DECRYPT_CHAR
DECRYPT_BIT DECRYPT_DB
SET ENCRYPTION PASSWORD statement allows the entry of
a password and a hint
Password is used to create key
Password or key is stored in DB2 along with hint if provided
Use SELECT GETHINT statement to recover hint
DB2 V8 requires a zSeries Processor
Documentation found in
DB2 V8 Administration Guide, SC18-7413-01, Chapter 9
Summary
Not an integrated solution but well tested and is the best around
Replaces the EDITPROC code providing encryption that may
have been obtained earlier and was 'AS IS'
Requires no application changes
Data base changes may need to occur
Ensure targeted data will be protected may need to rearrange data
Adjustments for data base product restrictions or considerations
Understanding IBM Crypto will be crucial to adhering to the
regulations/requirements driving this solution
Weigh the options available
Not every segment or table needs to be encrypted
Evaluate need for
Encryption/decryption in cross-platform and/or sysplex
environments
Disaster Recovery
04/04/06 25-26 of 15

Ata Encryption For Databases Understanding The Crypto Hardware

Enviado por

Dados do documento

Descrição original:

Título original

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

Ata Encryption For Databases Understanding The Crypto Hardware

Enviado por

Direitos autorais:

Formatos disponíveis

IBM ^ zSeries Technical Training

Data Encryption for Databases :

© 2006 IBM Corporation

zSeries Sales and Technical Education

The following are trademarks or registered trademarks of other companies.

Linux is a registered trademark of Linus Torvalds

MasterCard is a registered trademark of MasterCard International

z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation

Drivers and Need

z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation

zSeries Sales and Technical Education

Data Encryption Driven by Demand: Driven by Law

Solutions targeting requirements driven by

Is Only Encryption Needed

By examining the various regulatory legislation and industry

z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation

zSeries Sales and Technical Education

Brief Look at the Some of the Legislative Requirements

Brief Look at the Some of the Legislative Requirements . . .

Graham-Leach-Bliley Act (GLBA)

Summary : All Legal Directives include requirements to protect personal

z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation

zSeries Sales and Technical Education

Data Encryption History on IBM Mainframes for Databases

Application enablers allowed clients to code confidentiality into

IBM Data Encryption Solutions for Databases Beyond

Data Encryption for IMS and DB2 Databases Second Edition

z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation

zSeries Sales and Technical Education

IBM Data Encryption Solutions for Databases Beyond

Data Encryption for IMS and DB2 (Emphasis on DB2)

zSeries Sales and Technical Education

Data Encryption for IMS and DB2 (Emphasis on DB2)

These exits must initially encrypt the database and

z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation

Data Encryption for IMS and DB2 (Emphasis on DB2)

Data Encryption for IMS and DB2 Databases Third Edition

z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation

zSeries Sales and Technical Education

General Limitations to Consider

Using encryption and the IBM crypto hardware requires

General Limitations to Consider . . .

Performance varies but is faster than software encryption

zSeries Sales and Technical Education

General Limitations to Consider . . .

Only one exit of either database can be associated with a segment

IBM Data Encryption Tool: HW & SW Assurance Chart

PCIXCC IMS V6 or later

zSeries Sales and Technical Education

IBM Data Encryption Tool: Usage Assurance

zSeries IMS V6 or later

PCIXCC IMS V6 or later

IBM Data Encryption for IMS and DB2

z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation

zSeries Sales and Technical Education

IMS Exit Processing

z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation

DB2 Exit Processing

z9XX Crypto | MarilynAllmond | Wahington Systems Center © 2006 IBM Corporation

zSeries Sales and Technical Education

Prerequisites for Use

Required Crypto hardware must be activated