User manual IBM ZOS V1.12

[. . . ] IBM United States Software Announcement 210-008, dated February 9, 2010 Preview: z/OS V1. 12 - Heralding a new generation of smart operating systems Table of contents 1 2 3 Overview Key prerequisites Planned availability date 3 27 27 29 Description Statement of general direction Product number Corrections At a glance IBM® previews z/OS® Version 1. 12. With this latest release of z/OS, IBM heralds a new area of smart operating systems by creating an environment that can proactively work for you to help promote improved operations, availability, manageability, and security through innovative self-learning, self-managing, and self-optimization capabilities. Enhancements include: · Predicting problems - z/OS Predictive Failure Analysis® (PFA) is planned to monitor the rate at which SMF records are generated. When the rate is abnormally high for a particular system, the system will be designed to issue an alert to warn you of a potential problem, potentially avoiding an outage. [. . . ] Details on the security enhancements intended for z/OS V1. 12: · ICSF is planned to provide support for translation of external RSA tokens wrapped with key encrypting keys into one of three smart card formats. A new callable service, PKA Key Translate (CSNDPKT), is designed to translate an existing RSA private key in CCA external format into a specified smart card (SC) format in support of VISA, or the common ME or CRT format. To use this new function, you will need an IBM System z9® or System z10 server with the Crypto Express2 feature with a minimum driver and microcode level. This function is also available on z/OS V1. 8 and higher with the z/OS V1. 8, z/OS V1. 9 or z/OS V1. 10 with the Cryptographic Support for z/OS V1R8-V1R10 and z/OS. e V1R8 Web deliverable and PTF UA46713. · An enhancement to Central Processor Assist to Cryptographic Function (CPACF) on IBM System z10 servers with the CEX3C feature is designed to help facilitate the continued privacy of cryptographic key material when used by the CPACF for high-performance data encryption. Leveraging the unique z/Architecture®, protected key CPACF is designed to help ensure that key material is not visible to applications or operating systems when used for encryption operations. Protected key CPACF is designed to provide significant throughput improvements for large volumes of data and low latency for small blocks of data. In z/OS V1. 12, ICSF is planned to exploit the enhancements made to the CPACF in support of separate key wrapping keys for DES/TDES and AES. This is designed to provide the same functions available using the PCI card, but with the advantage of CPACF performance. ­ In z/OS V1. 12, PKI Services is planned to allow you to create and sign certificates with ECC keys, in addition to RSA and DSA keys. ­ RACF and PKI Services will be designed to support longer distinguished names in digital certificates. This is intended to support your use of certificates with very long distinguished names. ­ Certain events, such as restoring a prior level of the security database, or removing and reinstalling the Certificate Authority (CA) certificate, can cause the security manager to return serial numbers to be used for new certificates that have been used before. PKI Services will be designed to detect this and IBM United States Software Announcement 210-008 IBM is a registered trademark of International Business Machines Corporation 14 find the first unused serial number before issuing a new certificate, to avoid attempting to issue two certificates with duplicate serial numbers. Also, a new utility is planned to allow you to post existing certificates in LDAP, avoiding the need to post them manually. Additionally, another new utility will be designed to allow you to post updates to Certificate Revocation Lists (CRLs) immediately when you need to, rather than waiting for the interval you have specified. Last, PKI Services performs certain tasks, such as removing old or expired certificates and requests, and processing certificate expiration notification warning messages, once a day. These housekeeping tasks have historically consumed considerable processing time when you have a large number of certificates. A new PKI Services design is intended to markedly improve the performance and reduce the processing time of these tasks and additionally allow you to specify the time of day and days of the week this task will be run. ­ PKI Services is planned to support passing the reason a certificate request was rejected from the administrator to the requester in the rejection e-mail. Also, PKI Services will be designed to support custom extensions to X. 509 Version 3 certificates; for example, creating a Domain Controller certificate with an extension called Certificate Template Name, with an OID, and with BMP data "DomainController" for use with Microsoft Exchange or Smart Card Login. Last, PKI Services is planned to allow you to create a certificate with a Subject Alternate Name that contains multiple instances of each of the General Name forms support. [. . . ] Plans related to Extended Address Volume (EAV) larger volume sizes as described in 5694-A01, Preview: z/OS V1. 10, announced in Software Announcement 208-042, dated February 26, 2008, will be communicated at a later date. All statements regarding IBM's plans, directions, and intent are subject to change or withdrawal without notice. Product number 5694-A01 Business Partner information If you are a Direct Reseller - System Reseller acquiring products from IBM, you may link directly to Business Partner information for this announcement. https://www. ibm. com/partnerworld/mem/sla. jsp?num=210-008 Important Web sites · z/OS Web site http://www. ibm. com/systems/z/os/zos/ · General Q & A http://www. ibm. com/systems/z/faq/ · Previously announced statements of direction http://www. ibm. com/systems/z/os/zos/zos_sods. html · z/OS Internet Library http://www. ibm. com/systems/z/os/zos/bkserv/ · z/OS Basic Skills Information Center http://publib. boulder. ibm. com/infocenter/zoslnctr/v1r7/index. jsp · Descriptions of courses worldwide http://www. ibm. com/services/learning · z/OS downloads http://www. ibm. com/systems/z/os/zos/downloads/ · CustomPac http://www. ibm. com/services/custompac IBM United States Software Announcement 210-008 IBM is a registered trademark of International Business Machines Corporation 27 · ShopzSeries http://www. ibm. com/software/shopzseries · z/OS Communications Server http://www. ibm. com/software/network/commserver/zos/ · IBM Open Class® Library Transition Guide http://publibz. boulder. ibm. com/epubs/pdf/cbcit100. pdf Customized offerings z/OS product deliverables are shipped only via CBPDO, ServerPac, and SystemPac. Software delivery for z/OS and z/OS platform products on DVD is planned for September 10, 2010. [. . . ]