User manual IBM ZOS V1.12

[. . . ] IBM United States Software Announcement 210-008, dated February 9, 2010 Preview: z/OS V1. 12 - Heralding a new generation of smart operating systems Table of contents 1 2 3 Overview Key prerequisites Planned availability date 3 27 27 29 Description Statement of general direction Product number Corrections At a glance IBM® previews z/OS® Version 1. 12. With this latest release of z/OS, IBM heralds a new area of smart operating systems by creating an environment that can proactively work for you to help promote improved operations, availability, manageability, and security through innovative self-learning, self-managing, and self-optimization capabilities. Enhancements include: · Predicting problems - z/OS Predictive Failure Analysis® (PFA) is planned to monitor the rate at which SMF records are generated. When the rate is abnormally high for a particular system, the system will be designed to issue an alert to warn you of a potential problem, potentially avoiding an outage. [. . . ] Leveraging the unique z/Architecture®, protected key CPACF is designed to help ensure that key material is not visible to applications or operating systems when used for encryption operations. Protected key CPACF is designed to provide significant throughput improvements for large volumes of data and low latency for small blocks of data. In z/OS V1. 12, ICSF is planned to exploit the enhancements made to the CPACF in support of separate key wrapping keys for DES/TDES and AES. This is designed to provide the same functions available using the PCI card, but with the advantage of CPACF performance. · There are a number of improvements planned for PKI Services. ­ In z/OS V1. 12, PKI Services is planned to allow you to create and sign certificates with ECC keys, in addition to RSA and DSA keys. ­ RACF and PKI Services will be designed to support longer distinguished names in digital certificates. This is intended to support your use of certificates with very long distinguished names. ­ Certain events, such as restoring a prior level of the security database, or removing and reinstalling the Certificate Authority (CA) certificate, can cause the security manager to return serial numbers to be used for new certificates that have been used before. PKI Services will be designed to detect this and IBM United States Software Announcement 210-008 IBM is a registered trademark of International Business Machines Corporation 14 find the first unused serial number before issuing a new certificate, to avoid attempting to issue two certificates with duplicate serial numbers. Also, a new utility is planned to allow you to post existing certificates in LDAP, avoiding the need to post them manually. Additionally, another new utility will be designed to allow you to post updates to Certificate Revocation Lists (CRLs) immediately when you need to, rather than waiting for the interval you have specified. Last, PKI Services performs certain tasks, such as removing old or expired certificates and requests, and processing certificate expiration notification warning messages, once a day. These housekeeping tasks have historically consumed considerable processing time when you have a large number of certificates. A new PKI Services design is intended to markedly improve the performance and reduce the processing time of these tasks and additionally allow you to specify the time of day and days of the week this task will be run. ­ PKI Services is planned to support passing the reason a certificate request was rejected from the administrator to the requester in the rejection e-mail. Also, PKI Services will be designed to support custom extensions to X. 509 Version 3 certificates; for example, creating a Domain Controller certificate with an extension called Certificate Template Name, with an OID, and with BMP data "DomainController" for use with Microsoft Exchange or Smart Card Login. Last, PKI Services is planned to allow you to create a certificate with a Subject Alternate Name that contains multiple instances of each of the General Name forms support. For example, more than one IP address may be specified where only one was allowed before. ­ Certificate Management Protocol (CMP) is an Internet protocol used to manage X. 509 digital certificates described by RFC 4210, which uses the Certificate Request Message Format (CRMF) described by RFC 4211. In z/OS V1. 12, PKI Services is planned to provide support for parts of the CMP standard, allowing CMP clients to communicate with PKI Services to request, revoke, suspend, and resume certificates. This is intended to allow you to use CMP in a centralized certificate generation model. [. . . ] CBPDO, ServerPac, and SystemPac are offered for Internet delivery in countries where ShopzSeries product ordering is available. Internet delivery can reduce software delivery time and allows you to install software without the need to handle tapes. For more details on Internet delivery, refer to the ShopzSeries help information at http://www. software. ibm. com/ShopzSeries You choose the delivery method when you order the software. In addition to Internet and DVD, the supported tape delivery options for CBPDO, ServerPac, and SystemPac include: · 3590 · 3592 Note: Product delivery on all 3480 and 3490 tape media is planned to be discontinued October 26, 2010. [. . . ]