Dataset encryption
A z/OS feature that encrypts a dataset's contents automatically, so only users allowed to use its key can read the data.
Also written z/OS data set encryption, pervasive encryption, encrypted dataset, key label, DSKEYLBL
z/OS can encrypt datasets as they are written and decrypt them as they are read, without any change to the programs that use them. IBM promoted this as part of pervasive encryption: encrypting as much data as possible by default.
Each encrypted dataset is linked to a key through a key label, the name of a key stored by ICSF. The label can be assigned in several ways: by the SMS data class, by the RACF profile that protects the dataset, or with DSKEYLBL in the JCL when the dataset is created. The dataset must be an extended format dataset.
The important point is separation of access. To read the data, a user needs access to the dataset and also access to the key label, which RACF controls separately. A storage administrator who can copy, move and back up the dataset does not need access to the key, so they can do their job without being able to see the data.
The data stays encrypted wherever it goes: on disk, in backups and on tape. That reduces the risk if a copy ends up in the wrong place, and it helps sites meet rules on protecting customer data.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- ICSFIntegrated Cryptographic Service Facility: the part of z/OS that gives programs access to the mainframe's encryption hardware and keys.
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- SMSThe Storage Management Subsystem: the z/OS feature that decides where new datasets go and how they are backed up, kept and deleted, using rules the site writes.
- DatasetWhat a mainframe calls a file: a named collection of records with a defined structure, rather than a loose stream of bytes.
- Dataset profileA security rule describing which datasets it covers and who is allowed to do what to them.