Selecting Tape Files for Encryption Using DFSMS › Data Class Characteristics for Encryption › How Data Classes Specify Tape Encryption

How Data Classes Specify Tape Encryption

Use data classes to specify that CA Tape Encryption should encrypt a tape file. Data classes apply to both SMS managed tapes and non-SMS managed tapes. CA Tape Encryption encrypts data on both SMS managed and non-SMS managed tapes. The following points summarize this process:

• Data classes are assigned by DFSMS in the Automatic Class Selection (ACS) routines or may be specified by the DATACLAS JCL parameter. The ACS routines let you determine who can request encryption processing by overriding any request specified in the JCL. We recommend that you do not allow end users to control encryption processing because of the associated resource overhead.
• When tape files go through normal OPEN for output processing, CA Tape Encryption checks the DFSMS data class to determine whether the data class assigned to the tape includes the BES= or BESn= character strings in the description field of the data class. When these character strings are found, encryption processing is determined to be requested for this data set and further validation of the request is initiated.
• If encryption key protection is active, the user submitting the job must have access to the specified encryption key.

  The following sample shows the ISMF Data Class Application Selection panel with the name NEWDC specified in the Data Class Name field:

    Panel  Utilities  Help                                                      
  ------------------------------------------------------------------------------
                         DATA CLASS APPLICATION SELECTION                       
  Command ===>                                                                  
                                                                                
  To perform Data Class Operations, Specify:                                    
    CDS Name . . . . . . 'SMS.SCDS1.SCDS'                                       
                                 (1 to 44 character data set name or 'Active' ) 
    Data Class Name  . . NEWDC     (For Data Class List, fully or partially     
                                   specified or * for all)                      
                                                                                
  Select one of the following options  :                                        
    3  1. List    - Generate a list of Data Classes                             
       2. Display - Display a Data Class                                        
       3. Define  - Define a Data Class                                         
       4. Alter   - Alter a Data Class                                          
                                                                                
  If List Option is chosen,                                                     
     Enter "/" to select option      Respecify View Criteria                    
                                     Respecify Sort Criteria                    
                                                                                
  Use ENTER to Perform Selection;                                               
  Use HELP Command for Help; Use END Command to Exit.                           
  

  Note: The specific fields on this and related ISMF panels are subject to change as new versions of DFSMS become available.

• The ACS routines are completely controlled by your storage administrator and are different for each organization. You can code the ACS routines to use a data class specified in the JCL DATACLAS= parameter if found, or you can code them to override any data class specified on the DATACLAS= parameter with one assigned in the ACS routine. This latter technique provides for centralized control of which users or jobs are allowed to create encrypted tape data sets.
  • If a user specifies a value in the DATACLAS= parameter in JCL, the ACS routines check to see whether the data class has been assigned. If the class is valid, the job uses it. If the class is not valid, the job uses the data class assigned in the ACS routines.
  • The data class name must be from one to eight alphanumeric characters, starting with an alphabetic, $, @, or #.
• CA Tape Encryption selects files for encryption based on a character string in the DFSMS data class description field that it recognizes.
  • The description field must include a CA Tape Encryption parameter, in the form of BES=(string_value) or BESn=(string_value).
  • You can include additional text before or after the BES= or BESn= parameter. A comma or blank must immediately precede the BES= or BESn= statement if either is not the leftmost text in the description field.
  • The description field can contain up to 120 alphanumeric and special characters. If you enter lowercase characters, they are converted to uppercase.
  • The security selection data set feature does not support the use of commas and command delimiters or imbedded blanks. Replace commas with periods and remove any imbedded blanks. The use of commas and imbedded blanks will continue to be supported for the DATACLAS description statement only.

  The following sample shows the ISMF Data Class Define panel with an example of a character string in the description field that CA Tape Encryption recognizes, with a key name of SYMKEY1. CA Tape Encryption ignores all text in the description field except the character string BES=(SYMKEY1).

    Panel  Utilities  Scroll  Help                                              
  ------------------------------------------------------------------------------
                                DATA CLASS DEFINE                 Page 1 of 4   
  Command ===>                                                                  
                                                                                
  SCDS Name . . . : SMS.SCDS1.SCDS                                              
  Data Class Name : NEWDC                                                       
                                                                                
  To DEFINE Data Class, Specify:                                                
    Description ==> CLASS FOR ENCRYPTING DATA SETS BES=(SYMKEY1) OWNER=J. SMITH 
                ==>                                                             
    Recfm . . . . . . . . . .             (any valid RECFM combination or blank)
    Lrecl . . . . . . . . . .             (1 to 32761 or blank)                 
    Space Avgrec  . . . . . .             (U, K, M or blank)                    
          Avg Value . . . . .             (0 to 65535 or blank)                 
          Primary . . . . . .             (0 to 999999 or blank)                
          Secondary . . . . .             (0 to 999999 or blank)                
          Directory . . . . .             (0 to 999999 or blank)                
    Retpd or Expdt  . . . . .             (0 to 9999, YYYY/MM/DD or blank)      
    Volume Count  . . . . . . 1           (1 to 59 or blank)                    
    Add'l Volume Amount . . .             (P=Primary, S=Secondary or blank)     
                                                                                
  Use ENTER to Perform Verification; Use DOWN Command to View next Panel;       
  Use HELP Command for Help; Use END Command to Save and Exit; CANCEL to Exit.  
  

• After the data class is activated on the system and the ACS routines are updated to assign specific files to the data class (or requested by the DATACLAS parameter if permitted by the ACS routines), run or schedule a normal z/OS batch process that writes a z/OS tape volume in the usual manner to cause all files assigned to the data class to be encrypted.