Legacy MTO Security Model

This topic describes the MTO legacy security features. It explains:

Overview

MTO provides optional security for individual transactions and resources. It is off by default.

MTO controls access to transactions and resources through three mechanisms:

MTO also provides a mechanism for implementing your own password encryption and decryption strategy.

Transaction Security

Transaction security allows you to control access to individual transactions.

To enable security for a transaction, you must do two things:

If you assign security key number 1 to a transaction, any user can run the transaction; all users own security key 1 by default. Figure 1 illustrates security key checking applied to a transaction.

Transaction key checking

Figure 1: Transaction key checking

Resource Security

You can control access by a transaction to the following types of resource:

To enable resource security, do the following:

  1. Specify that a transaction is to perform resource security checking, by checking Security: Resource Level Checking on the PCT page in ESMAC for the transaction. (By default, transactions do not perform resource security checking.)
  2. Specify a set of resource keys in the resource table entry (for example, the FCT entry for a file). Each resource key is a number in the range 1 through 24.
  3. Specify a set of resource keys in a user's SNT entry. A user can access a resource if one or more of the resource keys for the resource matches a resource key specified in that user's SNT entry.

Figure 2 illustrates the process of resource key checking.

Resource key checking

Figure 2: Resource key checking

Sign-on Table (SNT) Entries

You must create an entry for the user in the Sign-on Table (SNT) if the user requires:

Each entry in the SNT specifies the following:

The User SYSAD

When you create a MTO Resource Definition File, its SNT already contains an entry for the system administrator, with username SYSAD and password SYSAD. (You must enter this password in upper case.)

User SYSAD has system administrator privileges and owns all security and resource keys.

You should change SYSAD's password to something more secure as soon as possible.

Password Encryption and Decryption

MTO calls a user-replaceable module, dfhucryp.gnt in location /$COBDIR/src/, to perform encryption and decryption of user passwords. The installed module does not actually perform any encryption; that is, the encrypted password is the same as the unencrypted password. You can replace this module with one that implements a password encryption and decryption strategy appropriate for your site.

An example module, dfhucry1.gnt, which implements a simple encryption and decryption scheme is supplied. Its source (.cbl) form is provided in the directory $COBDIR/src/directory. It uses the number of 1 bits in the user ID as a shift count and a pair of encipher and decipher tables.

The Interface to the Password Module

The interface to dfhucryp.gnt is a standard call interface, requiring a single parameter:

CALL "DFHUCRYP" USING CRYPT-PARAMETER-AREA.
 01  CRYPT-PARAMETER-AREA.
     05  CRYPT-FUNCTION                PIC XX COMP-X.
         88  CRYPT-ENCRYPT-88             VALUE 1.
         88  CRYPT-DECRYPT-88             VALUE 2.
     05  CRYPT-RESULT                  PIC XX COMP-X.
         88 CRYPT-SUCCESSFUL-88           VALUE 0.
         88 CRYPT-FAILED-88               VALUE 1.
     05  CRYPT-USER-ID                 PIC XX(8).
     05  CRYPT-ENCRYPTED-PASSWORD      PIC XX(8).
     05  CRYPT-DECRYPTED-PASSWORD      PIC XX(8).

where:

CRYPT-FUNCTION Specifies the function as encrypt (=1) or decrypt (=2).

The encrypt function takes the decrypted password as input and outputs the encrypted password, possibly referring to the user ID field.

The decrypt function takes the encrypted password as input and outputs the decrypted password, possibly referring to the user ID field.

CRYPT-RESULT This field is used to signal the success (=0) or failure (=1) of the function. Since a failure is treated as a password mismatch in all validation functions, the error return can be used to screen out unacceptable passwords during the SNT update process.
CRYPT-USER-ID The user ID associated with the password being encrypted or decrypted.
CRYPT-ENCRYPTED-PASSWORD The encrypted password. This field is used as an input field by the decrypt function and as an output field by the encrypt function.
CRYPT-DECRYPTED-PASSWORD The decrypted password. This field is used as an output field by the decrypt function and as an input field by the encrypt function.

Choosing an Encryption and Decryption Scheme

The only restrictions on the encryption and decryption scheme you choose are as follows:

You should bear in mind that the routine is called on entry to the resource definition maintenance functions and at every attempt to sign on to MTO. A slow scheme can, therefore, result in poor performance.

Replacing the Password Encryption and Decryption Scheme

If you alter your password encryption and decryption scheme, any encrypted passwords stored in the Sign-on Table (SNT) must be decrypted using the old scheme and then re-encrypted with the new scheme. A utility program called dfhpcryp.gnt is supplied to assist in this conversion.

The procedure for moving to a new encryption scheme is described below. In this procedure, you introduce your new encryption module to the system as dfhucryu.gnt. You then run the dfhpcryp.gnt utility, which uses the existing module, dfhucryp.gnt, and your new one to perform the conversion. When the conversion is complete, you replace the existing module with your new one.

Before you make any changes, please take a backup copy of:

To run dfhpcryp.gnt:

  1. Compile the new encryption module to .gnt, but DO NOT replace the existing dfhucryp.gnt.

    Warning: Your new module must only replace the existing dfhucryp.gnt after the dfhpcryp.gnt has been run to perform the conversion.

  2. Rename your new encryption module to dfhucryu.gnt and copy it into the same directory as the existing dfhucryp.gnt.
  3. Ensure that no part of MTO is active.
  4. Run the dfhpcryp.gnt utility.
  5. When dfhpcryp.gnt completes, remove dfhucryp.gnt and rename dfhucryu.gnt to dfhucryp.gnt.
  6. Back up the modified Resource Definition File.

MTO is now ready to run with the new encryption and decryption scheme.

The backups taken during this process are important in case you want to return to the old encryption and decryption scheme for any reason.

JCL Submission

In order for a user to submit JCL, you must ensure that the Authorized(User may submit JCL to JES) option on the user definition is checked.