Search

In this paper, we present the architecture of the IBM Tivoli® Change and Configuration Management Database. Its main features include a rich data model, automatic discovery of data for configuration items, visualization of application dependencies on configuration items, and multicustomer support. We discuss implementation topics, such as relationship management, composite configuration items, data federation, reconciliation of data from different sources, a security model for multicustomer support, and integration of change-management and configuration-management processes.

Long before the advent of electronic systems, different methods of information scrambling were used. Early attempts at data security in electronic computers employed some of the same transformations. Modern secret key cryptography brought much greater security, but eventually proved vulnerable to brute-force attacks. Public key cryptography has now emerged as the core technology for modern computing security systems. By associating a public key with a private key, many of the key distribution problems of earlier systems are avoided. The Internet public key infrastructure provides the secure digital certification required to establish a network of trust for public commerce. This paper explores the details of the infrastructure.

We briefly review the IBM System Object Model (SOM, incorporated in SOMobjects™) and Distributed SOM (DSOM). We then describe the base DSOM security architecture characterized by the presence of the Object Security Service (OSS) framework in the DSOM run-time environment. Depending on its implementation, this framework can be wrapped around procedural security service providers, thus taking advantage of existing security mechanisms. Subsequently we elaborate on the OSS elements for authentication and authorization and how they relate to the DSOM Object Request Broker (ORB™) on the one hand, and to the client and server applications on the other hand. We discuss the DSOM approach to object access control and present a novel method for enforcing it.

In this paper, we review the important theoretical models of computer access control systems. Using the IBM Multiple Virtual Storage (MVS) operating system as the example, we show how the principles expressed in these models can be implemented. The roots of user authentication and access control on MVS are examined, tracing the convergence of the requirement for controls with the development of appropriate software. The paper also highlights security and auditing features unique to the host-centric computing model and discusses how these existing technologies might be applied to the security problems presented by the newer networking computing models. Finally, we look to the future and suggest the environment that will result when the host-centric computing model for security and access control is interoperated with the networking computing models.