S/390 Parallel Enterprise Server CMOS Cryptographic Coprocessor

As the Internet becomes the basis for electronic commerce, and as more businesses automate their data processing operations, the potential for unauthorized disclosure of sensitive data increases. On-line databases are becoming increasingly large and complex. Sensitive data is transmitted on communication lines and often stored off-line. As a result, the efficient, economical protection of enterprise-critical information is becoming increasingly important in many diverse application environments. The protection required to conduct commerce on the Internet, provide data confidentiality, and provide user authentication can be achieved only by cryptographic services and techniques. The high-speed, physically secure IBM S/390 CMOS Cryptographic Coprocessor for S/390 Parallel Enterprise Servers, together with the IBM Integrated Cryptographic Service Facility (ICSF), an IBM licensed program for the OS/390 operating system, provides the ability to encrypt and decrypt data, generate and manage cryptographic keys, perform PIN operations, and perform other cryptographic functions dealing with data integrity, digital signatures, and key exchange. Introduction The IBM S/390* CMOS Cryptographic Coprocessor for S/390 Parallel Enterprise Servers* [1], herein called the S/390 Cryptographic Module (SCM), is an extension to the S/390 central processor unit (CPU) and can be considered as an additional execution element. It is implemented on a single CMOS chip that connects both physically and logically to a CPU, and is supported by the IBM Integrated Cryptographic Service Facility (ICSF) [2]. Depending on the model, one or two SCMs are provided. Figure 1 shows a S/390 system architecture with two SCMs. The SCM hardware implements the S/390 cryptographic architecture, which is an extension of the S/390 architecture [3]. Available only in the ESA/390* mode, it is an upward-compatible extension to the Integrated Cryptographic Facility (ICRF) provided on the bipolar S/390 Enterprise Servers. All functions to support data privacy, message authentication, personal identification, and key management (along with many extensions) are provided as they were for ICRF. These functions and the associated instructions are referred to as the direct attached crypto (DAC) operations. For DAC operations, each SCM appears to be attached to only one CPU in the configuration and functions as an integral part of that CPU. That is, the DAC instructions are performed synchronously with the instruction processing of that CPU.