MQ

MQ

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Data encryption at rest and Transit for MQ

  • 1.  Data encryption at rest and Transit for MQ

    Posted Mon August 10, 2020 02:04 PM
    Hello,

    Can someone please share some information how Data encryption at rest and transit is will work in MQ, and also how users authenticate and authorize the MQ?. Thanks.

    ------------------------------
    SANTOSH BABBURU
    ------------------------------


  • 2.  RE: Data encryption at rest and Transit for MQ

    Posted Mon August 10, 2020 02:17 PM
    In Transit, you can use TLS on channels.
    In Rest, you will have to enable AMS which is MQ Advance.

    ------------------------------
    om prakash
    Oak Creek WI
    4146611399
    ------------------------------

    Original Message


  • 3.  RE: Data encryption at rest and Transit for MQ

    Posted Mon August 10, 2020 03:45 PM
    Thank you Prakash, can you please provide some details on encryption at rest and also can MQ users can integrate with active directory?

    ------------------------------
    SANTOSH BABBURU
    ------------------------------

    Original Message


  • 4.  RE: Data encryption at rest and Transit for MQ

    Posted Tue August 11, 2020 02:37 AM
    Hello Santosh,

    MQ AMS (Advanced Message Security) which is part of MQ Advanced provides the possibility to encrypt and or sign messages from the moment the producer to the consumer.
    The solution uses Public Key Infrastructure to achieve this.
    https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.2.0/com.ibm.mq.sec.doc/q014590_.htm
    Authentication is something else and MQ allows to use the local operating system or an LDAP.
    https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.2.0/com.ibm.mq.sec.doc/q113250_.htm

    ------------------------------
    Pierre Richelle
    IBM Hybrid Cloud Integration Specialists
    IBM
    bruxelles
    0474681892
    ------------------------------

    Original Message


  • 5.  RE: Data encryption at rest and Transit for MQ

    Posted Tue August 11, 2020 04:28 PM
    Hi Pierre,

    AMS is an extra license we haven't purchased. I need to find through data at rest issues without AMS option, please advise.

    ------------------------------
    SANTOSH BABBURU
    ------------------------------

    Original Message


  • 6.  RE: Data encryption at rest and Transit for MQ

    Posted Wed August 12, 2020 07:15 AM
    Hi,

    The only option that you might have would be to encrypt the disk and set specific security access to MQ and the MQ log.
    An alternative would be 
    1- encrypt/decrypt messages on the application
    2-write an exit (Channel message exit) that would decrypt/encrypt the message.

    But this will take you some days to write a proper solution + maintenance.

    I think it might be better to buy a MQ trade-up to MQ Advanced (which includes other features such as File transfer, HA, MQTT).
    More over the solution is completely transparent for the applications.

    ------------------------------
    Pierre Richelle
    IBM Hybrid Cloud Integration Specialists
    IBM
    bruxelles
    0474681892
    ------------------------------

    Original Message


  • 7.  RE: Data encryption at rest and Transit for MQ

    Posted Fri August 14, 2020 04:21 PM
    Can you please share some best practices in implementing security for authorization and authentication for MQ?

    ------------------------------
    SANTOSH BABBURU
    ------------------------------

    Original Message


  • 8.  RE: Data encryption at rest and Transit for MQ

    Posted Mon August 17, 2020 05:43 AM

    Suggest that this IBM Redbook is just what you need. While it is a few years old (and a few releases back), all the concepts and features described in it are still valid.

    Secure Messaging Scenarios with WebSphere MQ

    Cheers,
    Morag



    ------------------------------
    Morag Hughson
    MQ Technical Education Specialist
    MQGem Software Limited
    ------------------------------

    Original Message


  • 9.  RE: Data encryption at rest and Transit for MQ

    Posted Mon August 17, 2020 09:10 AM
    Hi Santosh,
    I think you have three topics
    • Encryption
    • Authorization
    • Authentication
    This article may point to what you are looking for
    https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.0.0/com.ibm.mq.sec.doc/q010010_.htm
    It is about MQ Security Mechanism

    ------------------------------
    Matthias Jungbauer
    ------------------------------

    Original Message


  • 10.  RE: Data encryption at rest and Transit for MQ

    Posted Tue August 11, 2020 02:41 AM
    In one of my regular meetings I recorded on how to set up AMS and a short demo: see https://youtu.be/FIKswOZcpyc

    ------------------------------
    Francois van der Merwe
    Hybrid Cloud / Integration Specialist Tech Sales
    IBM
    Johannesburg
    +27825569467
    ------------------------------

    Original Message


  • 11.  RE: Data encryption at rest and Transit for MQ

    Posted Tue August 18, 2020 10:06 AM
    Hello Santosh,

    Mr. Google should have shown you the various MQ solutions that Capitalware offers.

    Authentication:  Since MQ v8, MQ provides a basic authentication mechanism.  If you want a very robust solution for MQ authentication then have a look at MQ Authenticate User Security Exit (MQAUSX).  You can have 1 configuration per queue manager or 1 per channel or however you want it.  It is supported on AIX, HP-UX, IBM i, Linux (x86, Power & zSystem), Solaris, Windows and z/OS.

    Encryption: Capitalware offers 2 solutions: MQ Channel Encryption (data infight) and MQ Message Encryption (data at rest).   One of the big differences between MQ Message Encryption (MQME) and MQ AMS is that MQME does NOT require certificates (neither does MQ Channel Encryption).  And the headache of yearly renewal and deployment of certificates.  Also, another big difference between MQ AMS and MQME is that MQME supports encryption/decryption of messages for BOTH queues and topics.  MQME is supported on AIX, HP-UX, IBM i, Linux (x86, Power & zSystem), Solaris and Windows.

    You can setup MQME to be in an MQ Security Grid (a term I coined), where MQME handles BOTH data inflight and data at rest.

    You can review a presentation I gave at MQ Technical Conference in 2018 called What's new in MQ Message Encryption.

    Regards,
    Roger Lacroix
    Capitalware Inc.


Related Content