DataPower

DataPower

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

Explore the New Features in IBM DataPower 10.6.1!

By Ulas Cubuk posted Tue October 22, 2024 08:11 AM

  

Explore the New Features in IBM DataPower 10.6.1!

Following on from the IBM DataPower 10.6 Long Term Support (LTS), we’re thrilled to introduce IBM DataPower 10.6.1, the first Continuous Delivery (CD) release in the 10.6 series. This latest release is packed with features that enhance security and usability. In this blog, we'll dive into the details of these exciting updates.

Enhanced Security for IBM MQ: More Control Over TLS Connectivity

We're excited to announce a new feature that gives you more control over the security of your IBM MQ v9+ queue manager. You can now modify the behavior of Online Certificate Status Protocol (OCSP) and Certificate Revocation List (CRL) checking for Transport Layer Security (TLS) connectivity.

By default, IBM MQ behaves in the following way when it comes to OCSP and CRL checks for TLS connectivity:

  • OCSP Checks: IBM MQ attempts to perform an OCSP security check against the servers listed in the AuthorityInfoAccess (AIA) certificate extension.
  • Handling Unknown Revocation Status: If the revocation status of a certificate can't be determined from an OCSP server, the connection is closed with an error.
  • CRL Checks: IBM MQ does not perform a CDP revocation check against the servers listed in the CrlDistributionPoint (CDP) certificate extension.
  • CCDT File Configuration: IBM MQ attempts to load the configuration for certificate revocation from the CCDT file and runs the check as configured. If the CCDT file can't be opened or the certificate can't be validated, the MQCONN call fails.

With this new feature, you have more flexibility and control over the security of your IBM MQ queue manager. You can modify the default behavior to suit your specific needs and ensure the security and integrity of your TLS connections.

For more information, see Configuring an IBM MQ queue manager. 

Enhanced Security for Signing and Verifying Messages

We're excited to introduce support for the sha256-rsa-MGF1 algorithm. This asymmetric algorithm can be used for signing and verifying messages, providing an additional layer of security. The sha256-rsa-MGF1 algorithm is a specific implementation of RSASSA-PSS (RSA Signature Scheme with Appendix - Probabilistic Signature Scheme) that uses the SHA-256 hash function and the MGF1 mask generation function.

With this update, you can now specify the sha256-rsa-MGF1 algorithm when configuring the sign action. This allows you to sign messages with an even higher level of security, and the verify action can verify these signed messages. This enhancement ensures that our customers can meet regulatory requirements.

Add Context to Your Crypto Objects

We've added a Comments property to various crypto objects, including:

  • Certificate
  • Firewall credentials
  • Identification credentials
  • Key
  • Shared secret key
  • Validation credentials

This property allows you to add notes and context to your crypto objects, making it easier to manage and understand your configurations.

Updated Status Providers

We've updated the following status providers to include the Comments property data:

  • DNS static hosts status provider and the show static-hosts command
  • Routing table status provider and the show route command

These updates provide more detailed information about your configurations, making it easier to troubleshoot and optimize your systems.

Adaptive Mode for Analytics Endpoint

Our new adaptive mode for the analytics endpoint ensures that your analytics records are optimized for memory usage. This feature dynamically controls the maximum size of analytics records, preventing dropped records and out-of-memory states.

Here's how it works:

Memory State

Analytics Record Size

Normal

Defined maximum record size

Low

4 KB

Out of Memory

No records queued

Conclusion

The 10.6.1 release is packed with exciting features that enhance security, and usability. We're committed to continuously improving our products and services to meet your evolving needs. Stay tuned for more updates and announcements!

To learn more about these new features and how to implement them, please refer to our documentation.

    We hope you find these updates helpful!

    0 comments
    26 views

    Permalink