CICS Security Credential Container for Cross-Region Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ACF2™ technology in CICS regions causes processing errors and data corruption when modifying Terminal Input/Output Areas (TIOAs) to include and extract security credentials during cross-region data communications, leading to abnormal endings (abends) due to foreign or corrupt data.
Innovation Solution
Communicating security credentials within a container of the CICS channel data structure, where the credential container is added before the CICS transformer process when sending data and removed after receiving data, avoiding modifications to CICS-owned data structures and thus preventing disruptions to transformer processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security credentials are added to TIOA data structures during cross-region communications, then user authentication is enabled, but data corruption and processing errors occur
Solution Approach 1:
The patent introduces a credential container as an intermediary data structure that holds security credentials separately from the TIOA data structures. This container acts as a mediator between the credential data and the CICS transformer process, preventing direct modification of TIOA while enabling authentication. The container is added to the channel data before transformation and removed after, isolating the credential handling from the core CICS processing.
Solution Approach 2:
The patent segments the credential data from the main TIOA data structure by placing it in a separate container within the channel data. This segmentation allows credentials to be transmitted and processed independently without affecting the integrity of the original TIOA data structures, thus preventing data corruption while maintaining authentication functionality.
2Reliability
If TIOA data structures are modified to include security credentials, then authentication is achieved, but CICS processing errors occur
Solution Approach 1:
The credential container serves as an intermediary that enables authentication without requiring modification of TIOA data structures. By placing credentials in this separate container within the channel data, the system achieves authentication while preserving the integrity and expected format of CICS data structures, preventing processing errors.
Solution Approach 2:
Instead of modifying the original TIOA data structures, the patent creates a copy of the necessary credential information within a container in the channel data. This copying approach allows authentication to proceed using the credential copy while the original TIOA structures remain unmodified and intact for normal CICS processing.
3Reliability
If credentials are extracted before the transformer process, then authentication is possible, but data loss and corruption occur
Solution Approach 1:
The patent performs the preliminary action of adding the credential container to the channel data before the CICS transformer process executes. This ensures credentials are available for authentication when needed, while the container remains intact through transformation. The container is only removed after successful reception, preventing data loss.
Solution Approach 2:
The credential container acts as a protective intermediary that preserves credential data through the transformation process. By maintaining the container throughout transformation and only removing it after receipt, the system enables authentication without exposing the underlying data structures to corruption or loss.
Data Source
AI summary
Various embodiments include at least one of systems, methods, software, and data structures for communicating security credentials between Customer Information Control System (CICS) regions in a container of a CICS channel data structure. Some embodiments include receiving a dataset from a first CICS application executing within a first CICS region, the dataset received from the first CICS application for transmission to a second CICS application in a second CICS region. When the dataset includes a channel data, populating a container of the channel data with credential data to authenticate the dataset within the second CICS region and forwarding the dataset to a CICS transformer process of the first CICS region to transform and communicate the dataset to the second application in the second CICS region.