With the growth of IBM Z and LinuxONE in the cloud, customers are expecting their workloads and data to have the same levels of security, isolation, and privacy as running on-premise. In order to achieve these levels of trust, the IBM z15 and LinuxONE III provide the IBM Secure Execution for Linux facility, which isolates customers’ data from each other, as well as from the cloud administrators. Unlike other solutions in the industry, IBM Secure Execution does not require remote attestation, thus simplifying the deployment of applications into the protected environment. Also, unlike some other solutions in the industry, the integrity of data is protected end-to-end, that is, from the boot image on disk to memory as it is paged by the hypervisor and throughout execution. The isolation and integrity are provided by hardware and trusted firmware known as the ultravisor. In this article, we describe the security model of IBM Secure Execution, the functionality of the hardware and ultravisor, as well as the required changes to the hypervisor in order to support protected virtual machines.

The latest-generation IBM Z processor provides enhanced performance and compute capacity compared to its IBM z14 predecessor. This article describes some of the major improvements in both process and design including out-of-order load-and-store sequencing, single-instruction multiple-data and floating point enhancements, a new modulo arithmetic engine for accelerating elliptic curve cryptography, a hardware sort accelerator, and a workflow that modernized the development of these features. Outside of the central processing unit (CPU), the cache sizes have increased on all levels, and each processor chip now contains 12 CPUs. System topology changes have been introduced allowing up to five drawers to exist in a fully populated system. The processor cache subsystem includes numerous improvements in the area of fetch, store, and cache management policies aimed at speeding up both traditional data serving workloads and highly virtualized environments alike.

The IBM Z central processor (CP) and storage controller (SC) chips contain hardware and firmware to serve selfboot and secure boot needs. Selfboot initializes the CP/SC chips from hardware and firmware, which reside in each chip module. This establishes a core root of trust and also guarantees a boot time that is independent of the system configuration, which is key for large enterprise class systems consisting of multiple drawers and chips. Secure boot is built on this core root of trust and is used to authenticate the firmware loaded from system memory prior to execution of that firmware. Selfboot and secure boot also guarantee the integrity of the CP and SC chips by restricting hardware and memory accesses through debug or service interfaces during boot, runtime, and code update phases. In this article, we describe the basic hardware and firmware concepts that are implemented and enabled for the z15 CP and SC chips.

The IBM z15 processor power management enhances several on-chip power management techniques over z14 processor with a specific focus on reducing response time for voltage droop management. The IBM z15 processor puts a specific emphasis on proactive voltage droop management strategy to reduce conservative static guard band that is added to the supply voltage in order to protect against worst-case voltage droops. The z15 processor relies on selected events from the earlier stages of a deep pipeline processor as indicators to predict sharp changes in the power consumption over a short period of time. The early information of the selected events allows to throttle the execution flow through the processor pipeline and prevents the sharp power change before it takes place and thus reduces the voltage droop. In z15, as one of the proactive schemes, we combine both the digital power-proxies, which are direct indicators of the processor activity and the Critical Path Monitors (CPMs) to give an earlier and proactive indication of voltage droop events. This proactive indication provides enough time for the throttle actuation circuits to prevent the voltage droop. CPMs act as real-time timing margin indicators, and power-proxies act to serve as the activity monitors.

The IBM z15 is designed to meet the requirements of a range of data centers, while reducing costs through increased density, configuration flexibility, and cooling efficiency. The z15 is a continuation and broadening of the physical transformation of the mainframe that began with the IBM z14 ZR1/LR1, which introduced the new “true 19-in” frame. A maximum configuration z15 delivers greater than 30% additional compute capacity per watt than z14, and maintains approximately the same maximum system footprint, while enabling significant floor space reduction for most configurations. The z15 introduces the choice of integrated 2N power using either intelligent power distribution units or bulk power, also supporting most data centers including hot/cold-aisle containment, raised-floor and nonraised-floor, and top and bottom-exit I/O and power. The z15 supports the ASHRAE A3 (fourth edition) environment, providing efficiency advantages by reducing humidification requirements. The z15 maintains the value of a system that is preconfigured/pretested before shipping. Innovations in packaging, I/O cabling, controls, and testing are put in the context of the latest data center trends. The capabilities of new tools to estimate power, weight, airflow, heat extracted to water for water-cooled systems as well as 3-D and computational fluid dynamics models to aid in the planning for the system are described.

Timekeeping and highly accurate, precise time synchronization are key requirements for modern information technology systems. While true for several industries, this is especially true for industries involved in transaction processing such as the financial industry. As such, the IBM Z Sysplex needs highly accurate timing/timekeeping and synchronization technology to ensure data integrity, and to also provide the ability to reconstruct a database based upon logs. Recently enacted changes and new regulatory requirements, both in Europe and the United States, have brought increasing attention to time synchronization accuracy. These regulations spurred an interest, both from IBM Z and from our IBM Z clients, in the IEEE 1588 Precision Time Protocol (PTP) being implemented in IBM Z. This article explains the history of PTP, PTP technology, the regulations that led IBM to introduce PTP to IBM Z, PTP's implementation on IBM Z, and IBM's involvement and leadership in the development of the PTP technology and standards going forward.

Controlling access to and privacy of data within the enterprise can prove to be a formidable task with increased complexity and management overhead encountered as the granularity of access control is increased. Fibre Channel is the premier enterprise storage transport, so an organization's most sensitive data flows over Fibre Channel links within and across datacenters. In this article, we discuss a new, easy way to deploy innovation for Fibre Channel connections that ensures data is exchanged only between trusted servers and storage controllers, while also enabling the integrity and confidentiality of the data in flight between the trusted entities. We explain how the components of IBM Fibre Channel Endpoint Security are configured to work together to provide protection from insider threats, requiring minimal steps to deploy, fully controlled via policy, and transparent to applications, middleware, and operating systems.

System security is currently a main focus area for all IT infrastructure providers. New system features like pervasive encryption, the transition to cloud-based offerings, and the demand for quantum-safe platforms demand increased cryptographic performance as well as more cryptographic agility. The new IBM 4769 Cryptographic Coprocessor addresses these trends. It brings performance improvements that match the requirements of the new IBM z15. A combination of newly available features allows IBM z15 to scale to greater than 5,000 Virtual Hardware secure modules per system and makes it suitable to support virtualized client environments such as cloud-scale datacenters. To meet the dense packaging and energy requirements of those data centers, the form factor and power consumption of the card were reduced significantly. The card also offers an expanded set of algorithms to support state-of-the-art as well as future workloads. For the first time, the user interface provides access to a selected set of quantum-safe algorithms. Infrastructure extensions add hardware-embedded, attestation-friendly trusted boot services, which improve system resiliency by providing hardware enabled measurements of the secure and trusted boot process. These extensions simultaneously simplify the security certifications built on them. This article provides an overview of the IBM 4769 cryptographic coprocessor, highlighting security characteristics, internal hardware, form factor, and enhanced firmware.