IBM reboots iconic mainframe: Encrypt data all the time, at any scale

IBM today unveiled IBM Z, the next generation of a transaction system capable of running more than 12 billion encrypted transactions per day. The new system also introduces an encryption engine that, for the first time, makes it possible to pervasively encrypt data associated with any application, cloud service or database all the time.

In the most significant re-positioning of mainframe technology in more than a decade, when the platform embraced Linux and open source software, the system’s advanced cryptographic capability now extends across any data, networks, external devices or entire applications, with no application changes and no impact on business service level agreements.

“The vast majority of stolen or leaked data today is in the open and easy to use because encryption has been very difficult and expensive to do at scale,” said Ross Mauri, General Manager, IBM Z. “We created a data protection engine for the cloud era to have a significant and immediate impact on global data security.”

Hardware features

The IBM Z features the industry’s fastest microprocessor, running at 5.2GHz, and a new scalable system structure that delivers up to a 35 percent capacity increase for traditional workloads and a up to a 35 percent capacity increase for Linux workloads compared to the previous generation z13. The system can support:

• More than 12 billion encrypted transactions per day on a single system.
• The world’s largest MongoDB instance with 2.5x faster NodeJS performance than compared x86-based platforms.
• Two million Docker Containers.
• 1,000 concurrent NoSQL databases.

Other new available capabilities announced today include:

• Three times the memory of the z13 for faster response times, greater throughput and accelerated analytics performance. With 32TB of memory, IBM Z offers one of the largest memory footprints in the industry.
• Three times faster I/O and accelerated transaction processing compared to the z13 to drive growth in data, transaction throughput and lower response time.
• The ability to run Java workloads 50 percent faster than x86 alternatives.
• Storage Area Network response time with zHyperLink, delivering 10x latency reduction compared to the z13 and cutting application response time in half – enabling businesses to do much more work such as real-time analytics or interact with IoT devices and cloud applications within the same transaction, without changing a single line of application code.

Industry-first pervasive encryption for the cloud era

Encryption is often largely absent in corporate and cloud data centers because current solutions for data encryption in x86 environments can degrade performance (and thus user experience), and can be too complex and expensive to manage. As a result, only about two percent of corporate data is encrypted today, while more than 80 percent of mobile device data is encrypted.

IBM Z pervasive encryption reflects a call to action on data protection articulated by CISOs and data security experts worldwide, and more than 150 IBM clients around the world who participated and provided feedback in IBM Z’s system design over three years.

As a result of this collaboration, IBM Z brings advances in cryptography technology, building on an encryption platform that safeguards the world’s banking, healthcare, government and retail systems. IBM Z pervasive encryption delivers:

Pervasive encryption of data – All the time. IBM Z makes it possible, for the first time, for organizations to pervasively encrypt data associated with an entire application, cloud service or database in flight or at rest with one click. The standard practice today is to encrypt small chunks of data at a time, and invest significant labor to select and manage individual fields. This bulk encryption at cloud scale is made possible by a massive 7x increase in cryptographic performance over the previous generation z13 – driven by a 4x increase in silicon dedicated to cryptographic algorithms. This is 18x faster than compared x86 systems (that today only focus on limited slices of data) and at just five percent of the cost of compared x86-based solutions.

Tamper-responding encryption keys. A top concern for organizations is protection of encryption keys. In large organizations, hackers often target encryption keys, which are routinely exposed in memory as they are used. IBM Z can protect millions of keys (as well as the process of accessing, generating and recycling them) in “tamper responding” hardware that causes keys to be invalidated at any sign of intrusion and can then be restored in safety. The IBM Z key management system is designed to meet FIPS Level 4 standards, where the norm for high security in the industry is Level 2. This IBM Z capability can be extended beyond the mainframe to other devices, such as storage systems and servers in the cloud. In addition, IBM Secure Service Container protects against insider threats from contractors and privileged users, provides automatic encryption of data and code in-flight and at-rest, and tamper-resistance during installation and runtime.

Encrypted APIs. IBM z/OS Connect technologies make it easy for cloud developers to discover and call any IBM Z application or data from a cloud service, or for IBM Z developers to call any cloud service. IBM Z now allows organizations to encrypt these APIs – the digital glue that links services, applications and systems – nearly 3x faster than alternatives based on compared x86 systems.

Designed for tough new data protection regulations

The IBM Z also helps clients build trust with consumers and comply with new standards such as the EU’s General Data Protection Regulation (GDPR) that will increase data protection requirements for organizations doing business in Europe starting next year. At the U.S. Federal level, the Federal Financial Institutions Examination Council (FFIEC), which includes the five banking regulators, provides guidance on the use of encryption in the financial services industry. Singapore and Hong Kong have published similar guidance. More recently, the New York State Department of Financial Services published requirements regarding encryption in the Cybersecurity Requirements for Financial Services Companies.

IBM Z, integrated with IBM Security software, automates and streamlines security and compliance processes. For example, auditors are expected to manually inspect and validate the security of databases, applications and systems. Organizations can now immediately demonstrate that data within the scope of compliance is protected and the keys are secure. This can significantly reduce the mounting complexity and cost of compliance for auditors. The system also provides an audit trail showing if and when permissioned insiders accessed data.

Creating the most secure blockchain service

As blockchain applications become increasingly integrated into core business processes, client’s concerns are naturally shifting to security, encryption, and resiliency. The IBM Cloud is evolving again to bring IBM Z onto the IBM Cloud, launching initially as an encryption engine for cloud services and to run IBM Blockchain services to provide the highest commercially available levels of cryptographic hardware. New blockchain services in centers in Dallas, London, Frankfurt, Sao Paolo, Tokyo and Toronto are secured using IBM Z’s industry-leading cryptography technology.

New: Predictable and transparent container pricing

IBM also announced three groundbreaking new Container Pricing models for IBM Z, providing clients greatly simplified software pricing that combines flexible deployment with competitive economics vs. public clouds and on-premises x86 environments:

• New microservices and applications that enable clients to maximize the value from security-rich on-premises enterprise systems in real time. Clients can now co-locate applications to optimize qualities of services that are priced competitively with public cloud and on-premises platforms.
• Application development and test with the freedom to triple capacity of all development environments on z/OS to support latest DevOps tooling and processes. Clients can triple capacity with no increase in monthly license charge.
• Payment systems pricing based on the business metric of payments volume a bank processes, not the available capacity. This gives clients much greater flexibility to innovate affordably in a competitive environment, particularly in the fast-growing Instant Payment segment.

These precedent-setting Container Pricing options are designed to give clients the predictability and transparency they require for their business. The pricing models are scalable both within and across logical partitions (LPARs) and deliver enhanced metering, capping and billing capabilities. Container Pricing for IBM Z is planned to be available by year-end 2017 and enabled in z/OS V2.2 and z/OS V2.3.