C. Bornträger;J. D. Bradbury;R. Bündgen;F. Busaba;L. C. Heller;V. Mihajlovski
{"title":"Secure your cloud workloads with IBM Secure Execution for Linux on IBM z15 and LinuxONE III","authors":"C. Bornträger;J. D. Bradbury;R. Bündgen;F. Busaba;L. C. Heller;V. Mihajlovski","doi":"10.1147/JRD.2020.3008109","DOIUrl":null,"url":null,"abstract":"With the growth of IBM Z and LinuxONE in the cloud, customers are expecting their workloads and data to have the same levels of security, isolation, and privacy as running on-premise. In order to achieve these levels of trust, the IBM z15 and LinuxONE III provide the IBM Secure Execution for Linux facility, which isolates customers’ data from each other, as well as from the cloud administrators. Unlike other solutions in the industry, IBM Secure Execution does not require remote attestation, thus simplifying the deployment of applications into the protected environment. Also, unlike some other solutions in the industry, the integrity of data is protected end-to-end, that is, from the boot image on disk to memory as it is paged by the hypervisor and throughout execution. The isolation and integrity are provided by hardware and trusted firmware known as the ultravisor. In this article, we describe the security model of IBM Secure Execution, the functionality of the hardware and ultravisor, as well as the required changes to the hypervisor in order to support protected virtual machines.","PeriodicalId":55034,"journal":{"name":"IBM Journal of Research and Development","volume":null,"pages":null},"PeriodicalIF":1.3000,"publicationDate":"2020-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://sci-hub-pdf.com/10.1147/JRD.2020.3008109","citationCount":"5","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"IBM Journal of Research and Development","FirstCategoryId":"94","ListUrlMain":"https://ieeexplore.ieee.org/document/9138728/","RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q1","JCRName":"Computer Science","Score":null,"Total":0}
引用次数: 5
Abstract
With the growth of IBM Z and LinuxONE in the cloud, customers are expecting their workloads and data to have the same levels of security, isolation, and privacy as running on-premise. In order to achieve these levels of trust, the IBM z15 and LinuxONE III provide the IBM Secure Execution for Linux facility, which isolates customers’ data from each other, as well as from the cloud administrators. Unlike other solutions in the industry, IBM Secure Execution does not require remote attestation, thus simplifying the deployment of applications into the protected environment. Also, unlike some other solutions in the industry, the integrity of data is protected end-to-end, that is, from the boot image on disk to memory as it is paged by the hypervisor and throughout execution. The isolation and integrity are provided by hardware and trusted firmware known as the ultravisor. In this article, we describe the security model of IBM Secure Execution, the functionality of the hardware and ultravisor, as well as the required changes to the hypervisor in order to support protected virtual machines.
期刊介绍:
The IBM Journal of Research and Development is a peer-reviewed technical journal, published bimonthly, which features the work of authors in the science, technology and engineering of information systems. Papers are written for the worldwide scientific research and development community and knowledgeable professionals.
Submitted papers are welcome from the IBM technical community and from non-IBM authors on topics relevant to the scientific and technical content of the Journal.