Secure your cloud workloads with IBM Secure Execution for Linux on IBM z15 and LinuxONE III

IF 1.3 4区 计算机科学 Q1 Computer Science
C. Bornträger;J. D. Bradbury;R. Bündgen;F. Busaba;L. C. Heller;V. Mihajlovski
{"title":"Secure your cloud workloads with IBM Secure Execution for Linux on IBM z15 and LinuxONE III","authors":"C. Bornträger;J. D. Bradbury;R. Bündgen;F. Busaba;L. C. Heller;V. Mihajlovski","doi":"10.1147/JRD.2020.3008109","DOIUrl":null,"url":null,"abstract":"With the growth of IBM Z and LinuxONE in the cloud, customers are expecting their workloads and data to have the same levels of security, isolation, and privacy as running on-premise. In order to achieve these levels of trust, the IBM z15 and LinuxONE III provide the IBM Secure Execution for Linux facility, which isolates customers’ data from each other, as well as from the cloud administrators. Unlike other solutions in the industry, IBM Secure Execution does not require remote attestation, thus simplifying the deployment of applications into the protected environment. Also, unlike some other solutions in the industry, the integrity of data is protected end-to-end, that is, from the boot image on disk to memory as it is paged by the hypervisor and throughout execution. The isolation and integrity are provided by hardware and trusted firmware known as the ultravisor. In this article, we describe the security model of IBM Secure Execution, the functionality of the hardware and ultravisor, as well as the required changes to the hypervisor in order to support protected virtual machines.","PeriodicalId":55034,"journal":{"name":"IBM Journal of Research and Development","volume":null,"pages":null},"PeriodicalIF":1.3000,"publicationDate":"2020-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://sci-hub-pdf.com/10.1147/JRD.2020.3008109","citationCount":"5","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"IBM Journal of Research and Development","FirstCategoryId":"94","ListUrlMain":"https://ieeexplore.ieee.org/document/9138728/","RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q1","JCRName":"Computer Science","Score":null,"Total":0}
引用次数: 5

Abstract

With the growth of IBM Z and LinuxONE in the cloud, customers are expecting their workloads and data to have the same levels of security, isolation, and privacy as running on-premise. In order to achieve these levels of trust, the IBM z15 and LinuxONE III provide the IBM Secure Execution for Linux facility, which isolates customers’ data from each other, as well as from the cloud administrators. Unlike other solutions in the industry, IBM Secure Execution does not require remote attestation, thus simplifying the deployment of applications into the protected environment. Also, unlike some other solutions in the industry, the integrity of data is protected end-to-end, that is, from the boot image on disk to memory as it is paged by the hypervisor and throughout execution. The isolation and integrity are provided by hardware and trusted firmware known as the ultravisor. In this article, we describe the security model of IBM Secure Execution, the functionality of the hardware and ultravisor, as well as the required changes to the hypervisor in order to support protected virtual machines.
在IBM z15和LinuxONE III上使用IBM Secure Execution for Linux保护您的云工作负载
随着IBM Z和LinuxONE在云中的发展,客户希望他们的工作负载和数据具有与在本地运行相同的安全性、隔离性和隐私级别。为了实现这些级别的信任,IBM z15和LinuxONE III提供了IBM Secure Execution for Linux功能,该功能将客户的数据相互隔离,并将其与云管理员隔离。与行业中的其他解决方案不同,IBM Secure Execution不需要远程认证,从而简化了应用程序在受保护环境中的部署。此外,与行业中的其他一些解决方案不同,数据的完整性受到端到端的保护,即从磁盘上的启动映像到内存,在系统管理程序对其进行分页时以及在整个执行过程中都受到保护。隔离和完整性由被称为超级监控程序的硬件和可信固件提供。在本文中,我们描述了IBM Secure Execution的安全模型、硬件和超级管理程序的功能,以及为支持受保护的虚拟机而对管理程序进行的必要更改。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 求助全文
来源期刊
IBM Journal of Research and Development
IBM Journal of Research and Development 工程技术-计算机:硬件
自引率
0.00%
发文量
0
审稿时长
6-12 weeks
期刊介绍: The IBM Journal of Research and Development is a peer-reviewed technical journal, published bimonthly, which features the work of authors in the science, technology and engineering of information systems. Papers are written for the worldwide scientific research and development community and knowledgeable professionals. Submitted papers are welcome from the IBM technical community and from non-IBM authors on topics relevant to the scientific and technical content of the Journal.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
copy
已复制链接
快去分享给好友吧!
我知道了
右上角分享
点击右上角分享
0
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术官方微信