IBM Secure Service Container framework
|
Naming: The IBM z14 server generation is available as the following machine types and models:
•Machine Type 3906 (M/T 3906), Models M01, M02, M03, M04, and M05 → further identified as IBM z14 Model M0x, or z14 M0x.
•Machine Type 3907 (M/T 3907), Model ZR1 → further identified as IBM z14 Model ZR1, or z14 ZR1.
Unless otherwise specified, IBM z14 (z14) refers to both machine types in the remainder of this appendix.
|
In this appendix, the IBM Secure Service Container1 (SSC) framework is described. The SSC framework is available on IBM z14, and IBM z13 and z13s (Driver level 27) systems.
This appendix also briefly describes the reason why IBM created the SSC framework and how the SSC environment is intended to be used.
This appendix includes the following topics:
A.1 What is IBM Secure Service Container?
An appliance is an application (software) that provides a specified function or set of functions (service). It is packaged and deployed with a specific (trimmed) operating system in a virtual machine or a dedicated commodity of the shelf (COTS) hardware (physical server). It requires little to no intervention from a system administrator (software update, OS update, and maintenance).
An appliance must satisfy various requirements, such as certified functionality and security (the function it provides must be tamper-resistant, even from system administrators or other privileged users) and simple deployment and maintenance.
In the current IT deployments, various components that serve the business processes (databases, middleware, applications, and so on) require specialized management functions (such as access management, enterprise directories, secure key management, backup and restore). The development requirements of the management functions do not follow the dynamic of the actual business functions.
Because of the diversity of the platforms on which the business applications run, the management function must be maintained (updated, tested, or even certified) if the management functions are deployed alongside the mainstream business applications when the platform must be maintained or upgraded. However, the complexity and associated IT spending is increased.
As such, these management functions can be deployed by using an appliance model in which the functions that are provided are available and accessible through standardized methods.
Many appliances are available from various suppliers. Each appliance includes the following features:
•Separate administration and deployment process
•Different hardware configuration requirements
•Different performance profile and management requirements
•Different security characteristics that require alignment with enterprise requirements
A.1.1 SSC framework
IBM developed the SSC framework. This framework provides the base infrastructure to create and deploy an appliance, including operating system, middleware, Software Development Kit (SDK), and firmware support. A special feature of the IBM SSC framework is that it protects the deployed workload from being accessed by a system administrator or an external attacker.
A.2 SSC LPAR
For IBM Z, the SSC Partition is an LPAR type that runs an appliance based on Secure Service Container framework.
Multiple virtual appliances that are integrated into IBM Secure Service Container can be deployed on IBM z14 (z13 and z13s also). These virtual appliances include the following common features:
•Administration (deployment)
•Hardware configuration
•Managed performance profiles
•Security characteristics (aligned with enterprise requirements)
At the time of this writing, the following appliances are available from IBM:
•z/VSE Network Appliance.
•IBM Z Advanced Workload Analysis Reporter (IBM zAware), which is now deployed as a software appliance and integrated with IBM Operations Analytics for Z.
More appliances are expected in the future. Appliances can be implemented as firmware or software, depending on the environment on which the appliance runs and the function it must provide.
The SSC framework is available on IBM z14, z13, and z13s.
A.3 Why Secure Service Container?
The SSC framework simplifies the process that a team must apply to create an appliance. It also enforces a common set of behaviors for operations that all appliances must perform.
The SCC framework also provides a set of utilities that is used to implement the common functions that all appliances need (FFDC, network setup, appliance configuration, and so on.). An application developer can use the SSC framework to turn a solution into a stand-alone appliance that is easily installed onto the IBM Z platform.
The SSC framework enables the release a product as software or firmware that is based on a business decision, not on a technical decision.
Deploying an appliance takes minutes. Appliances do not require any operating system knowledge or middleware knowledge. They allow users to focus on the core services they deliver.
A.4 IBM Z and Secure Service Container
Appliances that are based on the SSC framework share the following features and characteristics:
•Encapsulated operating systems
•Services that are provided by using Remote APIs (RESTful) and web interfaces
•Embedded monitoring and self-healing
•End-to-end tamper-protection
•Protected intellectual property
•Tested and qualified by IBM for a specific use case
•Can be delivered as firmware or software
The deployment model for an appliance is shown in Figure A-1.
Figure A-1 Appliance deployment in an SSC LPAR on IBM Z
SSC provides a highly secure context (see Figure A-2) for deploying appliances that include the following features:
•Allows no system admin access:
– After the appliance image is built, OS access is not possible
– Only Remote APIs are available
– Memory access of system admin is disabled
•Data storage uses encrypted disk
•Debug data (dumps) is encrypted
•Strong isolation between container instances
•High assurance isolation
Figure A-2 Secure Service Container protection
The process that is used to deploy an appliance includes the following steps (see Figure A-3):
1. Purchasing the software appliance.
2. Downloading the appliance image.
3. Creating and activating the SSC LPAR.
4. Deploying the appliance by using the appliance installer.
5. Configuring and using the appliance through REST API or a web UI.
Figure A-3 Deployment in five steps
The SSC framework provides following appliance management controls for appliance administrators:
•View messages and events
•Manage network, users, and disks
•View appliance status
•Export and import data
•Apply services and updates
•Support for software license
At the time of this writing, the SSC software framework supports the following components:
•FCP and ECKD storage
•Dynamic Partition Manager
•User management within appliance with LDAP
•Enhanced network and storage management user interface (UI)
•File system with embedded CRC checking
•Include KVM, qemu, and virsh packages
•Embedded OS upgrades
•Support smart card machine unique key handling
1 Secure Service Container is the infrastructure required to deploy appliances (framework) in a secure container on supported IBM Z hardware. With IBM United States Software Announcement 218-152, dated October 2, 2018, IBM introduces IBM Secure Service Container for IBM Cloud Private. IBM Cloud™ Private is a Platform as a Service (PaaS) environment for developing and managing containerized applications.
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.