Pages

Monday, October 2, 2017

IBM LinuxONE Emperor II ™, IBM’s Newest Mainframe Linux solution

By Bill Moran and Rich Ptak

IBM LinuxONE Emperor II

Introduction

On September 12th, IBM announced the IBM LinuxONE Emperor II™, a new, dedicated Linux mainframe with significant upgrades from its z13-based predecessor, IBM LinuxONE Emperor. IBM positions Emperor II as “the world’s premier Linux system for highly secured data serving, engineered for performance and scale.” IBM chose the LinuxONE Emperor II “to anchor IBM’s Blockchain Platform cloud service.” We discuss features and provide some thoughts on evaluating the system for your own environment.


Performance Features

Emperor II is a z14-based Linux-only mainframe system designed as a highly reliable and scalable platform for secure data-driven workloads. Key performance improvements include:
·         A 2-3 x performance boost over the z13-based Emperor.
·         IBM described 2.6 x performance advantage over comparable x86 systems for Java work, a result of IBM moving some CPU intensive Java operations into hardware.
·         Powerful I/O processing capability with up to 640 cores devoted to I/O operations, a benefit for I/O limited applications.
·         Emperor II can operate at near 100% utilization with very low performance degradation. Typical competing systems can achieve 50% or 60% utilization before experiencing significant performance degradation.
IBM’s LinuxONE Emperor II is an impressive, powerful, high performance system. Do keep in mind that all performance numbers are application/environment dependent. Therefore, if performance is critical, do your own testing. Vendor numbers can only provide broad guidelines to potential performance improvement.


Security Features

IBM LinuxONE Emperor I enjoyed significant market acceptance for a variety of workloads. Recognizing the escalating interests in security and high-volume data computing, IBM initiated a large engineering effort to enhance and extend already legendary mainframe system security. The z14-based Emperor II takes security to a completely new level.
IBM states that the system represents the most advanced level of security commercially available today. We believe there exists some justification for the claim. Here’s why.
·         A major block to large-scale encryption has been the extraordinary time and effort needed for encryption/decryption. IBM dramatically[1] decreased both by using an on-chip cryptographic processor (CPACF). This allows users to implement pervasive, end-to-end encryption of all data throughout (and beyond) the system. If a hacker breaks in anywhere in the chain, they only get access to encrypted data, useless without the ability to decrypt. 
·         Hardware protected decryption keys. A hardware-assist feature assures keys are never available in memory in the clear. There is no way for a user, hacker or even an administrator to unlock or make the keys visible and useable.
·         All data can be automatically encrypted and remain so, at-rest, in-motion and during processing – end-to-end – from system to user.
·         Encryption security is implemented with no application changes. Security solutions that require any changes (applications) or actions by developer/user/programmer have been a stumbling block for encryption (and other) security approaches.
·         Finally, IBM has a new architecture called Secure Service Containers. These containers protect the firmware and the boot process as well as, the data and the software from any unauthorized change. A traditional weakness has been the potential for system admins to exploit their elevated system credentials or for those credentials to be exposed to internal or external threats and then used to gain access to locally running application code and data. With Secure Service Containers, the only access is via the web or an API granted to those specifically with access to this environment. This closes a hole long used by hackers gain access to critical and private data.


Other key features

Emperor II delivers enhanced vertical scalability (scale up) possibilities, i.e. it allows a collection of tightly coupled multiprocessors to communicate at very high speed using shared memory. This architecture provides a distinct advantage for applications doing sequential updates to a relational database over scale-out systems, such as most x86 systems.
A typical example would be a banking application handling customer accounts. To maintain a correct account balance, all debits and deposits must be processed sequentially. That is, in the order they were performed, e.g. earliest date and time first. An account can be “locked” to ensure accuracy, having shared memory minimizes the latency and associated delay that results from such lock management.  Attempting this via a scale-out collection of independent systems can result in a very complicated software environment and may also result in performance problems whereas, IBM’s Emperor II would have neither problem.


IBM Strategy

Enterprise concerns about data security have changed, now having dramatically increased in priority. While previously it was on everyone’s checklist, when the final purchase decision was made price and performance dominated. Now, security is a deciding factor, and IBM is positioning the Emperor II to win.

This signals a broader change in IBM’s messaging strategy. No longer is the focus on “speeds and feed” with its reliance on numbers, processing speed, price/performance, TCO, etc. to motivate a change of platform. IBM intends to drive the decision using a business case focused on platform design (architecture) targeting the solution of major business and operational problems, as IBM LinuxONE Emperor II does.

Of course, much depends upon the platforms being compared. In many cases, inherent mainframe security will be decisive. IBM’s Emperor II with LinuxONE security and its vertical scalability far exceeds anything a standard X86 platform[2] has.

While we applaud this change in strategy, it can complicate the selling task. Since IBM’s target is x86 systems, sales reps may find themselves competing with Window systems as opposed to a Linux x86 systems. A security discussion comparing LinuxONE to other systems will require a more knowledgeable sales force. Features and functions such as security, Blockchain technology, etc. will have to be explicitly linked to specific business requirements, problem resolution, etc.

One final word on security. The heavy emphasis on security also represents a risk as bad guys are likely to focus on exploiting weaknesses in applications or lax security procedures as the easiest point of vulnerability. Consumers, businesses and journalists are notoriously quick to indiscriminately point the blame to technology for failure. A successful penetration via, for example, an app accessing an Oracle database when the platform functioned perfectly – can quickly be blamed on the platform and the app overlooked. IBM effectively and economically addresses a real problem area. But, there exists much more to be done by the entire community.


Summary

IBM has done an excellent job in implementing security in this system. Anyone looking to achieve the highest level of security in a Linux environment should carefully examine the Emperor II system.  If they have not done so already, they also need to establish a security department to create and monitor organization-wide security policies.

It can’t be said that any system is truly impenetrable. This is true for reasons relating to the very real threat of internal compromise (e.g. carelessness, poor compliance practices, etc.), technological innovation as well as the subversive efforts of very, very sophisticated and clever people attempting to crack the system. We can say that we think that IBM has done an admirable job in creatively addressing a significant number and breadth of security vulnerabilities and problems. They have made it easier and economically affordable (in cost AND resource utilization) for enterprises of all sizes to use encryption techniques to secure systems and data.

We anticipate IBM’s LinuxONE Emperor II will appeal to high-end enterprises. They are familiar with mainframes and have the staff to manage them. IBM will have to work harder to win over those with less mainframe familiarity and without experienced staff. However, recent surveys indicate that efforts to modernize mainframe management and development tools along with the availability of JAVA, Linux, etc. are attracting new users to mainframes.  

Finally, the security that the system offers will be a powerful incentive for certain customers and the total package of the architecture and its features create a system that can deliver solutions to many customers that they cannot find anywhere else. Congratulations to IBM, we’ll watch and report on how this all develops.





[1] IBM did not provide performance or overhead numbers.
[2] By “standard” we mean that high end Oracle and HPE systems may have a scale up design that eliminates the problem that many x86 systems will encounter.

No comments:

Post a Comment