IBM Power Encryption

Client Presentation
Agenda

Topics/Sections

Relevant trends: cybersecurity breaches, regulatory environment

t
Data protection “pyramid”: encryption and key management
management at different layers
Data-at-Rest
• Threatsbuilt-in encryption capabilities
addressed
Data-at-Rest key management
Platform Key Store (PKS)
Data-at-Rest Platform Cryptography

Data-at-Rest Key Management

Data-at-Rest Cyber Resiliency

Data-in-Transit Encryption

Application Encryption

Performance
Data is under threat..
egulatory compliance and associated financial liabilities are
driving the need for enterprise data protection Risk to Economy

NIS2: CEOs or legal

representatives can be
suspended

DORA: Act allows for criminal

penalties to be imposed on
management
Fines up to

2%
of global Third Party Risk Management
turnover

New standard for best practice

4
 The cost of Data Breaches continues Extensive use of AI and automation, and
increasing, having reached an all-time high in an IR strategy reduce significantly the
2023 impact of data breaches

Organizations with extensive use of security AI and

automation had an average cost of a data breach at USD 3.60M
USD 4.45M 25% 23
million, which was USD 1.76 million less and a 39.3%
Average total cost Share of malicious Days to recover
of a breach, 15.3% attacks that data after a difference compared to no use
increase since rendered systems ransomware attack
2020 inoperable

57% 277 1 in 3
Data breaches led Days to identify Number of
to an increase in (204) and contain breaches identified
prices (73) a data breach by an organization’s
own security teams
or tools

measured in USD millions

Source: Cost of a Data Breach 2023 report and IBM

© 2023 IBM Corporation 5

What will a cybercriminal be able to do?

1. Harvest 2. Harvest 3. Harvest Public

encrypted encrypted Keys/Certificates
communications keys

“Q-Day”
Extract Private Key BEFORE
availability of “cryptographically relevant”
Quantum Computer from Public key AFTER

DECRYPT DISRUPT MANIPULATE

➢ Decrypt lost or harvested comms ➢ Create fraudulent firmware updates ➢ Fraudulently change historical digitally
➢ Decrypt current comms, data & backups ➢ Modify vulnerability scanner patterns signed contracts
➢ Undo privacy in blockchains ➢ Issue fraudulent blockchain transactions ➢ Create fraudulent new contracts
➢ Fraudulent access to systems ➢ Modify signed digital evidence
➢ Create fraudulent digital evidence 6
IBM Consulting / © 2023 IBM Corporation
Secure the enterprise from cyberthreats and maintain
regulatory compliance

Protect critical data across Predict, prevent, and respond Business Resiliency
the hybrid cloud to modern threats

Outcomes: Outcomes: Outcomes:

•Reduce cost and legal risk related to • Identify risk before hackers do •Prevent malicious activities during a
evolving regulations • Protect endpoints from known cyber attack
•Discover where critical data resides and and unknown threats •Detect, contain damage during/after
control access for the right reason • Detect advanced threats the attack
•Mitigate data misuse by insiders efficiently •Full recovery of business operations
• Respond to security incidents with in a matter of a few hours rather than
speed weeks and even months

SKO1 / Copyright © 2024 IBM 7

Secure the enterprise from
cyberthreats and maintain Examples of stolen data types:
regulatory compliance • Encrypted data lost during a data breach

• Data communications over TLS that

have been harvested

Snapshots of encrypted cloud data

Data is being •

stolen today • Media that is not encrypted with

quantum-safe encryption methods
with the intent and is improperly disposed or lost
of exposing it • Encryption systems using blackened
tomorrow (wrapped) encryption keys that are public

Data must be protected with strong encryption

algorithms with AES using 256-bit keys or the NIST
Quantum Safe algorithms to be considered Quantum-
safe
8
Data requirements
for encryption and Files Folders Databases Storage Big data

key management
across all platforms
is complex

HYBRID MULTI-CLOUD INFRASTRUCTURE

On-premises
Private Cloud
There are challenges with data encryption and key management

Data is hosted in heterogeneous platforms

across on-premises and hybrid multi-cloud environments

Compliance Lack of talent Policy management Control and Visibility across

and skills for encryption management of heterogeneous
encryption keys platforms
Data-at-Rest Encrypted Platform
 An Encrypted Data Protection Platform is a requirement
End to end security with full stack encryption, in transit, at rest, in memory

Power10 transparent Power10: Blazing fast

memory encryption: hardware-accelerated
• No additional encryption
Application &
Database Encryption management setup • 4X crypto engines
(e.g., Oracle TDE,
DB2, SAP HANA) in every core vs. Power9
• No performance impact
• 2.5X faster AES crypto
performance per core*
File System Encryption
(e.g., AIX EFS) • Accelerated Live Partition
Complexity

Mobility (LPM) Encryption

Full disk / virtual disk
(AIX LV encryption,
IBM i ASP encryption, Linux LUKS) Power10: stay ahead of current and future threats
with support for
• Quantum-safe cryptography
Main memory
encryption
Storage System Encryption
All data at rest in storage
• Fully homomorphic encryption
All data in CPU
(e.g., Flash Systems, DS8K,
memory
tape) • Support for next generation Crypto Express Card

*AES-256 in both GCM and XTS modes runs about 2.5 times faster per core
Coverage than comparable Power9 systems according to preliminary measurements
obtained on RHEL Linux 8.4 and the OpenSSL1.1.1g library
IBM Power / January 2024 / Power Security
 Data-at-Rest Encryption for Different Stack Layers
What data should be encrypted and where; how are keys managed

Enterprise Key Management Server

IBM SKLM
Application & Integration IBM GKLM
Database Encryption Current Capability – for AIX
(e.g., Oracle TDE, KMIP
DB2, SAP HANA)
Integration IBM Cloud
PKS i/f KMIP client (Key Protect)) Hyperprotect
LPAR (IBM i) LPAR (Linux) LPAR (AIX) Crypto Services
File System Encryption KP API (IBM Z based)
(e.g., AIX EFS) Disk Encr. LUKS Hypercalls LV Encryption FIPS 140-2 Level 4
Complexity

Full disk / virtual disk

(AIX LV encryption, PowerVM
IBM i ASP encryption, Linux LUKS)

Platform Key Store (PKS)

Main memory Storage System Encryption Space expanded in Power10
encryption All data at rest in storage
All data in CPU (e.g., Flash Systems, DS8K, Encrypted LV
memory tape)
Power Data Center

Coverage
Threat Model Overview: What Layer of Data Encryption is applicable to my Environment?

• Encryption at the storage level: protects

Application & Database
Encryption against physical attacks
(e.g., Oracle TDE, DB2, SAP HANA)
• e.g., removal of drive from storage array
• Encryption at the OS level
File System Encryption
(AIX EFS)
• Protects from storage administrators
• Encryption at the application
• Under some conditions protects from OS
Full disk / virtual disk
(AIX LV encryption,
administrators
IBM i ASP encryption, Linux LUKS)

Storage System Encryption

All data at rest in storage
(Flash Systems, DS8K, tape)
Reduce the risk of Ransomware
Embedded processor circuitry for increased isolation of CPU from
Enhanced security by separating CPU service processors
Limits access of BMC/FSP to only necessary resources
and Service Processor Trust Domains Further reduces threat vector even if BMC/FSP is compromised

The importance of Service Processor Security

Additional features to strengthen
integrity of BMC complex
BMC/OpenBMC secure boot for
scale-out and mid-range systems

https://www.blackhat.com/us-18/briefings/schedule/index.html#the-unbearable-lightness-of-bmcs-10035 Simplified diagram of connectivity between the service processor and CPU (from ASPEED)

IBM Power / March 2023 / © 2023 IBM Corporation

Data at Rest Power10 Inherent
Platform Cryptography Capabilities
Power10 Cryptography Algorithm Acceleration

P9 P10
AES AES AES AES AES
engine engine engine engine engine
+ + + + +
SHA SHA SHA SHA SHA
engine engine engine engine engine

Power10 Processor provides 4x AES and SHA2 encryption engines compared to P9

• Directly improves performance of crypto libraries like openssl, nettle etc. used by various server
applications (e.g. TLS, IPsec)
• Improved encryption performance will allow for full disk encryption solutions at a tolerable
performance overhead (protect data at rest)
• AIX LV encryption,
• IBM i ASP encryption,
• Linux LUKS
Live Partition Mobility

• Partitions are encrypted

if/when they need to be
migrated from one
system to another
LPAR1

• Protects the data

in motion
Data-at-Rest Key Management
Why security teams consider
cloud key management solutions
• Auditors and compliance • I don’t have the time
teams won’t approve a move and resources to learn
to the cloud if I cannot prove key management of
key custodianship multiple clouds

• My CSPs native policy for key • I never ever want to lose

rotation is 6-12 months but my key again!
my internal policy is 90 days.
• I want to be able to kill my
• I want to suspend my keys with 100% assurance
cloud now and then when I kill my cloud account
resume later on
• How do I protect cloud data
and take back control from
cloud service providers
Data-at-Rest Encrypted Key Management is essential
Cloud based key management service (KMS) for seamless and affordable data-at-rest
encryption of sensitive and operational workloads, with complete client control

Managed Security Service available as

• Multitenant on IBM Cloud – Public (all MZRs)
• Single Tenant on IBM Cloud Satellite locations (BYOHSM)

Centralized BYOK KMS (Bring Your Own Key)

FIPS 140-2 Level 3 Hardware Security Module (HSM) Key-Vaulting for

protection of keys

Configurable control of user access requests (via IBM Cloud IAM) to

Generate, Rotate, Enable, Disable, Restore and Manage keys

Seamless integration with IBM Cloud Service for databases, storage,

VMWare, containers, Power Virtual Server, COS for encryption of
provider and customer data

Key Industries Why Key Protect

▪ Finance - Banks, ▪ Healthcare ✓ End-to-end encryption for all data for maximum security
Cooperatives, Credit ▪ Infrastructure and Retail ✓ Reduced operational cost with simplified Key Management
Unions ▪ FinTechs ✓ Data security governance with IAM based access control
▪ Energy ▪ Education ✓ Operational visibility into the performance and health of your
▪ Technology applications, services, and platforms
IBM Key Protect on Cloud Cloud key-management capabilities IBM Key Protect

Customer key lifecycle management ●

As-a-Service, integrated with cloud services ●
Industry-leading encryption key Client can bring their keys from on-premises
●
Hardware Security Module (HSM)
management, BYOK, gives clients
Operational assurance –
control of their data. provider will not access keys ●
Operational assurance is enforced. Dual Authorization Policy for key deletion ●

Compliant with industry standards for SOC2, GDPR,

Automatic key rotation ●
PCI-DSS, HIPAA, ISO 27K, and regional regulations Multi-tenant, cost efficient
like C5 (Germany) and ISMAP (Japan) key-management system ●
Multi-tenant isolation is enforced through
cryptography ●
High-level security –
FIPS 140-2 Level 3 HSM ●
Customer can view IBM Cloud resources
associated with each encrypted key ●
Key deletion is protected by default if a
resource is associated with a key ●
22
Data-at Rest Cyber Resiliency
 IBM Power Integrated with IBM Storage Response and
Backup and
Learning and
Restore
for Cyber-Resilient Recovery and Encryption Recovery
Procedures
evolving

• Data-at-Rest encryption AES 256

• Security PINS are sent to the drive in encrypted form over PCI bus with secure key passing (SKP)
• Flash Core Module: FCM 4
• FIPS 140-3-Level 2 in process
• RSA and CRYSTALS Kyber Quantum Safe Algorithms
• SKP is encrypted twice, once by each cypher Validation

24
Copy Services Manager
(CSM) Restore Forensic
Recovery
Production Volumes Analysis
volumes
Surgical
Backup Capacity Recovery
Capture Safeguarded backup 0 Recover
Catastrophic
Safeguarded backup 1 Recovery
Production … Production Offline
Software Safeguarded backup n Software Backups
(up 500 per volume)
Stack Stack
IBM DS8000 provides Safeguarded Copy

IBM DS8000 with Safeguarded Copy CSM manages the creation, recovery, IBM Power Systems hardware and
provides immutable, consistent point- and restoration of the copies and software provides a secure, isolated
in-time copies of data. provides automation to manage those environment to perform data validation,
processes. forensic analysis, and create offline
backups.
 IBM Storage
Storage for Data Resilience Storage for Data and AI Storage for Hybrid Cloud

Reduce the threat exposure from Accelerate business results and Drive innovation and scale
days to hours and proactively innovation and unlock the latent application modernisation with
safeguard data with a multi- value of unstructured data across the enterprise storage that deploys
faceted and scalable data data ecosystem by eliminating data seamlessly across hybrid
resiliency approach that defends silos, advancing data discovery and infrastructures including cloud native
an organization’s data. classification. architectures on prem.
Protect, detect, recover fast. IBM storage is the on prem solution IBM cloud already deploys Ceph
for watsonx.

IBM Storage Software IBM Storage Virtualize IBM Storage Scale

IBM Storage Defender IBM Storage Ceph

IBM Storage Protect IBM Fusion

IBM Storage Systems IBM FlashSystem IBM Storage Scale System (SSS)

IBM DS8900 | TS7700 IBM Fusion HCI System

IBM Storage Ready Nodes (Ceph), (Defender – Data Protect)

IBM SAN Networking and Tape

Storage System IBM Storage FlashSystem Family
Encryption - Configuring FlashSystem encryption: link

IBM DS 8000 Family

- Securing Data: link

Redbook: IBM DS8000 Encryption for Data at Rest,

Transparent Cloud Tiering, and Endpoint Security
(DS8000 Release 9.2). Describes two modes of key
management:
- With external key servers (external encryption)
- Without external key servers (local encryption)
26
Data-in-Transit Encryption
Hardware security protection for
sensitive data with NextGen IBM
Crypto Express Card (4769)

• Hardware Security Module (HSM) for

highest security, especially where
tamper protection is required
• Complementary to Power10 Core
Cryptographic acceleration Next generation card, 4769
• Validated to U.S. NIST FIPS 140-2/3 • Available on IBM Power10® servers, either
Standards Overall Security Level 4 on AIX®, IBM i®, or PowerLinux and IBM
Power9® servers, either on AIX or IBM i

Power Systems / July 2022 / © 2022 IBM Corporation

Operating System Encryption
Spectrum of AIX Data-At-Reset Encryption

Encryption Solutions
OS Storage I/O Stack Coverage/
Granularity

Applications
30
E.g. Oracle/DB2 database encryption
© IBM Corporation

Encryption granularity
EFS: Encrypted File System (2007)

Application coverage
Write
Read

• Encryption controlled at file level

• Inheritance allows encryption enforced at file system level
File system • Per user encryption key protection, complicating
system admin tasks.

LVE: Logical Volume Encryption (2020)

Disk Partition
• Multiple wrapping key protection: PKS, key server, +HPCS
Manager
• In-place on-line conversion
• Power in-core crypto acceleration

Storage Device Physical Volume/disk Encryption (ongoing)

Driver • Oracle/RAC workload (bypassing LVM)
• Oracle uses BSAFE without crypto acceleration on Power
AIX Data-In-Flight TLS/C: OpenSSL (with FIPS certification)
Encryption Options
- OpenSSL crypto library optimized with Power in-core acceleration as
default

TLS/Java: Java SDK with ICC crypto lib (going through FIPS
certification)
- OpenSSL based with exploitation of Power in-core crypto facility

IPsec employs CLiC crypto library

- Processor crypto engines (on-chip or in-core) have limited impact on
performance
- Requires NIC adapter IPsec offload to deliver substantial performance
boost
31
IBM i Encryption

End-user data encryption APIs

• Integrated - Cryptographic Services APIs and CCA
• Other – JCE and OpenSSL
Network encryption APIs and configuration
• System TLS
• IPSec VPN/IKEv2
Data at Rest
• External Storage
• Encrypted Auxiliary Storage Pool (ASP)
• Self-Encrypting Drive (SED) NVMe
• ISV encrypted file system
IBM i Integrated End-User Encryption Interfaces
Algorithm i 7.2 i 7.3 i 7.4 i 7.5
DES X X X X
Triple DES X X X X Cryptographic Services APIs (IBM i unique)
AES X X X X
• IBM i operating system program and service
RC2 X X X X
programs
RC4 X X X X
• Primarily implemented using CLiC
RSA X X X X
MD5 X X X X
• Encryption and Decryption APIs
SHA-1 X X X X • Authentication APIs
SHA-2 X X X X • Key Generation APIs
ECDH and X X X X • Key Management APIs (local)
ECDSA • Pseudorandom Number Generation APIs
X25519
• Cryptographic Context APIs
X448
• Used by 99% of Customer/ISV applications
Chacha20
Poly1305
• DB Field Procedures
SHA-3 P P P
PBKDF-2
Application-level encryption: consideration of key
applications/ISVs
 Common workloads that will require encryption

RedHat OpenShift and IBM Cloud Paks for Data Management

IBM Cloud Paks • Data
Popular data solutions
• Security
Streamline digital business • Integration including open-source favorites
development and resiliency • Watson AIOps Power provides industry-
• Business Automation
Power helps accelerate the path leading performance, security,
• Network Automation
toward digital transformation flexibility, and resiliency

SAP HANA Artificial Intelligence

In-memory database supporting AI is transforming businesses in
SAP’s ERP and business apps ways previously unimagined
Provision faster, scale affordably, Accelerated in-chip inferencing
and maximize uptime with Power with the Power10 processor

Oracle Database ISVs

Relational database system Wide variety of enterprise
for transactions and analytics applications and ISV solutions
Lower total cost of ownership Power provides industry-
(TCO) with Power leading performance, security,
flexibility, and resiliency 35
AIX Workloads

IBM® AIX® 7.3 with Each physical volume Power servers and On AIX, clients can Clients can use
Technology Level 1, is encrypted by using AIX create a solid run Oracle workloads, Power10 memory
you can encrypt the a unique key, that is foundation for the middleware, hardware encryption
physical volumes that known as a data modernization of application servers for protecting Oracle
uses the encryption key. The traditional Oracle and countless workloads, and
small computer data encryption key Database workloads, industry applications benefit from 2.5
systems is required for new application on the same times improved
Interconnect® (SCSI) encrypting and developments and platform—all without performance per core
protocol. Data that is decrypting all data workload unwanted downtime. compared to older
written to the physical that is stored in the consolidation. versions of servers
volume is encrypted physical volume.
and data that is read encryption key. The
from the physical user key can be a
volume is decrypted typed passphrase, or
during an I/O it can be stored in a
operation. platform keystore
(PKS) or in a network
key manager. 36
Workload Encryption Considerations: Oracle Transparent Data Encryption

• Oracle Transparent Data Encryption: link

TDE Column Encryption Overview TDE Tablespace Encryption

Oracle Transparent Oracle Database provides a key management framework for
Data Encryption: Transparent Data Encryption that stores and manages keys and
Key Management credentials.
Options

The key management framework includes the keystore to

securely store the TDE master encryption keys and the
Keystore for the
Storage of TDE management framework to securely and efficiently manage
Master Encryption keystore and key operations for various database components.
Keys [link]

The Oracle keystore stores a history of retired TDE master

encryption keys, which enables you to change them and still be
able to decrypt data that was encrypted under an earlier TDE
master encryption key.

38
Workload Encryption Considerations: DB2

• Db2 Native Encryption: link

• Database encryption using AIX encrypted file system (EFS): link

39
How to ensure we bring the proper level of Security for SAP workloads?
Consider the IBM SAP security framework…
The 13 layers of SAP security is a stratified approach that decompose security aspects in different layers,
following a top-down approach that moves from Regulatory and Compliance to the most technical
aspects of security hardening for SAP ensuring full coverage of our client’s needs

1. Governance & Regulatory Risk Assessment and Quantification

2. Access Management Cybersecurity Assessments

Compliance
3. Data Privacy

13layers of
SAP Application Layer Data Privacy / Protection Discovery

4. Continuous Control Monitoring Security monitoring automation

5. Authentication Infrastructure and SAP continuous authentication and MFA

SAP Security 6. Secure Source Code / DevSecOps Infrastructure and SAP DevSecOps

7. Secure Configuration / Baseline Security hardening and health checks

8. SAP HANA Security Application endpoint security, SAP security controls

Technical
applied to IBM Security 9. Data Protection / Encryption End-to-End Data Privacy, Encryption & Key Management

Power 10. Interface Security Network and Interface Security

11. Vulnerability &Threat Management Infrastructure and SAP Threat and Vulnerability Management

deployments 12. SAP Cloud / SAP BTP

On Prem, IaaS Cloud, RISE with SAP infrastructure deployment
13. Infrastructure Security options
40
`
Performance: Power10 Cryptography Algorithm Acceleration – SAP HANA Workloads

Power10 Processor provides 4x AES and SHA2 encryption engines compared to P9

• Directly improves performance of crypto libraries used by various server applications (e.g. TLS, IPsec)
• Improved encryption performance allows for full disk encryption solutions at a negligible performance
overhead (protect data at rest)
• Linux LUKS – see SAP blog AIX LV encryption, IBM i ASP encryption
Support for emerging cryptographic paradigms
 When would the Quantum threat materialize?

When is Q-Day? Quantum Computing Status and Roadmap The good news
2022 ✓ 2023 ✓ 2024 2025 2026+
1
Bring dynamic Enhancing
"The National Institute of Standards Improve Scale Increase

and Technology predicts it may be

circuits to
Qiskit
applications
with elastic
accuracy of
Qiskit
Quantum
applications
accuracy of
speed of Quantum safe
possible to break 2048-bit RSA by Runtime to
unlock more
computing
and
Runtime with with circuit quantum cryptography exists
2030
scalable knitting workflows &
computation parallelization error toolbox integration of and gets standardized
of Qiskit mitigation error
- NIST report on Post Quantum Cryptography Runtime correction

Model
Prototype quantum software applications
2
Developers
Governments issue
Quantum software applications

Algorithm ✓
Quantum algorithm &
Quantum Serverless
advisories and
Developers
directives
application modules Intelligent orchestration Circuit Knitting Libraries

“There is a 1 in 7 chance that some Kernel Qiskit Runtime ✓

fundamental public-key crypto will be Developers Dynamic circuits ✓ Threated primitives Error suppression and mitigation
broken by quantum by 2026, and a 1 3
in 2 chance of the same by 2031”
System
Osprey Condor Flamingo Kookaburra Scaling to Awareness of the
433 1121 433 qubits 433 10K-100K
- Dr. Michele Mosca, Institute of Quantum
Modularity qubits qubits qubits qubits extent and urgency
Computing, is growing
University of Waterloo 13,426* physical Qubits Required
to break RSA 2048
Elliptic Curve Cryptography (ECC) requires fewer … and first quantum-safe systems are already available!
logical Qubits – likely to be at risk earlier

43
(*) arxiv.org/pdf/2103.06159.pdf
IBM Consulting / © 2023 IBM Corporation
 Strategy development in action
IBM Quantum Safe Transformation Phase-1

1 Q-Safe Heatmap & Strategy

2 Discovery, Scanning & Inventory

Understand how and what to incorporate in Quantum Safe strategy development
3 MVP & Sandbox Testing

4 Insight Driven Prioritization & COE Setup

Collect key items with relevant cryptography

The world doesn’t

stand still, and
neither should your
Quantum Safe Quantum Safe Fields of Action
Definition of evaluation criteria
and respective score/weight
transformation and preliminary roadmap
Adjustment of QS
strategy – it should Strategy, Goals and Value
Realization Framework
learn and adapt to
changing landscape
on continuous basis

Contextual grouping and Ranking of selected items and

Quantum Safe solution heat map
approach 44

IBM Consulting / © 2023 IBM Corporation

Next Steps?

Whether you are just starting out on your Quantum Safe journey, wrestling with a
specific cryptography challenge, or looking to scale crypto-agility with innovation, IBM
will propel your time to value.
1 2 3 4

Schedule a Q-Safe Heatmap, opportunities & Discovery Cryptography Cryptography Strategy

Framing Workshop pain points across the organization (Maturity Assessment)

Initiate and discuss your journey Describe Quantum Safe problem Scan application source code for Achieve a unified vision of success
with IBM Quantum Risk Framing definition and framework cryptographic artifacts. and have clear path to realization.
Workshop – Interactive, Garage conditions.
workshop hosted by IBM’s Establish a “Cryptography Bill of Review existing cryptography policies,
cryptography experts. Review your organization’s Material”(CBOM) for scanned processes and procedures
business dependencies, 3rd applications.
IBM’s PoV covering quantum party technologies, critical Review operating model supporting
threats, quantum-safe crypto applications, networks, Create a cryptographic inventory data-at-rest encryption, key
and cryptographic agility. platforms, crypto tools, etc. including a set of existing management, PKI, certificate lifecycle
metadata sources (e.g., management, application encryption,
Understanding of Quantum Identification of the most vulnerability scanner or data
Risks you might be exposed to. important Quantum Safe fields classification systems). Assess long-term IT strategy and how
of action and suitable solution crypto governance is embedded
Discussion aligned to your approaches. Provide dashboard view of
mid/long-term IT strategy captured cryptography. Visualize your organizational
considering Cloud Migration & cryptography maturity
Application Modernization
 Fully Homomorphic Encryption: IBM HELayers FHE SDK Stack Architectural View
Power Applicability and Optimizations

Layers Features

Text Classification / Image Classification / Logistic Regression / Credit Card

Use Cases
Fraud Detection
Deployment Models
HE4Cloud
Neural Net and ML Components:
AI Innovation FC / SGD / CONV / Dropout / Decision Trees / …

A
Linear Algebra, Packing, Functions:
Computation P
TileMatrix / TileTensor / CKKS Bootstrapping
I

Wrappers HeWrapper / CipherWrapper / PlaintextWrapper

Validation of FHE libraries and

SDKs such as HElayers on HELib (+ PALISADE:
Power Systems
SEAL: ZAMA:
Libraries Toolkit): CKKS / BGV /
CKKS / BFV TFHE
CKKS / BGV BFV / TFHE

Validation / Optimization of NTL

NTL library (Number Theory)
on Power9 and Power10 HW
Coprocessor, Specialised instructions, vector dimension, cache sizes
Status Summary: FHE on Power

• Fully Homomorphic Encryption (FHE) is still the subject of active Research

• The benefits of FHE come with significant overhead
- FHE algorithms are many orders of magnitude slower than traditional cryptography
- Introducing FHE in enterprise applications requires application software and/or process flow changes
• IBM Research has been a leader in this space for many years, focusing on:
- Reducing performance overhead through improvements to cryptographic algorithm implementation
- Developing SDKs to simplify experimentation with and development of applications using FHE
• Power has been working closely with IBM Research on both focus areas
- Optimization of base FHE cryptographic libraries on Power9 and Power10 hardware
- Porting and validation of emerging FHE SDKs on Power
• Power customers interested in FHE should contact their representatives to explore potential PoCs
with IBM Research and Power in their application domain(s) of interest
47
Tape encryption

Encryption of tape data sets

“IBM intends to enhance pervasive encryption to perform encryption within the

access methods for tape data sets. It is expected to be transparent to the
application program unless it uses EXCP. This new data set encryption support is
intended to be independent of any encryption that occurs in the tape subsystem. ”1

48