New IBM Z Mainframe Designed to “Pervasively Encrypt” Enterprise Data

New IBM Z14 Mainframe Introduces Encryption Engine Capable of Running More Than 12 Billion Encrypted Transactions Per Day

The combination of an explosion in data breaches and increasingly severe regulatory requirements requires a new approach to security: the mainframe is back. IBM has announced its latest mainframe, the IBM z14, in what it calls “the most significant re-positioning of mainframe technology in more than a decade.”

Encryption is seen as the best solution for both data loss and regulatory compliance. But encryption is hard, requiring more time and processing power than most companies have at their disposal. At the same time, it is becoming an increasingly attractive solution. More than nine billion data records have been lost or stolen since 2013; and only 4% were encrypted. Next year, the General Data Protection Regulation (GDPR) could, in theory, impose fines of up to 4% of global turnover for the loss of unencrypted personal data.

A second regulation requiring widespread encryption is the NYSDFS cyber security regulation. This states, “As part of its cybersecurity program, based on its Risk Assessment, each Covered Entity shall implement controls, including encryption, to protect Nonpublic Information held or transmitted by the Covered Entity both in transit over external networks and at rest.” ‘Nonpublic Information’ could almost be interpreted as ‘everything’. The automatic facility to encrypt everything in transit and at rest — as does the IBM Z — will make its capabilities particularly attractive to banks and financial institutions that are governed by the New York State Department of Financial Services.

Encryption, where possible, is the one single solution that can solve both data loss (if it’s encrypted, it’s not lost) and compliance. IBM discussed the problem with 150 of its clients over three years and came up with its solution: a new mainframe with sufficient power and versatility to provide pervasive encryption.

IBM Z, says the firm, makes it possible, for the first time, for organizations to pervasively encrypt data associated with an entire application, cloud service or database in flight or at rest with one click. “The standard practice today,” it says, “is to encrypt small chunks of data at a time, and invest significant labor to select and manage individual fields.” But this approach doesn’t scale, so encryption is often incomplete and/or inaccurate.

Encryption is only a solution, of course, if the decryption keys are kept safe. IBM Z offers what the company calls ‘tamper-responding encryption keys’. Keys are invalidated at any sign of intrusion, and can be restored in safety. This key management system is designed to meet Federal Information Processing Standards (FIPS) Level 4 standards, and can be extended beyond the mainframe to other devices such as storage systems and servers in the cloud.

IBM’s solution has been to introduce more power into a new mainframe: a massive 7x increase in cryptographic performance over the previous generation z13 — driven by a 4x increase in silicon dedicated to cryptographic algorithms. “This is 18x faster than compared x86 systems (that today only focus on limited slices of data),” it claims, “and at just five percent of the cost of compared x86-based solutions.”

These aren’t the only large numbers associated with the new mainframe — IBM claims it features the world’s fastest microprocessor running at 5.2GHz. A single system can support more than 12 billion encrypted transactions per day; supports the world’s largest MongoDB instance with 2.5x faster NodeJS performance than compared x86-based platforms; two million Docker Containers; and 1000 concurrent NoSQL databases.

Few companies will want to pay mainframe prices for compliance alone. However, IBM is also previewing new Z/OS software that aids with private cloud service delivery, enabling owners to transition from an IT cost center to a value-generating service provider. 

It is also being incorporated into the IBM Cloud, where it will initially be used as an encryption engine for cloud services, and to run IBM blockchain services in six new centers in Dallas, London, Frankfurt, Sao Paulo, Tokyo and Toronto.

“The powerful combination of IBM Z encryption and secure containers differentiates IBM Blockchain services on the cloud by supporting the trust models new blockchain networks require,” said Marie Wieck, general manager, IBM Blockchain. “Enterprise clients also benefit from the ease of use making management transparent to the application and the user.”