IBM Secure Service Container
| Industry | Computer security, Cloud computing |
|---|---|
| Founded | 2016 |
| Headquarters | United States |
| Products | Trusted execution environment for IBM Z and IBM LinuxONE |
| Parent | IBM |
IBM Secure Service Container represents the trusted execution environment designed for IBM Z and IBM LinuxONE platforms.
History
IBM unveiled the z Appliance Container Infrastructure ("zACI") in 2016 through a firmware update for IBM z13, z13s, LinuxONE Rockhopper, and LinuxONE Emperor systems. Originally intended to support software "appliances" such as the z/VSE Network Appliance and GDPS Virtual Appliance, IBM broadened zACI’s functionality and renamed it IBM Secure Service Container (SSC) with the debut of IBM z14 and LinuxONE Emperor II models in 2017.
Details
The IBM Secure Service Container combines hardware, firmware, and software components integrated into modern IBM Z and LinuxONE servers. Its hardware and firmware build upon IBM’s PR/SM logical partitioning capabilities, which have achieved Common Criteria Enterprise Assurance Level (EAL) 5+ certification for security separation and isolation. On IBM z14 and Emperor II systems, an SSC logical partition (LPAR) can accommodate up to 16 TiB of memory per LPAR.
IBM offers an open source software framework—IBM Secure Service Container for IBM Cloud Private—alongside firmware features that enable running standard virtual machines and Docker containers on Linux inside SSCs without requiring specific modifications. In essence, SSC functions as a secure "container" providing a trusted execution environment for VMs and containers.
SSC technology underpins numerous public cloud offerings from IBM, including IBM Cloud Hyper Protect Services. Early adopters are often organizations with demanding security requirements, such as Digital Asset Custody Services (DACS), which focuses on digital asset and cryptocurrency management. The majority of users also deploy IBM’s FIPS 140-2 Level 4 certified Crypto Express hardware security modules and Trusted Key Entry (TKE) devices, although these components can be utilized independently on IBM Z and LinuxONE hardware.