The IBM Z Deep Dive Series is a monthly, practitioner-focused technical webinar series designed to help professionals deepen their expertise in IBM Z technologies. Each session focuses on a specific technology topic and brings together subject matter experts through engaging and interactive discussions.
I recently attended the LinuxONE and Digital Assets Dive Session in replay, and wanted to share my key takeaways, insights, and how I plan to apply what I learned.
Why I Joined This Session
The topics covered in the 3rd Deep Dive Session, “LinuxONE + Digital Assets,” are highly relevant to our business unit. Combined with issues such as security, encryption, and sovereignty, they are playing an increasingly important role for our customers and are indispensable to the further development of our products.
As a Development Manager at an ISV with many major clients in the banking and insurance sectors, automotive manufacturers, municipal data centers, and more, I must constantly monitor the latest developments in the market. I always strive not just to follow trends, but rather to stay ahead of them from the very beginning. Only in this way can we offer our customers products and services that are on par with the latest market developments.
Key Highlights
Highlight #1: Keynote
The central theme of this keynote was data sovereignty—that is, the question of how to ensure operational control, transparency, supply chain assurance, and the necessary technological independence in the face of constantly evolving systems and the growing threat to data security.
Linux One, with its long track record of running sensitive, business-critical workloads worldwide and its robust security and privacy capabilities, can make a significant contribution here.
Merve and Marianne then demonstrated HOW:
Customer Owned Infrastructure
The devices belong to the customers and are in their data center, and are therefore under their direct physical control.
Confidential Computing
Through hardware-based isolation, the system ensures that no external entities can access the data without authorization.
Customer-Managed Encryption Keys
The customer owns the keys. Without them, no data in the system can be decrypted.
Architecture Designed for Sensitive Workloads
An architecture developed and tested based on the requirements of major customers in the financial, government, and public sectors.
During the keynote, the most important capabilities of the LinuxONE system regarding security and sovereignty were discussed in detail once again:
Integrated crypto hardware
• CPACF processor extension for symmetric bulk encryption
• Additional Crypto Express cards for accelerated cryptographic computations and the storage of keys directly in the hardware
Support for quantum-safe cryptography in accordance with NIST standards
Confidential Computing with Secure Executing
Workloads running as guests cannot be accessed or modified by other guests—or from outside—using hardware- or firmware-based methods. Not even by administrators.
Isolation and Virtualisation
Isolating virtual systems and their workloads to the highest EAL5+ level without losing the ability to effectively share installed resources.
The points briefly outlined here represent a complex set of measures that, taken together, ensure the security and sovereignty of the data and the system.
It is important to note that all of this can also offer economic advantages over x86-based solutions:
• Save up to 65% in power
• Save up to 44% on TCO over 5 years
• Save up to 94% in the software costs over 5 years
Hint: In Lesson 6— “What LinuxONE Can Do That x86 Can't”—detailed comparisons were presented once again, and further details were discussed.
Highlight #2: Secure Executions for Linux
“Confidential Computing”—how can I securely protect data even at runtime, so that concurrently running guests, the operating system, privileged routines, and even administrators cannot access it without authorization?
One answer to this question is provided by Secure Execution, which protects “data in use” and enables chains of trust ranging from software artifacts to servers to hardware.
The foundation of this IBM technology is a specialized piece of software embedded in the firmware called “Ultravisor”. It manages and protects all workloads running on the machine from unauthorized access and operates above the hypervisor. Only the Ultravisor has access to the root of trust (certified by IBM and DigiCert (CA)), which is a private host key hidden in the hard drive and firmware. All images are stored exclusively in encrypted form, and their keys are protected by this very host key. Requests from guest systems to the hypervisor must be forwarded by the hypervisor to the Ultravisor. When the hypervisor wants to page out a memory page, it must request that guest page from the Ultravisor, and the Ultravisor will encrypt the page. It will verify the page, and then the hypervisor can access it.
This is just one aspect of a series of measures designed to implement “confidential computing.” Encrypted boot images and a sophisticated attestation system are others. Starting with the Z16, the Z architecture offers additional mechanisms that are used here: remote attestation—after attesting a secure client, the system deploys the secret to the attested guest. Starting with the Z17, another, even more secure option becomes available: Here, the system deploys secrets as retrievable secrets via add-secret requests. This secret can then be used, for example, to encrypt a disk.
This presentation was extremely technical and detailed, so only the most essential points could be covered here. I therefore highly recommend that anyone interested watch the full presentation themselves.
Highlight #3: Hardware based Encryption Facilities on IBM LinuxONE
As the availability of quantum computers—known as “Q-Day”—draws nearer, the time is fast approaching when algorithms that are still considered secure today can be easily broken. This affects not only current data but also legacy data sets, which cybercriminals are already collecting with this very intent.
This threat can be countered using hardware and software from the IBM LinuxONE system.
With EAL5+ level isolation, the system offers the highest level of workload isolation available, thereby preventing unauthorized access to data by neighboring guest systems—and even by the hypervisor or highly privileged administrators.
Dedicated Crypto Express cards serve as Hardware Security Modules (HSMs), enabling the secure storage and management of secret keys directly in the hardware and additionally accelerating cryptographic processes. Measures against physical attacks on the hardware (opening, X-ray, etc.) increase resistance to attacks.
The CPACF extension, implemented directly on the processors, enables high throughput for bulk operations such as synchronous encryption.
On the software side, a wide range of hardware-accelerated and quantum-secure encryption algorithms, such as ML-KEM and ML-DAS, are available.
Technical Deep Dive
The many interesting details—whether related to hardware or software—that were presented in the seven sessions make it hard for me to choose my favorites.
What LinuxONE can do that x86 can't
Compared to others, this was a presentation that wasn't all that technical, but I still really enjoyed it. The topic was “Why IBM LinuxONE is Better Than x86 Servers.”
Performance / Speed
• 50% increase in transaction performance for the Z17 compared to the Z16
• Using a single integrated accelerator for AI on the IBM LinuxONE Emperor 5 matches the throughput of a remote x86 server with 13 cores.
• Additional acceleration through optional IBM Spyre Accelerator Cards with 300+ TOPS per card.
• 40% faster response time thanks to kernel-level hardware optimization of Java garbage collection compared to solutions on x86.
A single LinuxONE machine can, at the base level, represent up to 85 individual machines that exceed the security standards of air gap servers. Whereas on the x86 side, you have a lot of hardware and then you have your hypervisor on top.
Security
by its capabilities for security and encryption the Z17 is the first and only “quantum-safe” server in the industry
· Hardware acceleration for cryptographic functions is built-in (CPACF) and not an optional component
· Encryption throughput is 3x to 9x higher than on x86
· The Hardware Security Module (HSM) is tightly integrated with the CPACF and enables protected keys.
x86 solutions are not as well integrated and do not support data at rest or data in flight.
· Higher tamper safe Protection – FIPS 140-2, Level 4 vs Level 3 on X86 side
· Logical partitions are rated as EAL 5+ isolation vs VMware EAL 4+
· Best support of confidential computing on the market
· Zero reported security breaches – Vmware 794, Oracle 474
Reliability
· IBM LinuxONE servers ship with 2 extra cores designated as spares
· Uses special memory, and this memory can even eliminate the most remote type of failure, called a Redundant Array of Independent Memory, RAIN
· Machines delivered with all cores – different options for activation are available
· Highest availability of Eight 9’s (99.9999999%) – Downtime / year of 315.36ms
(Best X86 Server 4.89)
Energy
Consolidating 126 x86 servers into a single LinuxONE Emperor 5 server reduces the carbon footprint by 91%. This results in significant savings on electricity costs and a reduction in CO2 emissions of 359 metric tons.
What I Plan to Apply
I was able to take away a lot of insights for my day-to-day work from this Deep Dive as well. In particular, topics related to security and encryption are very important across all our products. The new insights gained here will be very useful for us in making our products quantum-secure.
The information from the session on the advantages of IBM LinuxONE over x86 solutions will be very helpful to our colleagues in giving our customers the confidence that they are relying on the best and most modern platform.
Community Experience
At a virtual event, the community experience isn’t the same as at an in-person event with many people in the room where you can network during coffee breaks.
Still, I came away with a very positive impression. The sessions were very well-structured, and questions from others often opened up new perspectives.
I consider this series to be very valuable: we’ve had—and will certainly continue to have—more discussions among colleagues about the presentations featured here.
At the end of the session, I earned my IBM Z Deep Dive badge, which helped recognize the learning experience and technical knowledge gained during the event.
Looking Ahead
I'm looking forward to the next IBM Z Deep Dive session on Transactional AI on Z, scheduled for August 18, 2026, and continuing to learn alongside the IBM Z community.
If you haven't registered yet, I highly encourage you to do so. Whether you attend live or watch the replays, the depth and quality of these sessions make them well worth your time. Register here: https://ibm.biz/ZDeepDive