In the last year (2023), Garanti BBVA's fintech subsidiary launched Garanti BBVA Digital Assets company. The company aims to provide services such as transfer, custody, and exchange of the major cryptocurrencies such as Bitcoin, Ethereum, and USDC. For implementing this infrastructure we chose IBM LinuxOne III as the platform and in this blog post, we aim to explain why we chose it and which features of LinuxOne helped us during our Journey.
Everyone knows that security is one of the most critical things in the finance area, but when it comes to crypto assets it become far more important than before. A security breach that can happen in your environment can also mean that you lose all of your and your customer’s digital assets in an unrecoverable way. Let’s think of it with an analogy. Imagine, when someone steals the key to the door of your house, all of the official registrations of your house are automatically transferred to them and you will lose it forever. How would you secure the key in that case?
Here IBM LinuxOne provides us with a unique secure way to run the Operating System that deals with the cryptographic operation and an integrated Hardware Security Module (HSM) named "Crypto Express" card. Thanks to IBM Secure Execution for Linux technology which is called “Secure Enclave Hyper Protect Virtual Server”, LinuxOne can restrict even the admin/root access to the Secure Service Container LPARs. Thus, all the HSM-based sign operations can done in this restricted LPAR and return the result via a restricted API. Additionally, since the HSM is physically located inside the LinuxOne box as an I/O device, there is no external network access needed to access a separate HSM device. All operations can be done in the same box in an encrypted and secure way.
One more benefit of using LinuxOne is HiperSocket Communication. Thanks to HiperSocket Between the LPARs on the same LinuxOne you can set up a high-speed network (TCP/IP) communication that relies on system memory instead of using physical network cards and cables. You can connect your application LPARs with Secure Service Container LPARs by using this technology and this technology not only reduces the latency but also provides an additional layer of security since the data never goes out of the LinuxOne box unless you need to access an outside component intentionally.
Additionally, LinuxOne III comes with FIPS 140-2 Level4 certification for HSM security. This is the highest level in the market. In the next model, it is expected IBM to take this to a whole new level with Quantum-Safe encryption technology FIPS 203.
We also would like to mention about Open Source factor. Since you are running Linux, you can exploit lots of the fancy features that come with open-source technologies. These were Openshift and PostgreSQL in our case. By using synchronous DB replication based on PostgreSQL Patroni 3-site cluster we prevented any possibility of data or transaction loss in case of a site or region outage.
And as one last thing, although you are running Linux on LinuxOne, it is just another Z server and you have all other flexibilities that are inherited from Z like Capacity on Demand. At one point in the project, we needed additional CPU capacity, Instead of ordering new physical hardware parts or servers we were able to double the CPU capacity of our LinuxOne servers, just by a firmware activation done by IBM. (It can be a temporary (loan) or permanent activation). For the Disaster Recovery(DR) site, instead of buying equivalent CPU capacity with your Production site, you can have Capacity Backup(CBU) records that allow you to activate the capacity by yourself in case of an outage or DR testing.
Long story short, we believe that it was a good decision for us to go with LinuxOne servers in our Digital Asset projects. While creating a modern application environment, LinuxOne provided us with better security, availability, and flexibility than the other servers can.
*The newest member of the LinuxONE 4 family has arrived - Discover the IBM Z LinuxONE 4 Express now!*