IBM i Security and Vulnerabilities User Group

IBM i Security and Innovation

Join this online user group to communicate across IBM i Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Performance impact on IBM i with Disk Encryption

    Posted 10/24/24 03:35 AM

    Hi IBMi guys, do you have experience on IBMi disk encryption ? Due to NIS2 compliance some customer is looking for a way to encrypt the data disk on IBMi.

    There are several ways to do, via software solutions like Fortra or Raz-Lee suite or 5770-SS1 Option 45 - Encrypted ASP and  hardware features like co processor or 5770-SS1 Option 45 - Encrypted ASP.

    i did some POC on test customer environments but not in production .. do you have experiencing or suggestion related to the performance issues?

    Some software's are mono thread approach and can be a problem on IFS data encryption and use exit points technologies.

    Have a good day. 



    ------------------------------
    Luca Maurizio Verzicco
    IBMi Service and PreSales Manager
    S2E - Solution to Enterprise
    Milano - Italy
    +39 380 6570039
    ------------------------------


  • 2.  RE: Performance impact on IBM i with Disk Encryption

    Posted 10/24/24 07:40 AM
    Edited by Rohit Chauhan 10/24/24 07:40 AM

    Hello,

    I have worked in a similar project for a customer in the past so sharing my feedback. As you know there are many options available to encrypt the disks on IBM i. The main point to note with 5770SS1 Option 45 is that it will generate overhead most likely and you might need to add more memory and processor in addition to what is assigned today. It also depends on the type of application used by the customer. If the system is already running the application doing high transactions or data exchange then it is worth to consider for more resources planning from the beginning. The more encrypted data processing is taking place the higher the performance impact will be.I don't recall of having issues with the exit points but if you are using any third party product please check with them regarding the functionality validations. 

    On the other hand if you can have Cryptographic Coprocessor which is a hardware piece then the benefit is that encryption handling is done at a hardware level which reduces the overhead when it comes to memory and cores.  In this case the impact will be negligible. I think the latest supported Cryptographic Coprocessor card is 4769 in the market but 4770 should also be released in near future. 



    ------------------------------
    Rohit Chauhan
    Senior Technical Specialist
    Norway
    ------------------------------



  • 3.  RE: Performance impact on IBM i with Disk Encryption

    Posted 10/24/24 07:48 AM
    Edited by Luca Maurizio Verzicco 10/24/24 08:01 AM

    Thank Rohit Chauhan for your experience. 

    i did some POC with software solutions but the impact on performance is heavy if customer want to encrypt al the DB. 

    I'm doing some investigation about Hardware solution. 

    Have a good day. 



    ------------------------------
    Luca Maurizio Verzicco
    IBMi Service and PreSales Manager
    S2E - Solution to Enterprise
    Milano - Italy
    +39 380 6570039
    ------------------------------

    Original Message


  • 4.  RE: Performance impact on IBM i with Disk Encryption

    Posted 10/24/24 07:57 AM

    Hi @Luca Maurizio Verzicco,

    It is still not clear to me. So that means you are doing investigation on the hardware solution,i.e, Cryptographic Coprocessor ?



    ------------------------------
    Rohit Chauhan
    Senior Technical Specialist
    Norway
    ------------------------------

    Original Message


  • 5.  RE: Performance impact on IBM i with Disk Encryption

    Posted 10/24/24 08:05 AM

    Hi Rohit, thanks for your info.

    I'll do some investigation about costs and type of hardware Cryptographic Coprocessor  solution , the customer have an intensive use of CPU and RAM and don't want to loose performance.

    i think the Cryptographic Coprocessor card can be the right solution. 

    Have a good day. 



    ------------------------------
    Luca Maurizio Verzicco
    IBMi Service and PreSales Manager
    S2E - Solution to Enterprise
    Milano - Italy
    +39 380 6570039
    ------------------------------

    Original Message


  • 6.  RE: Performance impact on IBM i with Disk Encryption

    Posted 10/24/24 08:38 AM

    Hi Luca - Just to be clear - are you looking for encryption at rest or looking at encryption in flight ? For us, we use encryption at REST and leverage external storage, in particular Flash Storage to accomplish our encryption needs.  Maybe this could be a solution for you/your customer as well. ?  Using the CRYPTO card does have some downsides to it and without knowing the environment , it would be difficult to gauge whether or not those downsides are pertinent to your customer. Hope this helps and Good luck - Rich



    ------------------------------
    Rich Malloy
    ------------------------------



  • 7.  RE: Performance impact on IBM i with Disk Encryption

    Posted 10/24/24 09:35 AM
    Edited by Luca Maurizio Verzicco 10/24/24 09:37 AM

    Hi Rich, thanks for your info. 

    Customer want to use an on the fly encryption. 

    They are using two 9009 41G machine with internal SSD disk and not external storage.

    i'm looking also for NVME disk costs  with Self Encrypting Drives (SED) solution  and if it can be enought to solve the situation.

    Thanks for your help. 



    ------------------------------
    Luca Maurizio Verzicco
    IBMi Service and PreSales Manager
    S2E - Solution to Enterprise
    Milano - Italy
    +39 380 6570039
    ------------------------------

    Original Message


  • 8.  RE: Performance impact on IBM i with Disk Encryption

    Posted 10/24/24 10:00 AM

    You're welcome Luca.  If they are only looking at encrypting the DISK itself, I think a storage solution that provides encryption at REST would probably be best overall. Another thing to consider, if you go the CRYPTO route and need to add processor / memory - you will need to do so very fast as the 41G (and other Power 9 models) are on the 'chopping' list for those kind of features. This might be an opportunity to do something new all the way around.....

    Hardware withdrawal: IBM POWER9 Activation features - IBM Documentation



    ------------------------------
    Rich Malloy
    ------------------------------

    Original Message


  • 9.  RE: Performance impact on IBM i with Disk Encryption

    Posted 10/25/24 03:35 AM

    Luca, 

    Further along to what everyone said here, some additional points to consider. 

    Id look at the production box PDI stats - FULL OPEN Rates, this gives you a good indication with workload on what you might expect. 

    Then further to that, perhaps understand the clear reasons for encryption (e.g. full disk encryption might not solve the problem if the system is still open for attack vectors on sensitive data, that they will need a software solution). 

    If that is the actual reason for disk encryption, then further push them to classify data, Encryption is heavier than Obfuscation, which you might only want to obfuscate PI data and not sensitive data say a payroll database. 

    Marius



    ------------------------------
    Marius le Roux
    Owner
    MLR Consulting
    ------------------------------



Related Content