Key features of the 4767 PCIe Cryptographic Coprocessor

High-end secure coprocessor

The IBM 4767 PCIe Crytographic Coprocessor is a high-end secure coprocessor implemented on a PCIe card with a multi-chip embedded module. It is suited to applications requiring high-speed cryptographic functions for data encryption and digital signing, secure storage of signing keys, or custom cryptographic applications. These can include financial applications such as PIN generation and verification in automated teller and point-of-sale transaction servers.

Highest level of certification: FIPS PUB 140-2, Level 4

Federal Information Processing Standards (FIPS) are issued by the U.S. National Institute of Standards and Technology (NIST). The IBM 4767 cryptographic processes are performed within an enclosure on the HSM that is validated to FIPS PUB 140-2, Security Requirements for Cryptographic Modules, Overall Security Level 4. Level 4 is the highest level of certification achievable for commercial cryptographic devices.

Performance and architectural improvements

The IBM 4767 hardware provides significant performance and architectural improvements over its predecessor while enabling future growth. For example, the 4767 can exceed 15,000 PIN translation operations per second. The secure module contains redundant IBM PowerPC 476 processors, custom symmetric key and hashing engines to perform AES, DES, T-DES, SHA-1, SHA-384, SHA-512, and SHA2, MD5 and HMAC, and custom public key cryptographic algorithm engines to support RSA and Elliptic Curve Cryptography.

Tamper responding design

The secure module is protected by a tamper responding design that protects against a wide variety of attacks against the system and immediately destroys all keys and sensitive data if tampering is detected. Other hardware support includes a secure realtime clock, hardware random number generator and a prime number generator.

Common Cryptographic Architecture, Enterprise PKCS #11 APIs

IBM provides the Common Cryptographic Architecture (CCA) Support Program that you can load into the coprocessor (HSM) to perform cryptographic functions common in the finance industry and in Internet business applications. You can also add custom functions to the HSM using an available programming toolkit or through IBM consulting services. IBM also provides the Enterprise PKCS #11 (EP11) interface to run secure key cryptographic operations using the industry-standard PKCS #11/openCryptoki API.

Embedded certificate allows external verification

During the final manufacturing step, the coprocessor generates a unique public/private key pair that is stored in the device. The tamper detection circuitry is activated and remains active throughout the useful life of the coprocessor, protecting this private key as well as other keys and sensitive data. The public key of the coprocessor is certified at the factory by an IBM private key and the certificate is retained in the coprocessor. These safeguards ensure the HSM is genuine and untampered.

Available for select IBM Z, LinuxONE, x64, and Power servers

The technology is available on select IBM Z models (z14, z13s and z13 only) as the Crypto Express5S (CEX5S) feature. On z/OS, support is provided by ICSF cryptographic services. On Linux on IBM Z, CEX5S support is provided by CCA and by Enterprise PKCS #11 (EP11). On x64 servers, the PCIeCC2 is available as MTM 4767-002 with support for specific Windows, SLES, and RHEL releases. On IBM Power servers POWER8®, it is supported by IBM AIX®, IBM i®, and PowerLinux™ operating systems.

You may also be interested in

IBM z15

Flexibility, responsiveness and cost are fueling your digital transformation and your journey to cloud. Now, you can drive to market faster – while avoiding cloud security risks and complex migration challenges. Designed through collaboration with clients, the new IBM z15™ single-frame and multi-frame systems deliver security, privacy and resiliency at scale as part of your enterprise-wide cloud infrastructure. IBM z15 enables cloud native services while extending the value of your most valuable data and application investments to address today’s business challenges and lead tomorrow's transformation.

Learn more

IBM Security Key Lifecycle Manager for z/OS

Centralize, simplify and strengthen encryption key management

Learn more

IBM LinuxONE Emperor II

IBM LinuxONE Emperor II

Learn more

IBM LinuxONE Rockhopper II

A secure, scalable Linux server – built to fit the cloud data center

Learn more

Expert resources to help you succeed

Support

Learn more about product support options.

Resource library

Explore a collection of in-depth information for this product.