Security of Secure Service Container for IBM Cloud Private

The Secure Service Container for IBM Cloud Private offering provides various security advantages by using the IBM Secure Service Container as the hosting environment.

IBM Secure Service Container is designed to support the deployment of software container technology without requiring application changes to leverage the security capabilities. This is especially useful considering the regulatory focus on protecting critical data from internal and external threats. For example:

• The infrastructure and data are protected against access and abuse by root users, system administrator credentials and other privileged user access.
• Infrastructure management organizations can manage the physical IT infrastructure without having visibility to the end-user's applications and customer data.

As a system or appliance administrator who manages the underlying infrastructure, you can simply download the appliance, deploy it, and then make it available on your system for your developers.

As a developer, you can focus on creating your dockerized solution and deploy it into this environment, and still know that your docker solution is not visible to the system or appliance administrator.

Security mechanisms

Various security mechanisms are also applied to protect the data in the Secure Service Container for IBM Cloud Private solution.

• Persistence data is encrypted by using the automatic file system encryption technology Linux Unified Key Setup (LUKS). The encryption keys are stored within appliances and not accessible to administrators, and keys are managed based on the appliance lifecyle. The Docker container data mounted to disk is also encrypted.
• In-flight data is encrypted by using the automatic network encryption technology Transport Layer Security (TLS). Data is transferred through encrypted management REST API interfaces among Secure Service Container partitions.
• Diagnostic data is encrypted, which includes first-failure data capture (FFDC) data required to fix problems, Dump data including log message buffers, and so on. Such data is only accessible to the service team.
• Operating system access to the underlying Secure Service Container appliance is prohibited, and back doors to this host level are eliminated because SSH is disabled on the Secure Service Container partitions by default. Access to the cluster nodes are via SSH keys that are protected by the cloud administrator. Users traditionally with OS access are not allowed to access application data and customer data.

Encryption algorithms

Encryption algorithms used for storage and data transport are provided by the IBM Secure Service Container in the offering.

The web server of IBM Secure Service Container is nginx. The following table contains the utilized subset (default) of cryptographic capabilities of the Secure Service Container web server.

Table 1. Cryptographic capabilities of the Secure Service Container web server

Note:

Authenticated Encryption with Associated Data (AEAD) is not a hash function. AEAD is an implicit integrity check in AEAD ciphers (for example, AESGCM). Therefore you can declare AESGCM ciphers as:

• Algorithm Application: Data Encryption, Integrity Check
• Type: Encryption Algorithm

Table 2. AEAD algorithm application and type

Appliance Component Communication

This table only lists the utilized subset of cryptographic capabilities supported by GnuPG. See The GNU Privacy Guard for more information about GnuPG.

Table 3. Subset of cryptographic capabilities supported by GnuPG

Additional Information: The currently used cipher for AES under GnuPG is CFB.

Filesystem Encryption

This table only lists the utilized subset of cryptographic capabilities supported by cryptsetup or dm-crypt system.

Table 4. Subset of cryptographic capabilities supported by cryptsetup or dm-crypt