SSC combines hardware, software, and middleware and is unique to IBM Z platform. Although it is called a Container, it should not be confused with purely software Open Source containers (such as Kubernetes or Docker). 

SSC is a part of the Pervasive Encryption concept that was introduced with IBM z14, which is aimed at delivering best IBM Security hardware and software enhancements, services, and practices for 360-degree infrastructure protection. 

LPAR is defined as SSC by using Hardware Management Console (HMC). 

The SSC solution offers the following advantages: 

GLYPH<SM590000> Existing applications require zero changes to use SSC; software developers do not need to write any SSC-specific programming code. 

GLYPH<SM590000> End-to-end encryption of data in-flight and at-rest: 

– Automatic Network En cryption (TLS, IPSEC); data in-flight. 

– Automatic File System Encryption (LUKS); data at-rest. 

– Linux Unified Key Setup (LUKS) is the standard way in Linux to provide disk encryption. SSC encrypt all data with a key that is stored within the appliance 

– Protected memory: Up to 16 TB can be defined per SSC LPAR. 

GLYPH<SM590000> Encrypted Diagnostic Data 

All diagnostic information (debug dump data, and logs) are encrypted and do not contain any user or application data. 

GLYPH<SM590000> No operating system access 

After the SSC appliance is built, Secure Shell (SSH) and command line-interface (CLI) are disabled, which guarantees that even system administrators cannot access the contents of SSC and do not know what application is running there. 

GLYPH<SM590000> Applications that run inside SSC are accessed externally by REST APIs only, in a transparent to user way. 

GLYPH<SM590000> Tamper-proof SSC Secure Boot 

SSC- eligible applications are booted into SSC by using verified booting sequence, where only trusted and digitally signed and verified by IBM software code is uploaded into the SSC. 

GLYPH<SM590000> Vertical workload isolation, which is certified by EAL5+ Common Criteria Standard, which is the highest level that ensures workload separation and isolation. 

GLYPH<SM590000> Horizontal workload isolation, which is a separation from the rest of the host environment. 

SSC is a powerful IBM technology for providing the extra protection of the most sensitive workloads. The integration with other applications in transparent; all services can be called externally by standard REST APIs. 

## IBM z/VSE Network Appliance 

The z/VSE Network Appliance builds on the z/VSE Linux Fast Path (LFP) function and provides Internet Protocol network access without requiring a TCP/IP stack in z/VSE. The appliance uses the SSC infrastructure that was introduced on z13 and z13s servers. Compared to a TCP/IP stack in z/VSE, this network appliance can support higher TCP/IP traffic throughput while reducing the processing resource consumption in z/VSE. 

