## z/VM encrypted hypervisor paging (encrypted paging support) 

With the PTF for APAR VM65993 (planned to be available December 15, 2017), z/VM V6.4 will provide support for encrypted paging in support of the z14 pervasive encryption philosophy of encrypting all data in flight and at rest. Ciphering will occur as data moves between active memory and a paging volume owned by z/VM. 

Included in this support is the ability to dynamically control whether a running z/VM system is encrypting this data. This support will protect guest paging data from administrators or users with access to volumes. Enabled with AES encryption, z/VM Encrypted Paging includes low overhead by using CPACF. 

The supported operating systems are listed in Table 7-10 on page 259. 

## z/TPF transparent database encryption 

Shipped in August 2016, z/TPF at-rest Data Encryption provides following features and benefits: 

GLYPH<SM590000> Automatic encryption of at-rest data by using AES CBC (128 or 256). 

GLYPH<SM590000> No application changes required. 

GLYPH<SM590000> Database level encryption by using highly efficient CPACF. 

GLYPH<SM590000> Inclusion of data on disk and cached in memory. 

GLYPH<SM590000> Ability to include data integrity checking (optionally by using SHA-256) to detect accidental or malicious data corruption. 

GLYPH<SM590000> Tools to migrate a database from un-encrypted to encrypted state or change the encryption key/algorithm for a specific DB while transactions are flowing (no database downtime). 

## Pervasive encryption for Linux on Z 

Pervasive encryption for Linux on Z combines the full power of Linux with z14 capabilities by using the support of the following features: 

GLYPH<SM590000> Kernel Crypto: z14 CPACF 

GLYPH<SM590000> LUKS dm-crypt Protected-Key CPACF 

GLYPH<SM590000> Libica and openssl: z14 CPACF and acceleration of RSA handshakes by using SIMD 

GLYPH<SM590000> Secure Service Container: High security virtual appliance deployment infrastructure 

## Protection of data at-rest 

By using the integration of industry-unique hardware accelerated CPACF encryption into the standard Linux components, users can achieve optimized encryption transparently to prevent raw key material from being visible to OS and applications. 

## Protection of data in-flight 

Because of the potential costs and overheads, most of the organizations avoid the use of host-based network encryption today. By using enhanced CPACF and SIMD on z14, TLS and IPSec can use hardware performance gains while benefitting from transparent enablement. Reduced cost of encryption enables broad use of network encryption. 

## 7.4.7 Special-purpose Features and Functions 

This section describes the zEnterprise Data Compression Express. 

