Oracle Solaris 11 - ASBIS SK Online

Security of Oracle SPARC Systems 

and 

Oracle Solaris 11 OE 

Marek Slivka 

Principal Sales Consultant

New SPARC T4 Processor 

18 On Chip Crypto functions 

Balanced high-bandwidth interfaces and internals 

2.85GHz and/or 3.0GHz 

2 On Chip 10 GbE Networking 

Dynamic Threading 

Out of Order Execution 

8 Cores, 64 Threads 

Co-engineered with Oracle software 

2 On Chip Dual-Channel DDR3 Memory Controllers 

2 On Chip x8 PCIe gen2 I/O Interfaces 

3

SPARC T4 CPU and Systems Deliver 

High Performance, Security 

• Achieves high security performance through on-chip Crypto 

Instruction Accelerators in each core 

• Streamlines processing and application programming with 29 new 

non-privileged cryptographic instructions 

• Secures your data as well as your systems 

• Makes encryption available to all 

– It’s built in – just start using it 

– No extra costs to purchase or install 

• Delivers up to 11x encryption performance boost

Encryption 

Why Use It? 

• To keep data safe; yours and your customers 

– Data confidentiality: only authorized readers 

– Message integrity: the same as when sent or saved 

– Authentication: access only to those authorized 

– All disks and tapes leave the data center eventually 

• Some regulations demand or highly encourage it 

• Warm fuzzies: to sleep at night

Encryption Functions 

Why Different Types Are Needed

SPARC T4 Leads in On-Chip Encryption Acceleration

SPARC T4 Leads in On-Chip Encryption

SPARC T4: 4th Generation SPARC On-Chip 

Cryptography Leadership

SPARC T4 Cryptographic Acceleration 

Significant Performance Gains for SSL

Benefits of SPARC T4 CPU and Systems 

High Performance, Security 

• Leads in on-chip acceleration of popular encryption standards 

– Accelerates 17 cryptographic algorithms 

– Plus random number generation support 

• Includes simple instruction based application programing 

– Allows reduced application code size 

– Minimizes complexity and possible errors 

– Provides direct access to on-chip encryption acceleration for fast 

processing 

• Encryption on-chip is more tamper resistant

Oracle Solaris 11 & SPARC T4: End-to-End Security 

SPARC T4 is 30% to 4x faster than Westmere (AES-NI, best x86 

crypto) 

SSL 

SOAP 

SSL 

SSL 

SSL 

iPlanet 

Web 

IPsec (VPN) 

Unified Key Management 

SSL 

Fusion 

Middleware 

Storage 

ZFS 

Filesystem 

SSL 

Oracle 

Database 

Storage 

Tablespace 

Encrypt 

• SPARC T4 faster than x86 Westmere (with AES-NI): 

– Database queries with security 43% faster vs. x86 

– ZFS Filesystem Crypto 4x faster vs. x86 

– 10Gb/s SSL T4 uses 50% less threads to saturate 10GbE 

– 10Gb/s IPsec (VPN) T4 23% faster vs. x86, T4 uses 3.6x less CPU 

– AES-CFB, CBC, CCM, GCM kernels 1.4x to 3.6x faster vs. x86 

• SPARC T4 is dramatically faster than IBM Power7 

– OpenSSL 4.3x faster single-thread security vs Power7

SPARC T4 & Oracle Solaris 11 Oracle TDE 

• Performance on Oracle TDE (Transparent Database Encryption) 

– SPARC T4 43% faster secure queries than x86 Westmere (AES/NI) 

• Combination of fast query processing and TDE 

– Tests 8 different queries on 2-socket servers 

– Consistent SPARC T4 query time 128-bit to 256-bit ciphers 

44% faster 

System AES-CFB-128 AES-CFB-192 AES-CFB-256 AES-CFB-256 

SPARC T4 2.85GHz 585 s 586 s 586 s 99%u / 1%sys 

x86 3.47GHz Xeon 836 s 841 s 842 s 98%u / 2%sys 

% T4 advantage 43% 44% 44% 

secs

ZFS Encryption: T4 Beats Westmere(AES-NI) 

Encrypted filesystem on Oracle Solaris 11 is practical for applications 

• SPARC T4 4x faster than Westmere(AES-NI acceleration) 

– Both AES-CCM & AES-GCM 4x faster on 128, 192, 256-bits 

– SPARC T4 Encryption performance very near cleartext performance 

• ZFS encryption uses the Oracle's Solaris 11 Cryptographic Framework 

Encrypt MB/s - 5 file create Clear AES-128-CCM AES-192-CCM AES-256-CCM 

SPARC T4-2 3,802 3,225 3,335 3,167 

2x Westmere 3,325 773 764 750 

T4 Advantage 1.1x 4.2x 4.4x 4.2x

Encryption: T4 Beats Westmere(AES-NI) 

In-memory encryption micro-benchmark on Oracle Solaris 11 

• SPARC T4 1.7x faster throughput than 3.33GHz Westmere 

– Encryption using ucrypto on T4/IPP on the Westmere/AES-NI 

• Single-thread AES-CFB & AES-CBC 

– SPARC T4 single-thread 9% to 26% faster than Westmere/AES-NI 

Processor AES-256-CBC T4 Advantage AES-256-CFB T4 Advantage 

SPARC T4 11,567 MB/s – 10,949 MB/s – 

Intel X5680 6,670 MB/s 1.7x 7,503 MB/s 1.5x 

SPARC T3 5,980 MB/s 1.9x 6,023 MB/s 1.8x

Security with SPARC T4 

Built-in Encryption. No Overhead. No Software Changes. 

43% faster secure queries 

ZFS Encryption: Encrypted Filesystem 

3x faster encryption 

Encryption: In-memory 

1.8x better throughput (reduced time) 

See performance substantiation slides

ORACLE’S DUAL OS STRATEGY 

Best in class. Optimized for the enterprise. Your Choice. 

17

SOLARIS 11. THE FIRST CLOUD OS. 

NEXT GENERATION OF UNIX 

#1 UNIX 

Built for Cloud Infrastructures 

Engineered for Oracle 

18

#1 UNIX 

If It Must Run, It’s On Solaris 

More installations 

than AIX and HP-UX 

combined. 

11,000+ applications 

just work. 

Now in a cloud. 

Optimized to Run All of Your Applications Faster

Extreme Performance for Cloud Applications 

Built for Next-Decade Hardware 

10x 

Networking 

10x 

CPU 

10x 

Memory 

10x 

Data

Co-engineered with the Oracle Stack 

CPU 

Memory 

File 

System 

I/O 

Security 

Fully MT-hot kernel, scales to 100s of cores and 10,000s of HW threads 

Support for Critical Threads features in T4 chip 

JVM support for Solaris scheduling classes, User-level high resolution timer support 

WLS scalability, smt pause() to optimize busy waits in the JVM, 5X performance 

improvement of high-resolution timer 

Large page support by JVM, T4 2GB pages for Java performance, Preemption control 

NUMA IO framework, Latency-aware kernel memory allocator, NUMA optimizations in 

LDOMs, Intimate Shared Memory (ISM), Dynamic Intimate Shared Memory (DISM) 

Optimized Shared Memory (OSM), NUMA IO framework, Latency-aware kernel 

memory allocator, Large Page support, Fast DB Restart 

Support for Event ports, Userland file system for DB 

SDP, IPoIB,Receive-side Scaling, LSO for VNICs, Traffic fan-out for EoIB, HA for SDP, 

Open Fabrics User Verbs, SR-IOV performance scaling, Dynamic Reconfiguration for 

IB HCAs,vnet & vswitch performance improvements, uDAPL, RDSv1, RDSv3, SDP: 

Support for low-latency InfiniBand protocols, Direct I/O with Concurrent writes, 

Dynamic Reconfiguration for IB HCAs 

Integration of JVM with crypto offload engines 

Zones support for EoIB, IPoIB, SDP: Secure isolation, lowest-latency virtualization, 

Integration with Solaris Crypto offload engine, Zones: Secure isolation, lowest-latency 

virtualization

Co-engineered with the Oracle Stack 

2.4x Faster Database Performance 

7x Better Middleware Price/Performance with Java

Designed-in Virtualization

21st Century Cloud Infrastructure 

For All Mission Critical Applications 

Solaris 11 

Zone 

Solaris 10 

Zone 

Solaris Legacy 

Zone 

Solaris Legacy 

Zone 

Solaris 10 

Zone 

Oracle Solaris 11 Oracle Solaris 10 

Oracle VM 

SPARC 

x86

Availability Meets The Cloud 

Oracle Solaris 11 

• Integrated end-to-end fault healing of 

hardware, OS and virtualization 

• Dynamic Domains 

Scale 

• No software to install 

• Zero overhead virtualization 

• SPARC / x86 Hypervisors 

• Solaris Zones 

• Oracle VM Templates 

VMware 

• HA for VMs 

• Vmotion 

• Virtualization 

mgmt tools 

• Support for x86 

• Mission-critical workloads 

• Production-safe observability 

• Component-Level Dynamic Reconfiguration 

• Application failover in zone clusters 

• Support for SPARC and x86 

• Secure live migration 

• Instant provisioning 

Availability

Oracle Solaris 11: Network Virtualization 

Save On Network Gear. Increase Performance 

Virtual equivalents of NICs, 

switches, LANs, 

firewalls, load balancers, 

routers, bridges - Aggregation 

Network Resource and 

Bandwidth Management for 

QOS 

Secure isolation of networks 

Tight Solaris Zones Integration

Network Architecture Strategy

Data at Cloud Scale

Breakthrough Efficiency 

Scale Out Design. Built-in Data Services. No License Fees. 

Compression 

Replication 

Flash-aware 

virtual storage pools 

Deduplication 

Dataset 

Encryption 

Reduce Storage Use by up to 10x

Engineered Cloud Security 

At Every Level

Security in the Cloud 

Defense in Depth. Multitenancy Design. 

• Delegated administration 

• Built-in Audit 

• Immutable Zones 

• Network and data layer protection 

• Encrypted data per tenant

Advanced Protection 

Integrated Audit, Encryption and Content Security 

• Read-only virtual OS 

environments 

• Encrypted and nonencrypted 

data sets in 

same storage pool 

AIX 

• Enterprise encryption key manager 

for application, middleware, 

database, OS, server and storage 

VMware 

• Delegated administration for virtual 

OS environments for self-service 

IT 

• Low impact, 

always-on auditing 

• Assured software 

packages with vendor 

and customer crypto 

signatures

Cloud Deployment Simplified

Redefining Software Lifecycle Management 

Safe Updates. Fast Reboots. 

• Error-free safe software updates 

– Automatic dependency checking 

of software packages 

– Cloned environment updated, 

immediate rollback if needed 

• Reboot in seconds 

– In-kernel boot loader puts 

kernel into memory and switches

Your Software. Our Software. Your Cloud. 

Oracle Solaris 

Content Server 

Oracle VM 

Templates 

Your 

Software 

Your Enterprise 

Repository 

Error-free. Safe. Fast.


Security 

Oracle Solaris 11 Security Protections 

Oracle Solaris 11 Security Technologies 

Oracle Solaris 11 Security Defaults 

36


Security Protections 

Protecting the kernel 

Protecting logins 

Protecting data 

37


Security Technologies 

Audit Service 

Basic Audit Reporting Tool (bart, bart_rules, bart_manifest) 

Cryptographic Services (cryptoadm, encrypt, mac, pktool, kmfcfg) 

File permissions and Access Control Entries (chmod) 

38



Packet Filtering 

IP Filter (ipfilter, ipf, ipnat, scv.ipfd, ipf) 

TCP Wrappers (hosts_access) 

Passwords and Password Constraints (passwd, crypt.conf) 

39



Pluggable Authentification Module (pam.conf) 

Privileges in Oracle Solaris (ppriv, privileges) 

Remote Access 

IPsec and IKE, Secure Shell, Kerveros Service 

(ipsecconf, in.iked, ssh, sshd, sshd_config, ssh_config, kerberos, kinit) 

40



Role-Based Access Control (rbac, roleadm, profiles, user_attr) 

Service Management Facility (svcadm, svcs, smf) 

Oracle Solaris ZFS File System (zfs) 

Oracle Solaris Zones (brands, zoneadm, zonecfg) 

Trusted Extensions (trusted_extensions, labeld) 

41


Security Defaults 

System Access Is Limited and Monitored 

Kernel, File, and Desktop Protections Are in Place 

Additional Security Features Are in Place 

42

Why Oracle Customers Choose Solaris 

Top Reasons for Investing in Oracle Solaris Systems 

1. Reliable: If it must run, it’s on Solaris 

2. Fast: World record leader for enterprise applications 

3. Scalable: Engineered today for next generation systems. Invest for the future 

4. Secure: Deeply integrated security. Trusted labeled configurations 

5. Virtualized: Maximum resource utilization. Faster time to market 

6. Engineered for Oracle: Best performance. Fastest deployments 

7. SPARC and x86: Choice of industry’s leading enterprise architectures 

8. Compatible: Preserves your investments. Avoids costly migrations 

9. Trusted Vendor: One phone call

Oracle Solaris 11 - ASBIS SK Online

Create successful ePaper yourself

Delete template?

Save as template?