vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Confidential computing with LinuxONE 

Confidential computing is enabled on LinuxONE (s390x processor architecture) by using the [IBM Secure Execution for Linux](https://www.ibm.com/docs/en/linux-on-systems?topic=virtualization-introducing-secure-execution-linux) technology. This technology is part of the hardware of IBM z15 (z15) and IBM LinuxONE III generation systems. With IBM Secure Execution for Linux, you can securely deploy workloads in the cloud. It ensures the integrity and confidentiality of boot images, and server authenticity. Applications are isolated from the operating system, thus providing more privacy and security for the workload.

By using IBM Secure Execution for Linux, you can create encrypted Linux images that can run on a public, private, or hybrid cloud with their in-use memory protected. The workload or data is protected from external and insider threats.

A new operating system that leverages the IBM Secure Execution for Linux technology is now available as IBM Hyper Protect. The associated image that's used to create the instance is called the [IBM Hyper Protect Container Runtime (HPCR) image](https://cloud.ibm.com/docs/vpc?topic=vpc-vsabout-imageshyper-protect-runtime). A virtual server instance that's provisioned by using this image is called as an IBM Cloud Hyper Protect Virtual Servers for VPC (Virtual Private Cloud) instance.

For a technical deep dive into the IBM Hyper Protect Platform, see the white paper [The Second Generation of IBM Hyper Protect Platform](https://www.ibm.com/downloads/cas/GPVMWPM3).

Check out the [tutorial](https://cloud.ibm.com/docs/vpc?topic=vpc-financial-transaction-confidential-computing-on-hyper-protect-virtual-server-for-vpc) and the [video](https://mediacenter.ibm.com/media/Confidential+Computing+for+a+financial+transaction+using+Hyper+Protect+Virtual+Server+for+VPC/1_vv3j2oo6) on Confidential Computing for a financial transaction using Hyper Protect Virtual Server for VPC.
A certificate is issued by a certificate authority and is digitally signed by that authority. A certificate is generally issued and signed by a certificate authority. However, for testing and development purposes, you might use a self-signed certificate.
* Private key: An algorithmic pattern that is used to encrypt messages that only the corresponding public key can decrypt. The private key is also used to decrypt messages that were encrypted by the corresponding public key. The private key is kept on the user system and is protected by a password.
* Intermediate certificate (optional): A subordinate certificate that is issued by the trusted root certificate authority (CA) specifically to issue end-entity server certificates. The result is a certificate chain that begins at the trusted root CA, passes through the intermediate certificate, and ends with the SSL certificate issued to the organization. Use an intermediate certificate to verify the authenticity of the main certificate. Intermediate certificates are typically obtained from a trusted third party. You might not require an intermediate certificate when you test your app before you deploy it to production.
* Enable request of client certificate: When you enable this option, a user who tries to access an SSL protected domain is requested to provide a client-side certificate. For example, in a web browser, when a user tries to access an SSL protected domain, the web browser prompts the user to provide a client certificate for the domain.
* Client certificate truststore (optional): Includes the client certificates for the users who you want to allow access to your app. Upload a client certificate truststore file to enable the option to request a client certificate.



You can set up mutual authentication by uploading a client certificate truststore that includes a public key in its metadata.







 Importing SSL certificates into IBM Cloud Secrets Manager 

You can apply a security protocol to provide communication privacy for your app to prevent eavesdropping, tampering, and message forgery. If you have a Lite account, you must upgrade your account to upload a certificate.

When an expired or expiring certificate must be renewed, and after the new certificate is ready, delete the existing certificate and then add the new one.



 Import your existing credentials into IBM Cloud Secrets Manager
[Image showing alice sending message to protectec queue](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_app_ams_st_putpq.png)
4. From bob's command shell, run the sample program to receive the messages.

amqsgetc DEV.QUEUE.1.ALIAS <your Queue manager name>

4.1 Enter the application API key for bob when prompted for a password(This is your '"apiKey' value in the file "applicationApiKeybob.json)
4.2. You can see that the message is received as message <PDMQ> shows data encrypted, thus confirming that message is stored as encrypted and not readable by non-authorized users. ![Image showing bob receiving message from alias queue](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_app_ams_st_getpaq.png)











 Conclusion 

You have now completed this tutorial. As a part of this guide, you have set up Application AMS for end to end security of messages. We have demonstrated that this ensures message integrity and message privacy are protected and that messages are readable only by authorized users.





 Appendix 



 Appendix 1: connection_info.txt 

To retrieve the connection_info.txt file containing queue manager connection details:



1. Login to the IBM Cloud service instance by clicking on the relevant service shown in the table
!
This section guides you in creating the keystore.conf file for alice and bob.



1. Create a new file keystore.conf in the .mqs directory for user alice and copy following contents into it.

On Mac:

cms.keystore=/alice/.mqs/alicekey
cms.certificate=Alice_Cert

On Linux:

cms.keystore=/home/alice/.mqs/alicekey
cms.certificate=Alice_Cert

On Windows:

cms.keystore=%HOMEDRIVE%Usersalice.mqsalicekey
cms.certificate=Alice_Cert



* Replace %HOMEDRIVE% with the value of it on your computer (for ex: C:)



2. Create a new file keystore.conf in the .mqs directory of user bob and copy following contents into it.
On Mac:

cms.keystore=/bob/.mqs/bobkey
cms.certificate=Bob_Cert

On Linux:

cms.keystore=/home/bob/.mqs/bobkey
cms.certificate=Bob_Cert

On Windows:

cms.keystore=%HOMEDRIVE%Usersbob.mqsbobkey
cms.certificate=Bob_Cert



* Replace %HOMEDRIVE% with the value of it on your computer (for ex: C:)









 Testing End to End Message Protection 

MQ Advanced Message Security provides:



* Message Integrity: Enables authentication of inbound traffic on a per-message basis, as well as strict restrictions on which queues those messages can be sent to and which recipients can receive them.
* Message Privacy: Based on the protection policy set on the target queue, AMS encrypts the message even before it is placed on the queue, thus ensuring that its contents are never exposed.



Demonstration of end to end message security involves demonstrating message integrity and message privacy. We start by demonstrating message integrity, where we can see that non-authorized users are not allowed to access the protected queue.
How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

![0_ti_146001191_Ver_2_mid_034b7088-1338-4f0e-8221-efefafbffd86_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_sc_30_nwd
How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

![0_ti_146001191_Ver_2_mid_53b3b0ed-33e5-48c4-91d5-d18c42c04d6e_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_sc_30
How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

![0_ti_146001191_Ver_2_mid_9643ccda-1ae4-4e3f-9c88-29293bed697b_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_sc_30_nwd_1_tl_Choosing_
How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

![0_ti_146001191_Ver_2_mid_a6e17234-746f-419f-8ecb-a85777b41df8_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_sc_30_nwd_1_tl
Compliance 

IBM Cloud® Schematics actively participates in several industry compliance programs. As compliance focal, you can use the Schematics goals to check that your organization is adhering to the external and internal standards for your industry. For more information about monitoring compliance, see [Getting started with Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).

To monitor your resources with Schematics, see [Managing security and compliance with Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-monitoring-instances).



 General Data Protection Regulation (GDPR) readiness 

About GDPR and how Schematics adheres to it, see [General Data Protection Regulation](https://cloud.ibm.com/docs/schematics?topic=schematics-general-data-protection-regulation-gdpr). View [IBM's commitment to GDPR readiness](https://www.ibm.com/data-responsibility/gdpr/) to learn about IBM's GDPR readiness journey and the GDPR capabilities and offerings to support your compliance journey.





 Privacy shield 

Schematics is privacy shield that is certified. For more information, see the [IBM Privacy Shield Privacy Policy for Certified IBM Cloud Services](https://www.ibm.com/us-en/privacy/privacy-shield).





 International Organization for Standardization (ISO) 

Schematics is audited by a Third-party security firm and meet ISO 27001, ISO 27017, ISO 27018, and ISO 27701 requirements. For more information, see the [Schematics Compliance page](https://www.ibm.com/cloud/compliance) for links to the certificates. The following descriptions on the Schematics compliance page cover the Schematics service and respective certifications:



* IBM Cloud Services (PaaS and SaaS) certified cloud product listing
* IBM Cloud Services (PaaS and SaaS) certificate - ISO 27001
* IBM Cloud Services (PaaS and SaaS) certificate - ISO 27017
* IBM Cloud Services (PaaS and SaaS) certificate - ISO 27018
Any vulnerabilities found by these scans must be resolved before product release or submitted through IBM's Product Security Incident Response Team (PSIRT) process for resolution via defect (IBM Authorized Program Analysis Report or APAR)
* IBM TRIRIGA development uses Rational Team Concert for development (management of tasks, stories, epics, version control, test management, etc) Selenium and TestNG for test automation, Jenkins for deployment automation, and Rational Performance Tester (RPT) for performance load testing.







 Data Security & Privacy (DS&P) 



* IBM Data Security and Privacy Principles for IBM Cloud services can be found at the link below:



[https://www.ibm.com/support/customer/csol/terms/?cat=data-security](https://www.ibm.com/support/customer/csol/terms/?cat=data-security)



* IBM Privacy Shield Privacy Policy for Certified IBM Cloud Services can be found below. This is applicable to EU-US and Swiss-US customers:



[https://www.ibm.com/privacy/details/us/en/privacy_shield.html](https://www.ibm.com/privacy/details/us/en/privacy_shield.html)



* Data Responsibility at IBM



[https://www.ibm.com/blogs/policy/dataresponsibility-at-ibm/](https://www.ibm.com/blogs/policy/dataresponsibility-at-ibm/) If a government wants access to data held by IBM on behalf of a SaaS client, IBM would expect that government to deal directly with that client



* Data Processing Addendum (GDPR)



[https://www.ibm.com/support/customer/zz/en/dpa.html](https://www.ibm.com/support/customer/zz/en/dpa.html)





 Data Privacy and Subject Rights 



* IBM Privacy Statement



IBM's Privacy Statement describes IBM's general privacy practices and subject rights that apply to personal information. For complete statement details click on the link below.
(https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpswhy-do-i-see-wildcard)[Is HTTP2 protocol supported for HTTPS requests?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpsis-http2-supported)[Why is the newly created wildcard CDN status CNAME configuration required if we don't need to set the DNS record to point the domain to IBM CNAME?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpswildcard-cname-configuration-needed)


Feedback

Focus sentinel

 Give us your feedback 

Tell us about your experience0/1500



Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

!
Viewing your various firewalls 

You can identify the Hardware Firewalls in use on an account and their associated VLANs, as well as identify unprotected VLANs and plan the deployment of a firewall solution.



 Firewall overview by VLAN 

To get an overview of firewalls on your system, as well as initiate basic management:



1. From your browser, open the [IBM Cloud catalog](https://cloud.ibm.com) and log into your account.
2. Select the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) from the top left, then click Classic Infrastructure.
3. Select Network > IP Management > VLANs.



To view only public VLANS, click on the Filter drop down and enter fcr for Primary Router.

Each row represents a VLAN in your infrastructure. IBM© Cloud populates the VLAN NUMBER and PRIMARY ROUTER information automatically indicating the true VLAN number and the router that it is configured on. Use the NAME field to define a recognizable name.

The GATEWAY/FIREWALL column contains details about which hardware firewall protection is in place, for example:

Individually Protected Servers indicates that one or more servers is utilizing a Hardware Firewall and that there is not a FortiGate Security Appliance, or Network Gateway in place. VLAN firewalls and network gateways are not able to be placed on a VLAN that has individually protected servers.

Firewall-vlanXXXX.networklayer indicates that there is a FortiGate Security Appliance in place. Only one VLAN firewall or Network Gateway can be associated with a VLAN, but a server can be protected on the public VLAN by a VLAN firewall and associated on the private network with a Network Gateway.

GatewayName indicates the VLAN is associated with that Network Gateway.





 Individually protected servers view 

On the VLANs screen, identify a row with Individually Protected Servers in the Gateway/Firewall column and click on the associated VLAN number link. This will display the details for the VLAN including the associated devices.
From the list DNS Virtual Server Name, select the previously-configured DNS virtual server, and set the Redirect option to Origin.

The Destination Virtual Server setting is used when outbound traffic is to be directed to the local cache server pool. Leave it empty when you want to direct all your outbound traffic to origin servers.
7. Click OK followed by Done.



Contribute in GitHub

Open doc issue

Edit topic







Feedback

Focus sentinel

 Give us your feedback 

Tell us about your experience0/1500



Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

![0_ti_146001191_Ver_2_mid_0221f76f-495c-4b72-8f9a-5b8c8b0894f4_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_sc_30_nwd_
Edit topic







Feedback

Focus sentinel

 Give us your feedback 

Tell us about your experience0/1500



Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

![0_ti_146001191_Ver_2_mid_edb404e7-7014-4a07-93e6-96c7494003bf_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_sc_30_nwd_1_tl_Why_20can_t_20I
export MQSERVER="CLOUD.ADMIN.SVRCONN/TCP/<HOSTNAME>(<PORT>)"

On Windows:
set MQSAMP_USER_ID=alice
set MQSERVER=CLOUD.ADMIN.SVRCONN/TCP/<HOSTNAME>(<PORT>)



* <HOSTNAME> - this is 'hostname' in the file connection_info.txt
* <PORT> - this is 'listenerPort' in the file connection_info.txt



2. Run the sample program to receive the messages.

amqsputc DEV.QUEUE.1 <your Queue manager name>



* Enter the application API key for alice when prompted for a password(This is your '"applicationApiKey' value in the file "applicationApiKeyalice.json)



Image below shows that alice's attempt to open the protected queue has failed with MQRC_NOT_AUTHORIZED. ![Image showing put failure onto a protected queue](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_app_ams_alice_pt_putpq.png)







 Message Security Check - Authorize users to Send and Receive messages on a Protected Queue. 

alice and bob have the required configuration and fully comply with the protection policy defined on the target queue. This makes alice and bob the authorized sender and recipient of the message on the protected queue. As part of this demonstration, we run the sender program (amqsputc) using alice's userid to send a message to the protected queue. We then run the receiver program (amqsgetc) using bob's userid to receive the message.



1. Create the following environment variables in alice's command shell.

On Mac:
export MQSAMP_USER_ID=alice
export MQSERVER="CLOUD.ADMIN.SVRCONN/TCP/<HOSTNAME>(<PORT>)"
Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-remdiations) 
 1.2.34 Ensure that encryption providers are appropriately configured. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-remdiations) 
 1.2.35 Ensure that the API Server makes use of only Strong Cryptographic Ciphers. Manual 1 Pass 







 1.3 Controller manager 



Section 1.3 Controller manager benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.3.1 Ensure that garbage collection is configured as appropriate. Manual 1 Not checked 
 1.3.2 Ensure that controller manager healthz endpoints are protected by RBAC. Automated 1 Pass 
 1.3.3 Ensure that the --use-service-account-credentials option is set to true. Automated 1 Pass 
 1.3.4 Ensure that the --service-account-private-key-file option is set as appropriate. Automated 1 Pass 
 1.3.5 Ensure that the --root-ca-file option is set as appropriate. Automated 1 Pass 
 1.3.6 Ensure that the RotateKubeletServerCertificate option is set to true. Automated 2 Pass 
 1.3.7 Ensure that the --bind-address option is set to 127.0.0.1. Automated 1 Pass 







 1.4 Scheduler 



Section 1.4 Scheduler benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.4.1 Ensure that the healthz endpoints for the scheduler are protected by RBAC. Automated 1 Pass 
 1.4.2 Verify that the scheduler API service is protected by authentication and authorization. Automated 1 Pass 









 2 etcd 



Section 2 etcd benchmark results

 Section Recommendation Manual/Automated Level Result 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Automated 1 Pass
Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 
 1.2.34 Ensure that encryption providers are appropriately configured. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 
 1.2.35 Ensure that the API Server makes use of only Strong Cryptographic Ciphers. Manual 1 Pass 







 1.3 Controller manager 



Section 1.3 Controller manager benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.3.1 Ensure that garbage collection is configured as appropriate. Manual 1 Not checked 
 1.3.2 Ensure that controller manager healthz endpoints are protected by RBAC. Automated 1 Pass 
 1.3.3 Ensure that the --use-service-account-credentials option is set to true. Automated 1 Pass 
 1.3.4 Ensure that the --service-account-private-key-file option is set as appropriate. Automated 1 Pass 
 1.3.5 Ensure that the --root-ca-file option is set as appropriate. Automated 1 Pass 
 1.3.6 Ensure that the RotateKubeletServerCertificate option is set to true. Automated 2 Pass 
 1.3.7 Ensure that the --bind-address option is set to 127.0.0.1. Automated 1 Pass 







 1.4 Scheduler 



Section 1.4 Scheduler benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.4.1 Ensure that the healthz endpoints for the scheduler are protected by RBAC. Automated 1 Pass 
 1.4.2 Verify that the scheduler API service is protected by authentication and authorization. Automated 1 Pass 









 2 etcd 



Section 2 etcd benchmark results

 Section Recommendation Manual/Automated Level Result 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Automated 1 Pass