# IBM LinuxONE integration

The IBM LinuxONE Ripple Custody implementation uses:

- **IBM LinuxONE**: A dedicated computing server with an integrated HSM
- **CryptoExpress 6S (CEX6S)**: The cryptographic hardware module


The current HSM is **FIPS 140-2 Level 4** certified. The HSM fully supports **BIP32** and **SLIP-10** derivation schemes.

s390x support
Starting in version 1.34, Ripple Custody supports s390x (IBM) architecture for secure components only (the notary and vault). Non-secure components are not supported on s390x architecture.

For IBM LinuxONE deployments, contact your Ripple liaison for assistance with onboarding and configuration.

## Architecture

The notary and vault are securely deployed to HPVS (Hyper Protect Virtual Server) instances on IBM LinuxONE. Deploy the core platform and other non-secure Ripple Custody components outside the s390x secure-component environment.

With IBM LinuxONE, you are fully in control of your own data and keys. You can deploy the notary and one or multiple vaults to several logical partitions of LinuxONE. You can implement both connected hot vaults and disconnected cold vaults.

## Key generation

Initialize the HSM with a trusted key entry (TKE) ceremony.

For more information, see What is TKE?

The standard key generation process is as follows:

1. On configuration of the vault to use the HSM, the vault requests the HSM to securely generate a seed.
2. The HSM generates the seed, encrypts the seed, and returns the encrypted seed to the vault. You can store the encrypted seed in a location of your choice, since it's not readable outside the HSM.
3. On creation of a new account, the HSM securely generates account keys through a deterministic derivation from the seed, using the SLIP-10 algorithm.


You can also request generation of account keys in a completely random manner, with no seed. We do not recommend this approach.

For more information, see [Key derivation](/products/custody/v1.34/concepts/key-derivation).

## Database backups

We highly recommend that you synchronously replicate the database backup right from the beginning, as the database is the source of truth.

## Key rotation

For information on reasons and procedures for wrapping key rotation with IBM HSM vaults, see [IBM HSM wrapping key rotation](/products/custody/v1.34/system-management/vault-key-rotation-ibm-hsm).

## Next steps

1. **Complete installation**: Continue with [Installation and initialization](/products/custody/v1.34/deployment/install/installation).
2. **Configure blockchain indexers**: Set up blockchain connections.
3. **Review [Production best practices](/products/custody/v1.34/how-to/integrate-kms/production-best-practices)** for namespace segmentation, HA patterns, and monitoring