19.06.2013 Views

DB2 UDB for z/OS Version 8 Performance Topics - IBM Redbooks

DB2 UDB for z/OS Version 8 Performance Topics - IBM Redbooks

DB2 UDB for z/OS Version 8 Performance Topics - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

4.8.1 Per<strong>for</strong>mance<br />

4.8.2 Conclusion<br />

The following software is required to support clear keys<br />

► APAR PQ93943 and PQ94822 <strong>for</strong> the tool<br />

► ICSF SPE APAR OA08172 (availability TBD)<br />

► FMID HCR770A or HCR770B<br />

► <strong>OS</strong>/390 V2R10 or later<br />

The following hardware is also required to support “clear” keys<br />

► On z990, both CPACF and a PCIXCC card<br />

► Pre z990, cryptographic coprocessor<br />

While, secure keys require the following hardware:<br />

► On z990, a PCIXCC card<br />

► Pre z990, the cryptographic coprocessor<br />

The PCIXCC card is required to install ICSF, which in turn, manages the encryption keys.<br />

Studies on z990 have shown <strong>DB2</strong> encryption costs approximately 2.3 microseconds per<br />

column, plus 0.0086 microseconds per byte. While the Encryption Tool (clear key) costs<br />

roughly 1 microsecond per row, plus 0.006 microseconds per byte.<br />

So, to fetch 100k rows, encrypting two 32 byte columns using <strong>DB2</strong> encryption:<br />

<strong>DB2</strong> cost of encryption = 2x(2.3 + 32x0.0086)x100,000 = 520,000 microseconds<br />

To fetch 100k rows with row size of 204 bytes using the Encryption Tool, the additional CPU<br />

time is:<br />

Encryption Tool cost = (1+204x0.006)x100,000 = 220,000 microseconds<br />

For an equivalent number of bytes, we found it is faster to use <strong>DB2</strong> encryption to encrypt and<br />

decrypt the data, in situations where the number of columns to be encrypted is three or less.<br />

Otherwise, may be a better choice. The breakeven point varies depending on how many other<br />

columns are in the table and how big each column is, but generally the <strong>IBM</strong> Data Encryption<br />

Tool is a better choice than <strong>DB2</strong> column level encryption from the per<strong>for</strong>mance level point of<br />

view.<br />

The cost of encryption is reduced on the z990 hardware, compared with the older z900<br />

hardware. CPU time <strong>for</strong> the Encryption Tool is 10 times faster on a z990 versus the z900, and<br />

the elapsed time <strong>for</strong> multithreaded applications using encryption is much faster on z990<br />

versus z900 depending on the number of concurrent tasks. Similar observations are<br />

applicable to the z890 processor, which has the same level of relative per<strong>for</strong>mance as the<br />

z990.<br />

The CPU per<strong>for</strong>mance implications <strong>for</strong> encryption are similar to data compression. However<br />

the impact on encryption on CPU is likely to be slightly higher than compression.<br />

OLTP per<strong>for</strong>mance is less affected than query per<strong>for</strong>mance. The best query per<strong>for</strong>mance is<br />

achieved by designing good indexes to avoid “touching” many rows.<br />

190 <strong>DB2</strong> <strong>UDB</strong> <strong>for</strong> z/<strong>OS</strong> <strong>Version</strong> 8 Per<strong>for</strong>mance <strong>Topics</strong>

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!