Figure 3-2 SSC bootloader overview diagram 1. Firmware bootloader is loaded in memory. 2. Firmware loads the software bootloader from disk. a. Checks integrity of software bootloader. b. Decrypts software bootloader. 3. Software bootloader activates encrypted disks. a. Key stored in software bootloader (encrypted). b. Encryption/decryption done on the fly when it accesses appliance code and data. 4. Appliance designed to be managed by remote APIs only. a. REST APIs to configure Linux and apps. b. No ssh (allowed only in dev mode). 3.2.2 Download the image To install SSC blockchain appliance, download the official packages from the IBM Passport  Advantage site  https://www.ibm.com/software/passportadvantage/pao_customer.html .  Follow steps below to get access to the SSC images: 1. Log in to IBM Passport Advantage by using your IBM ID and password. Contact your sales  representative if you do not have one. 2. Go to My Programs, and then select the IBM Secure Service Container for IBM Cloud  Private program. 3. Download the Secure Service Container for IBM Cloud Private image to your x86 or Linux  on Z server. 4. Create an installation directory to store the Secure Service Container for IBM Cloud  Private image and configuration files. For example: mkdir /opt/< installation-directory >/cluster/images 5. Change to the installation directory, and extract the compressed file on the x86 server. cd /opt/< installation-directory >/cluster/images tar -zxvf CNYC7EN.tar.gz 6. After decompressing the file, you should have the following files. a. secure-service-container-for-icp_x86.tar.gz , which supports master node on  an x86 server. b. secure-service-container-for-icp_s390x.tar.gz ,  which supports master node  on a Linux on Z server. Chapter 3. Secure Service Container installation and configuration  71