Security within a software-defined infrastructure

Patent metadata

Field	Value
Publication number	US-10546121-B2
Application number	US-201816015766-A
Country	US
Kind code	B2
Filing date	Jun 22, 2018
Priority date	Mar 25, 2015
Publication date	Jan 28, 2020
Grant date	Jan 28, 2020

Abstract

There is a computer program product and computer system that includes program instructions programmed to establish a security container describing a workload and a set of resources in a software-defined environment, the security container including a set of sub-containers that are self-describing sub-containers having associated metadata describing content of a respectively corresponding sub-container, each sub-container of the set of sub-containers respectively corresponds to a resource-divisible portion of the workload, the set of resources being required by the workload, wherein a sub-container of the set of sub-containers is an operating system sub-container; monitor the workload and the set of resources for security events; and responsive to identifying a security event, adjust isolation mechanisms provided by the plurality of sub-containers at various layers of a stack. The set of sub-containers represents an end-to-end run time environment for processing the workload using the set of resources.

First claim

What is claimed is:

1. A computer program product comprising a computer readable storage medium having stored thereon program instructions programmed to:
establish a security container describing a workload and a set of resources in a software-defined environment, the security container including a set of sub-containers that are self-describing sub-containers having associated metadata describing content of a respectively corresponding sub-container, each sub-container of the set of sub-containers respectively corresponds to a resource-divisible portion of the workload, the set of resources being required by the workload, wherein a sub-container of the set of sub-containers is an operating system sub-container;
monitor the workload and the set of resources for security events; and
responsive to identifying a security event, adjust isolation mechanisms provided by the plurality of sub-containers at various layers of a stack;
wherein:
the set of sub-containers represents an end-to-end run time environment for processing the workload using the set of resources.

2. The computer program product of claim 1 , the program instructions further programmed to:
determine a set of security criteria for the security container; and
wherein:
monitoring for security events is based on the set of security criteria.

3. The computer program product of claim 1 , wherein adjusting isolation mechanisms includes at least one of:
inserting an isolation mechanism; and
removing an isolation mechanism.

4. The computer program product of claim 1 , the program instructions further programmed to:
determine a set of resource-divisible portions of the workload including a compute-resource portion, a storage resource portion, and a network resource portion.

5. The computer program product of claim 4 , the program instructions further programmed to:
generate the set of sub-containers, each sub-container representing a unique resource-divisible portion of the workload.

6. The computer program product of claim 1 , wherein the end-to-end run time environment includes bare metal sub-containers and hypervisor-specific sub-containers.

7. The computer program product of claim 1 , wherein monitoring the workload and the set of resources for security events includes deep introspection, condition-based monitoring, and/or applying a behavior model to a resource within the set of resources.

8. A computer system comprising:
a processor(s) set; and
a computer readable storage medium;
wherein:
the processor set is structured, located, connected, and/or programmed to run program instructions stored on the computer readable storage medium; and
the program instructions include program instructions programmed to:
establish a security container describing a workload and a set of resources in a software-defined environment, the security container including a set of sub-containers that are self-describing sub-containers having associated metadata describing content of a respectively corresponding sub-container, each sub-container of the set of sub-containers respectively corresponds to a resource-divisible portion of the workload, the set of resources being required by the workload, wherein a sub-container of the set of sub-containers is an operating system sub-container;
monitor the workload and the set of resources for security events; and
responsive to identifying a security event, adjust isolation mechanisms provided by the plurality of sub-containers at various layers of a stack;
wherein:
the set of sub-containers represents an end-to-end run time environment for processing the workload using the set of resources.

9. The computer system of claim 8 , the program instructions further programmed to:
determine a set of security criteria for the security container; and
wherein:
monitoring for security events is based on the set of security criteria.

10. The computer system of claim 8 , wherein adjusting isolation mechanisms includes at least one of:
inserting an isolation mechanism; and
removing an isolation mechanism.

11. The computer system of claim 8 , the program instructions further programmed to:
determine a set of resource-divisible portions of the workload including a compute-resource portion, a storage resource portion, and a network resource portion.

12. The computer system of claim 11 , the program instructions further programmed to:
generate the set of sub-containers, each sub-container representing a unique resource-divisible portion of the workload.

13. The computer system of claim 8 , wherein the end-to-end run time environment includes bare metal sub-containers and hypervisor-specific sub-containers.

14. The computer system of claim 8 , wherein monitoring the workload and the set of resources for security events includes deep introspection, condition-based monitoring, and/or applying a behavior model to a resource within the set of resources.

Assignees

• IBM

Inventors

• Brech Brad L
• Crowder Scott W
• Franke Hubertus
• Halim Nagui
• Hogstrom Matt R
• Li Chung-Sheng
• Pattnaik Pratap C
• Pendarakis Dimitrios
• Rao Josyula R
• Ratnaparkhi Radha P
• Williams Michael D

Classifications

• G06F9/5083

  Techniques for rebalancing the load in a distributed system · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title