Constructing flexibly-secure systems in a disaggregated environment

Patent metadata

Field	Value
Publication number	US-10901918-B2
Application number	US-201816204661-A
Country	US
Kind code	B2
Filing date	Nov 29, 2018
Priority date	Nov 29, 2018
Publication date	Jan 26, 2021
Grant date	Jan 26, 2021

Abstract

Server resources in a data center are disaggregated into shared server resource pools, which include a pool of secure processors. Advantageously, servers are constructed dynamically, on-demand and based on a tenant's workload requirements, by allocating from these resource pools. According to this disclosure, secure processor modules for new servers are allocated to provide security for data-in-use (and data-at-rest) in a dynamic fashion so that virtual and non-virtual capacity can be adjusted in the disaggregate compute system without any downtime, e.g., based on workload security requirements and data sensitivity characteristics. The approach herein optimizes an overall utilization of an available secure processors resource pool in the disaggregated environment. The resulting disaggregate compute system that is configured according to the approach cryptographically-protects workload data whenever it is outside the CPU chip.

First claim

The invention claimed is:

1. A method to protect information in a disaggregated computing environment, the disaggregated computing environment comprising a set of server resource pools including a secure processor pool, comprising
responsive to a workload request having a security requirement, instantiating, in real-time, a server entity composed of resources drawn from the server resource pools, the server entity including a secure processor drawn from the secure processor pool, and a memory drawn from a memory pool, wherein the secure processor is selected for inclusion in the instantiated server entity based upon the secure processor being listed in a privileged table indicative of which processors in the disaggregated computing environment are maintained in the secure processor pool;
constructing a secure object to execute in the server entity;
associating cryptographic information with the server entity; and
using the cryptographic information, configuring the server entity such that the secure object is stored encrypted in the memory; wherein the secure object is in decrypted form only when the secure object is inside the secure processor during an execution of the secure object by the secure processor after retrieval from the memory.

2. The method as described in claim 1 wherein the cryptographic information comprises a key-pair uniquely associated with the secure processor.

3. The method as described in claim 2 wherein the key-pair comprises a private key, and an associated public key, wherein the secure object is constructed at least in part using the public key, and wherein the private key is used to decrypt to secure object into the decrypted form inside the secure processor.

4. The method as described in claim 1 wherein the secure object comprises one of: workload code, workload data, and a combination of workload code and data.

5. The method as described in claim 1 further including securely delivering the secure object to the memory of the server entity over a privileged network that is inaccessible external to the server entity.

6. The method as described in claim 1 further including adjusting a composition of the server entity as the workload is being processed.

7. The method as described in claim 6 further including de-associating the memory in which the secure object is stored encrypted from the secure processor, suspending execution of the workload, and re-associating the memory to a second secure processor.

8. The method as described in claim 7 further including resuming execution of the workload in the second secure processor.

9. A system to protect information in a disaggregated computing environment, the disaggregated computing environment comprising a set of server resource pools including a secure processor pool, comprising:
one or more hardware processors;
computer memory holding computer program instructions executed by the hardware processors and operative to:
respond to a workload request having a security requirement to instantiate, in real-time, a server entity composed of resources drawn from the server resource pools, the server entity including a secure processor drawn from the secure processor pool, and a memory drawn from a memory pool, wherein the secure processor is selected for inclusion in the instantiated server entity based upon the secure processor being listed in a privileged table indicative of which processors in the disaggregated computing environment are maintained in the secure processor pool;
construct a secure object to execute in the server entity;
associate cryptographic information with the server entity; and
use the cryptographic information to configure the server entity such that the secure object is stored encrypted in the memory; wherein the secure object is in decrypted form only when the secure object is inside the secure processor during an execution of the secure object by the secure processor after retrieval from the memory.

10. The system as described in claim 9 wherein the cryptographic information comprises a key-pair uniquely associated with the secure processor.

11. The system as described in claim 10 wherein the key-pair comprises a private key, and an associated public key, wherein the secure object is constructed at least in part using the public key, and wherein the private key is used to decrypt to secure object into the decrypted form inside the secure processor.

12. The system as described in claim 9 wherein the secure object comprises one of: workload code, workload data, and a combination of workload code and data.

13. The system as described in claim 9 wherein the computer program instructions are further operative to securely deliver the secure object to the memory of the server entity, the secure object being delivered over a privileged network that is inaccessible external to the server entity.

14. The system as described in claim 9 wherein the computer program instructions are further operative to adjust a composition of the server entity as the workload is being processed.

15. The system as described in claim 14 wherein the computer program instructions are further operative to de-associate the memory in which the secure object is stored encrypted from the secure processor, suspend execution of the workload, and re-associate the memory to a second secure processor.

16. The system as described in claim 15 wherein the computer program instructions are further operative to resume execution of the workload in the second secure processor.

17. A computer program product in a non-transitory computer readable medium for use in a data processing system to protect information in a disaggregated computing environment, the disaggregated computing environment comprising a set of server resource pools including a secure processor pool, the computer program product holding computer program instructions executed in the data processing system and operative to:
respond to a workload request having a security requirement to instantiate, in real-time, a server entity composed of resources drawn from the server resource pools, the server entity including a secure processor drawn from the secure processor pool, and a memory drawn from a memory pool, wherein the secure processor is selected for inclusion in the instantiated server entity based upon the secure processor being listed in a privileged table indicative of which processors in the disaggregated computing environment are maintained in the secure processor pool;
construct a secure object to execute in the server entity;
associate cryptographic information with the server entity; and
use the cryptographic information to configure the server entity such that the secure object is stored encrypted in the memory; wherein the secure object is in decrypted form only when the secure object is inside the secure processor during an execution of the secure object by the secure processor after retrieval from the memory.

18. The computer program product as described in claim 17 wherein the cryptographic information comprises a key-pair uniquely associated with the secure processor.

19. The computer program product as described in claim 18 wherein the key-pair comprises a private key, and an associated public key, wherein the secure object is constructed at least in part using the public key, and wherein the private key is used to decrypt to secure object into the decrypted form inside the secure processor.

20. The computer program product as described in claim 15 wherein the secure object com

Assignees

• IBM

Inventors

• Ramasamy Harigovind V
• Schenfeld Eugen
• Salapura Valentina
• Bivens John A
• Ruan Yaoping
• Li Min
• Kundu Ashish
• Mahindru Ruchi
• Boivie Richard H

Classifications

• H04L9/0894 Primary

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• G06F12/1408 Primary

  by using cryptography (for digital transmission H04L9/00) · CPC title

• H04L67/1012

  based on compliance of requirements or conditions with available server resources · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title