Scaling a trusted computing model in a globally distributed cloud environment

Patent metadata

Field	Value
Publication number	US-9401954-B2
Application number	US-201314073234-A
Country	US
Kind code	B2
Filing date	Nov 6, 2013
Priority date	Nov 6, 2013
Publication date	Jul 26, 2016
Grant date	Jul 26, 2016

Abstract

A distributed cloud environment system comprising: a repository; a plurality of cloud managed nodes with a client program interface; a plurality of service management components with a service management component interface; a central trusted computing platform service in communication with the repository, the plurality of cloud managed nodes and the plurality of service management components, comprising: a first interface for communication with the client program interface in each of the plurality of cloud managed nodes through a first single touch point; and a second interface for communication with the service management component interface for the plurality of service management components through a second single touch point. The central trusted computing platform service manages interaction of the plurality of service management components with the plurality of cloud managed nodes, and the interaction of the plurality of cloud managed nodes with the repository.

First claim

What is claimed is:

1. A distributed cloud environment system comprising:
a repository comprising data; a plurality of cloud managed nodes comprising a client program which receives and ends measurement data to the repository and a client program interface;
a plurality of service management components comprising functions for managing service of the plurality of cloud managed nodes and a service management component interface; and
a central trusted computing platform service in communication with the repository, the plurality of cloud managed nodes and the plurality of service management components, comprising:
a first interface for communication with the client program interface in each of the plurality of cloud managed nodes through a first single touch point; and
a second interface for communication with the service management component interface for the plurality of service management components through a second single touch point;
wherein the central trusted computing platform service manages interaction of the plurality of service management components with the plurality of cloud managed nodes, and the interaction of the plurality of cloud managed nodes with the repository;
wherein an interaction managed by the central trusted computing platform is registration of the client program of the plurality of cloud managed nodes and the plurality of service management components by the steps of:
the central trusted computing platform service sending a command to the client program interface and the service management component interface to register the plurality of cloud managed nodes and the plurality of service management components;
the central trusted computing platform service receiving data including at least a location, measurement data, and system data from the cloud managed nodes and the service management components;
the central trusted computing platform service authenticating the data received from the plurality of cloud managed nodes and the data of the plurality of service management components by searching in the repository;
if the data is authenticated, the central trusted computing platform service comparing the location data to the data in the repository to match the location of the plurality of cloud managed nodes and the plurality of service management components; and
if the location matches, the central trusted computing platform registering the plurality of cloud managed nodes and the plurality of service management components as trusted and storing the data received from the plurality of cloud managed nodes and the plurality of service management components in the repository.

2. The system of claim 1 , further comprising an attestation service in communication with the central trusted computing platform service and the repository.

3. The system of claim 1 , wherein the plurality of service management components are selected from a group consisting of a ticketing system, a patch management system, an asset management system, a workflow system and a provisioning system.

4. The system of claim 1 , wherein the central trusted computing platform service further comprises:
a security layer comprising at least one of an authentication component, an authorization component, an audit component, and a public-key infrastructure component;
an interface layer comprising at least one of a protocol switch component, a delegation interface component, mediation component, and an user registry component; and
a service layer comprising at least one of a first interface service implementation component, a second interface service implementation component, and a repository and analytics component.

Assignees

• IBM

Inventors

• Jagana Venkata R
• Mangipudi Srinivasa R
• Readshaw Neil I
• Sivakumar Karthik

Classifications

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• H04L41/5096

  wherein the managed service relates to distributed or central networked applications · CPC title

• H04L67/10 Primary

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title