METHODS AND APPARATUS FOR ENHANCING BUSINESS SERVICES RESILIENCY USING CONTINUOUS FRAGMENTATION CELL TECHNOLOGY

• US 20150229671A1
• Filed: 02/08/2014
• Published: 08/13/2015
• Est. Priority Date: 02/08/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Boss, Gregory J., Drissi, Youssef, Hamilton, Rick A. II, Li, Chung-Sheng
• Granted Patent: US 9,621,586 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A method for enhancing resiliency of a service includes: decomposing at least one component associated with the service into a plurality of corresponding smaller elements; encrypting the elements to generate a corresponding plurality of encrypted elements; decomposing each of the encrypted elements into a corresponding plurality of smaller fragments; replicating each of the fragments; encapsulating the fragments into respective intelligent components, each of the intelligent components corresponding to a given one of the encapsulated fragments, each of the intelligent components being configured to independently determine a location of a first storage element in which to store itself; storing each of the intelligent components; and moving the intelligent components from the first storage element location to a second storage element location.

Claims

1. A method for enhancing resiliency of a service, the method comprising:

decomposing at least one component associated with the service into a plurality of corresponding smaller elements;

encrypting the plurality of elements to generate a corresponding plurality of encrypted elements;

decomposing each of the plurality of encrypted elements into a corresponding plurality of smaller fragments;

replicating each of the plurality of fragments;

encapsulating the plurality of fragments into respective intelligent components, each of the intelligent components corresponding to a given one of the encapsulated fragments, each of the intelligent components being configured to independently determine a location of a first storage element in which to store itself;

storing each of the intelligent components; and

moving the intelligent components from the first storage element location to a second storage element location.

2. The method of claim 1, wherein at least a subset of the intelligent components are continuously moved from the first storage element location to the second storage element location.

3. The method of claim 1, wherein moving the intelligent components from the first storage element location to the second storage element location occurs when a threat is not detected.

4. The method of claim 1, further comprising independently deciding to move the intelligent components from the first storage element location to the second storage element location via an independent decision-making process.

5. The method of claim 4, wherein the independent decision-making process avoids external intervention.

6. The method of claim 1, wherein moving the intelligent components from the first storage element location to the second storage element location further comprises:

replicating the intelligent components prior to moving when a threat is detected, and

moving away from a location of the threat in a random pattern.

7. The method of claim 1, further comprising communicating securely between the plurality of intelligent components.

8. The method of claim 1, wherein the encryption is unique for each of the plurality of intelligent components.

9. The method of claim 1, further comprising extracting one or more sets of bytes from each of the encrypted elements.

10. The method of claim 1, further comprising reporting the location the intelligent components to a network of virtual hubs.

11. The method of claim 1, further comprising requesting a service that uses the intelligent components.

12. The method of claim 11, wherein a request for the service is received and processed by a virtual hub, the method further comprising, for each of the intelligent components, responding to a secure call from the virtual hub after the request is received and processed.

13. The method of claim 12, further comprising retrieving at least one of the intelligent components to perform the service.

14. The method of claim 13, further comprising combining at least a subset of the intelligent components to assemble the at least one component associated with the service.

15. The method of claim 14, further comprising deconstructing the assembled component after the service request is fulfilled.

16. The method of claim 1, wherein each of the intelligent components is independently operative to perform at least one of decision-making, replication, data encryption, distribution and secure communications.

17. The method of claim 1, further comprising providing a system, wherein the system comprises distinct software modules, each of the distinct software modules being embodied on a computer-readable storage medium, and wherein the distinct software modules comprise an intelligent component module and a decomposition module;

wherein;

said encapsulating the plurality of fragments into respective intelligent components is performed by said intelligent component module executing on at least one hardware processor; and

said decomposing at least one component associated with the service into a plurality of corresponding smaller elements and said decomposing each of the plurality of encrypted elements into a corresponding plurality of smaller fragments are carried out by said decomposition module executing on the at least one hardware processor.

18. An apparatus, comprising:

a memory; and

at least one processor coupled with the memory and operative;

to decompose at least one component associated with a service into a plurality of elements;

to encrypt the plurality of elements to generate a corresponding plurality of encrypted elements;

to decompose each of the plurality of encrypted elements into a corresponding plurality of smaller fragments;

to replicate each of the plurality of fragments;

to encapsulate the plurality of fragments into respective intelligent components, each of the intelligent components corresponding to a given one of the encapsulated fragments;

to independently determine a location of a first storage element for each of the intelligent components;

to store each of the intelligent components; and

to move the intelligent components from the first storage element location to a second storage element location.

19. The apparatus of claim 18, further comprising a plurality of distinct software modules, each of the distinct software modules being embodied on a computer-readable storage medium, and wherein the distinct software modules comprise an intelligent component module and a decomposition module, wherein encapsulating the plurality of fragments into respective intelligent components is performed by the intelligent component module executing on the at least one processor.

20. A computer program product comprising a non-transitory machine-readable storage medium having machine-readable program code embodied therewith, said machine-readable program code comprising:

machine-readable program code configured;

to decompose at least one component associated with a service into a plurality of elements;

to encrypt the plurality of elements to generate a corresponding plurality of encrypted elements;

to decompose each of the plurality of encrypted elements into a corresponding plurality of smaller fragments;

to replicate each of the plurality of fragments;

to encapsulate the plurality of fragments into respective intelligent components, each of the intelligent components corresponding to a given one of the encapsulated fragments;

to independently determine a location of a first storage element for each of the intelligent components;

to store each of the intelligent components; and

to move the intelligent components from the first storage element location to a second storage element location.