Methods and apparatus for enhancing business services resiliency using continuous fragmentation cell technology

• US 9,621,586 B2
• Filed: 02/08/2014
• Issued: 04/11/2017
• Est. Priority Date: 02/08/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Boss, Gregory J., Drissi, Youssef, Hamilton, II, Rick A., Li, Chung-Sheng
• Primary Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US14/176,079
• Publication Number:
  US 20150229671A1
• Time in Patent Office: 1,158 Days
• Field of Search: 726 26, 726 1, 726 24, 726 25, 370328, 370392
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A method for enhancing resiliency of a service includes: decomposing at least one component associated with the service into a plurality of corresponding smaller elements; encrypting the elements to generate a corresponding plurality of encrypted elements; decomposing each of the encrypted elements into a corresponding plurality of smaller fragments; replicating each of the fragments; encapsulating the fragments into respective intelligent components, each of the intelligent components corresponding to a given one of the encapsulated fragments, each of the intelligent components being configured to independently determine a location of a first storage element in which to store itself; storing each of the intelligent components; and moving the intelligent components from the first storage element location to a second storage element location.

Claims

1. A method for enhancing resiliency of a service, the method comprising:

decomposing, by a decomposition module executing on at least one hardware processor, at least one component associated with the service into a plurality of corresponding smaller elements;

encrypting, by an encryption module executing on the at least one hardware processor, the plurality of elements to generate a corresponding plurality of encrypted elements;

decomposing each of the plurality of encrypted elements into a corresponding plurality of smaller fragments, the plurality of fragments comprising subsets of bits of bytes from the encrypted elements;

encapsulating, by an encapsulation module executing on the at least one hardware processor, the plurality of fragments into respective intelligent components, each of the intelligent components corresponding to a given one of the encapsulated fragments and forming a continuous fragmentation cell;

distributing the intelligent components to a plurality of storage element locations; and

moving the intelligent components independently within the plurality of storage element locations, wherein each intelligent component independently determines a given storage element location into which that intelligent component should be moved next, and wherein the intelligent components do not have a predetermined destination.

2. The method of claim 1, wherein at least a subset of the intelligent components are continuously moved within the plurality of storage element locations.

3. The method of claim 1, wherein moving the intelligent components occurs when a threat is not detected.

4. The method of claim 1, further comprising independently deciding to move the intelligent components from a first storage element location to a second storage element location via an independent decision-making process.

5. The method of claim 4, wherein the independent decision-making process avoids external intervention.

6. The method of claim 1, wherein moving the intelligent components further comprises:

replicating the intelligent components prior to moving when a threat is detected, and

moving away from a location of the threat in a random pattern.

7. The method of claim 1, further comprising communicating securely between the plurality of intelligent components.

8. The method of claim 1, wherein the encryption is unique for each of the plurality of intelligent components.

9. The method of claim 1, further comprising replicating the intelligent components for redundancy.

10. The method of claim 1, further comprising reporting the location of the intelligent components to a network of virtual hubs.

11. The method of claim 1, further comprising requesting a service that uses the intelligent components.

12. The method of claim 11, wherein a request for the service is received and processed by a virtual hub, the method further comprising, for each of the intelligent components, responding to a secure call from the virtual hub after the request is received and processed.

13. The method of claim 12, further comprising retrieving at least one of the intelligent components to perform the service.

14. The method of claim 13, further comprising combining at least a subset of the intelligent components to assemble the at least one component associated with the service.

15. The method of claim 14, further comprising deconstructing the assembled component after the service request is fulfilled.

16. The method of claim 1, wherein each of the intelligent components is independently operative to perform at least one of decision-making, replication, data encryption, distribution and secure communications.

17. The method of claim 1, wherein:

said encapsulating the plurality of fragments into respective intelligent components is performed by an intelligent component module executing on the at least one hardware processor; and

said decomposing each of the plurality of encrypted elements into a corresponding plurality of smaller fragments is carried out by said decomposition module executing on the at least one hardware processor.

18. An apparatus, comprising:

a memory; and

at least one processor coupled with the memory and operative;

to decompose at least one component associated with a service into a plurality of elements;

to encrypt the plurality of elements to generate a corresponding plurality of encrypted elements;

to decompose each of the plurality of encrypted elements into a corresponding plurality of smaller fragments, the plurality of fragments comprising subsets of bits of bytes from the encrypted elements;

to encapsulate the plurality of fragments into respective intelligent components, each of the intelligent components corresponding to a given one of the encapsulated fragments and forming a continuous fragmentation cell;

to distribute the intelligent components to a plurality of storage element locations; and

to move the intelligent components independently within the plurality of storage element locations, wherein each intelligent component independently determines a given storage element location into which that intelligent component should be moved next, and wherein the intelligent components do not have a predetermined destination.

19. The apparatus of claim 18, further comprising a plurality of distinct software modules, each of the distinct software modules being embodied on a computer-readable storage medium, and wherein the distinct software modules comprise an intelligent component module and a decomposition module, wherein encapsulating the plurality of fragments into respective intelligent components is performed by the intelligent component module executing on the at least one processor.

20. A computer program product comprising a non-transitory machine-readable storage medium having machine-readable program code embodied therewith, said machine-readable program code comprising:

machine-readable program code configured;

to decompose at least one component associated with a service into a plurality of elements;

to encrypt the plurality of elements to generate a corresponding plurality of encrypted elements;

to decompose each of the plurality of encrypted elements into a corresponding plurality of smaller fragments, the plurality of fragments comprising subsets of bits of bytes from the encrypted elements;

to encapsulate the plurality of fragments into respective intelligent components, each of the intelligent components corresponding to a given one of the encapsulated fragments and forming a continuous fragmentation cell;

to distribute the intelligent components to a plurality of storage element locations; and

to move the intelligent components independently within the plurality of storage element locations, wherein each intelligent component independently determines a given storage element location into which that intelligent component should be moved next, and wherein the intelligent components do not have a predetermined destination.