Security within a software-defined infrastructure

• US 10,534,911 B2
• Filed: 06/22/2018
• Issued: 01/14/2020
• Est. Priority Date: 03/25/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Brech, Brad L., Crowder, Scott W., Franke, Hubertus, Halim, Nagui, Hogstrom, Matt R., Li, Chung-Sheng, Pattnaik, Pratap C., Pendarakis, Dimitrios, Rao, Josyula R., Ratnaparkhi, Radha P., Williams, Michael D.
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US16/015,619
• Publication Number:
  US 20180300478A1
• Time in Patent Office: 571 Days
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5083 Techniques for rebalancing the load in a distributed system

Abstract

There is a computer program product and computer system that includes program instructions programmed to identify, in a software-defined environment, a security container describing a workload and a set of resources required by the workload, the security container including self-describing sub-containers having associated metadata describing content of a respectively corresponding sub-container; determine, for the workload, a set of resource-divisible portions of the workload including a compute-resource portion; generate a plurality of sub-containers within the security container, a sub-container within the plurality of sub-containers being a self-describing sub-container having associated metadata describing the content of the sub-container representing only one resource-divisible portion, the sub-container being an operating system sub-container; and responsive to identifying a security event while processing the workload, adjust a security mechanism associated with the security container. The plurality of sub-containers represents an end-to-end run time environment for processing the workload.

Claims

1. A computer program product comprising a computer readable storage medium having stored thereon program instructions programmed to:

identify, in a software-defined environment, a security container describing a workload and a set of resources required by the workload, the security container including self-describing sub-containers having associated metadata describing content of a respectively corresponding sub-container;

determine, for the workload, a set of resource-divisible portions of the workload including a compute-resource portion;

generate a plurality of sub-containers within the security container, a sub-container within the plurality of sub-containers being a self-describing sub-container having associated metadata describing the content of the sub-container representing only one resource-divisible portion, the sub-container being an operating system sub-container; and

responsive to identifying a security event while processing the workload, adjust a security mechanism associated with the security container;

wherein;

the plurality of sub-containers represents an end-to-end run time environment for processing the workload.

2. The computer program product of claim 1, wherein the end-to-end run time environment includes bare metal sub-containers and hypervisor-specific sub-containers.

3. The computer program product of claim 1, wherein the set of resources are software abstractions.

4. The computer program product of claim 1, wherein the set of resource-divisible portions includes a storage resource portion and a network resource portion.

5. The computer program product of claim 1, further comprising:

determining a set of security criteria for the security container.

6. The computer program product of claim 5, further comprising:

monitoring the workload and the set of resources for security events that occur while processing the workload; and

wherein the security events are based on the set of security criteria.

7. The computer program product of claim 6, wherein monitoring the workload includes applying a behavior model to a resource within the set of resources.

8. The computer program product of claim 1, wherein the security mechanism is an isolation mechanism provided by the plurality of sub-containers at various layers of a stack.

9. The computer program product of claim 1, wherein adjusting the security mechanism includes inserting an additional security mechanism.

10. The computer program product of claim 1, wherein the set of resources includes:

a compute resource, a storage resource, a network resource, and a user resource.

11. The computer program product of claim 1, wherein the set of resource-divisible portions of the workload further includes a storage-resource portion of the workload.

12. A computer system comprising:

a processor(s) set; and

a computer readable storage medium;

wherein;

the processor set is structured, located, connected, and/or programmed to run program instructions stored on the computer readable storage medium; and

the program instructions include program instructions programmed to;

identify, in a software-defined environment, a security container describing a workload and a set of resources required by the workload, the security container including self-describing sub-containers having associated metadata describing content of a respectively corresponding sub-container;

determine, for the workload, a set of resource-divisible portions of the workload including a compute-resource portion;

generate a plurality of sub-containers within the security container, a sub-container within the plurality of sub-containers being a self-describing sub-container having associated metadata describing the content of the sub-container representing only one resource-divisible portion, the sub-container being an operating system sub-container; and

responsive to identifying a security event while processing the workload, adjust a security mechanism associated with the security container;

wherein;

the plurality of sub-containers represents an end-to-end run time environment for processing the workload.

13. The computer system of claim 12, wherein the end-to-end run time environment includes bare metal sub-containers and hypervisor-specific sub-containers.

14. The computer system of claim 12, wherein the set of resources are software abstractions.

15. The computer system of claim 12, wherein the set of resource-divisible portions includes a storage resource portion and a network resource portion.

16. The computer system of claim 12, further comprising:

determining a set of security criteria for the security container.

17. The computer system of claim 16, further comprising:

monitoring the workload and the set of resources for security events that occur while processing the workload; and

wherein the security events are based on the set of security criteria.

18. The computer system of claim 17, wherein monitoring the workload includes applying a behavior model to a resource within the set of resources.

19. The computer system of claim 12, wherein the security mechanism is an isolation mechanism provided by the plurality of sub-containers at various layers of a stack.

20. The computer system of claim 12, wherein adjusting the security mechanism includes inserting an additional security mechanism.