Secure Computing Resource Allocation Using Homomorphic Encryption

Abstract

Secure computing resource deployment is facilitated within the computing environment by receiving a request to deploy computing resources in the computing environment and obtaining a homomorphically encrypted data set. The homomorphically encrypted data set includes configuration-related data for a desired configuration of computing resources to be deployed in the computing environment. The process further includes using the homomorphically encrypted data set in a configuration for deployment of the computing resources, where the computing resources are configured for deployment in the desired configuration without decrypting the homomorphically encrypted data set.

Description

[Background technology]

[0001] Cloud computing refers to a group of network elements that provide services such as data storage and computing power on demand without directed active management by the consumer or user. Cloud computing relies on the sharing of resources to achieve coherence and economies of scale.

[0002] Cloud computing can be provided as a service over the Internet in the form of "Infrastructure as a Service" (IaaS), "Platform as a Service" (PaaS), or "Software as a Service" (SaaS), or a combination thereof. Platform as a Service (PaaS) providers enable consumers to deploy consumer resources created using programming languages, libraries, services, and tools supported by the PaaS provider onto the PaaS cloud infrastructure. Consumers have control over the deployed applications, although they do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage. Platform as a Service (PaaS) providers offer a computing platform that typically includes an operating system, programming language execution environment, database, and web server. Consumers or users develop and run software on the cloud platform rather than acquiring and maintaining the underlying hardware and software layers. Summary of the Invention

[0003] Certain shortcomings of the prior art are overcome and further advantages are provided through the provision of a computer program product in one or more aspects for facilitating secure computing resource deployment. The computer program product includes a computer-readable storage medium having program instructions embodied therein. The program instructions are readable by one or more processors to cause the one or more processors to receive a request to deploy a computing resource in a computing environment and to obtain a homomorphically encrypted data set. The homomorphically encrypted data set includes configuration-related data for a desired configuration of the computing resources to be deployed in the computing environment. The program instructions further cause the one or more processors to use the homomorphically encrypted data set in a configuration for the deployment of the computing resources, where the computing resources are configured for deployment in the desired configuration without decrypting the homomorphically encrypted data set.

[0004] Computer systems and computer-implemented methods related to one or more aspects are also described and claimed herein. Additionally, services related to one or more aspects may also be described and claimed herein.

[0005] Additional features are realized through the techniques described herein. Other embodiments and aspects are described in detail herein and are considered a part of the claimed aspects.

[0006] One or more aspects of the present invention are particularly pointed out and distinctly claimed as examples in the claims at the conclusion of this specification. The above discussion, as well as objects, features, and advantages of one or more aspects of the present invention, will become apparent from the following detailed description read in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0007] [Figure 1] 1 is a block diagram of one embodiment of a data processing system capable of implementing processing in accordance with one or more aspects of the present invention. [Figure 2] FIG. 1 is a diagram of a computing environment in which various aspects of an embodiment of the present invention may be implemented in accordance with one or more aspects of the present invention. [Figure 3] FIG. 1 is a diagram of one embodiment of a process for facilitating secure computing resource placement within a computing environment in accordance with one or more aspects of the present invention. [Figure 4] FIG. 1 is a diagram of one embodiment of a homomorphic encryption process that may be used in one or more embodiments of a secure computing resource allocation process according to one or more aspects of the present invention. [Figure 5] FIG. 1 is a diagram of a computing environment and process flow for implementing one or more aspects of an embodiment of the present invention. [Figure 6] FIG. 1 is a diagram of one process embodiment of secure computing resource deployment in accordance with one or more aspects of the present invention. [Figure 7] FIG. 10 is a diagram of a sample configuration data set that is homomorphically encrypted and digitally signed and used by a computing environment in configuring a setting for computing resource placement in accordance with one or more aspects of the present invention. [Figure 8] FIG. 1 is a diagram of one embodiment of a cloud computing environment that can facilitate the implementation of, or be used in connection with, certain aspects of an embodiment of the present invention. [Figure 9] FIG. 1 is a diagram of abstraction model layers according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0008] The accompanying drawings, in which like reference numbers refer to identical or functionally similar elements throughout the different views, and which are incorporated in and form a part of this specification, further illustrate the present invention and, together with the detailed description of the invention, serve to explain aspects of the present invention. In this regard, it should be noted that descriptions of well-known systems, devices, processing techniques, etc. have been omitted so as not to unnecessarily obscure the invention in detail. It should be understood, however, that the detailed description and the specific examples, while indicating aspects of the present invention, are given by way of illustration only and not by way of limitation. Various substitutions, modifications, additions, or other arrangements, or combinations thereof, within the spirit or scope of the underlying inventive concepts will be apparent to those skilled in the art from this disclosure. It should be further noted that numerous inventive aspects and features are disclosed herein and, unless inconsistent, each disclosed aspect or feature can be combined with any other disclosed aspect or feature as desired for particular embodiments of the concepts disclosed herein.

[0009] It should also be noted that the illustrative embodiments are described below using specific code, designs, architectures, protocols, layouts, schematics, or tools, by way of example only and not by way of limitation. Furthermore, the illustrative embodiments are described in certain instances using particular software, tools, or data processing environments, by way of example only, for clarity of explanation. The illustrative embodiments may be used in conjunction with other comparable or similarly intended structures, systems, applications, or architectures. One or more aspects of the illustrative embodiments may be implemented in hardware, software, or a combination thereof.

[0010] As will be understood by those skilled in the art, program code, as referred to herein, can include both software and hardware. For example, the program code in certain embodiments of the present invention may include fixed-function hardware, while other embodiments may utilize software-based implementations of the described functionality. Certain embodiments combine both types of program code. One example of program code, also referred to as one or more programs, is illustrated in FIG. 1 as computer-readable program instructions 134, as well as application program 130 and code for secure computing resource allocation 136, one or more of which may be stored in memory 106 of computer system 102. Further examples include program 146 and computer-readable program instructions 148 in data storage device 144 of FIG. 1.

[0011] With reference to the figures, and in particular to Figure 1, an exemplary diagram of a data processing environment is depicted in which one or more aspects of the illustrative embodiments may be implemented. Figure 1 is only an example and is not intended to assert or imply any limitation with respect to the environments in which different embodiments may be implemented. Particular implementations may make many modifications to the depicted environment based on the description below.

[0012] 1, as mentioned, this figure illustrates a block diagram of a data processing system in which one or more aspects of the present invention may be implemented. Data processing system 100 is an example of a computer, such as a server or other type of device, on which computer-usable program code or instructions that implement one or more processes for the illustrative embodiments may be located.

[0013] 1, data processing system 100 includes a computer system 102, which may take the form of, for example, a general-purpose computing device. Computer system 102 may include, but is not limited to, one or more processors or processing units 104 (e.g., central processing units (CPUs)), memory 106 (e.g., referred to as main memory or storage), and one or more input / output (I / O) interfaces 108, coupled together via one or more buses or other connections 110 or both.

[0014] Processor 104 includes multiple functional components used to execute instructions, including, for example, an instruction fetch component for fetching instructions to be executed, an instruction decode unit for decoding the fetched instructions and obtaining operands for the decoded instructions, an instruction execution component for executing the decoded instructions, a memory access component for accessing memory for instruction execution, if necessary, and a writeback component for providing results of executed instructions.

[0015] Bus 110 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include Industry Standard Architecture (ISA), Micro Channel Architecture (MCA), Enhanced ISA (EISA), Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI).

[0016] Memory 106 may include a cache 120, such as, for example, a shared cache that may be coupled to a local cache 122 of processor 104. Additionally, memory 106 may include one or more programs or applications 130, an operating system 132, and one or more computer-readable program instructions 134, as well as program code 136 for secure computing resource placement to facilitate secure placement of virtual machines (VMs) and / or containers within a secure enclave of a host computing environment, for example, as discussed herein. Additionally or alternatively, computer-readable program instructions 134 may be configured to perform one or more other functions of certain embodiments of the present invention.

[0017] Computer system 102 may also communicate with one or more external devices 140, one or more network interfaces 142, or one or more data storage devices 144, or a combination thereof, for example, via I / O interface 108. Exemplary external devices include a user terminal, a tape drive, a pointing device, a display, etc. Network interface 142 enables computer system 102 to communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet), or a combination thereof, to provide communication with other computing devices or systems.

[0018] The data storage device 144 may store one or more programs 146, one or more computer-readable program instructions 148, or data, or a combination thereof, etc. The computer-readable program instructions may be configured to perform the functions of one or more aspects of the present invention.

[0019] Computer system 102 may include and / or be coupled to removable / non-removable, volatile / non-volatile computer system storage media. For example, computer system 102 may include and / or be coupled to non-removable, non-volatile magnetic media (commonly referred to as "hard drives"), magnetic disk drives for reading from and writing to removable, non-volatile magnetic disks (e.g., "floppy disks"), and / or optical disk drives for reading from and writing to removable, non-volatile optical disks, such as CD-ROMs, DVD-ROMs, or other optical media. It should be understood that other hardware and / or software components may be used in conjunction with computer system 102. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive storage systems.

[0020] Computer system 102 may be operational with numerous other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof, suitable for use with computer system 102 include, but are not limited to, personal computer (PC) systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and cloud computing environments that include any of the above systems or devices, as well as others.

[0021] As noted, the depicted example in Figure 1 is not meant to imply architectural limitations. Further, as noted, data processing system 100 in Figure 1 may be, for example, a server, a workstation, a tablet computer, a laptop computer, or other computing device.

[0022] As mentioned, cloud computing may be offered as a service over the Internet, such as "Platform as a Service" (PaaS). In operation, a PaaS provider enables a user or consumer to deploy computing resources, such as virtual machines or containers, on the cloud infrastructure to run one or more user applications or workloads. In information technology computing environments, for example, an operator framework is typically provided that provides automation of the configuration of one or more computing resources to run user workloads and the underlying systems. Lifecycle management processes are typically part of the operator framework.

[0023] As a specific example, the IBM® System / z computing system offered by International Business Machines Corporation of Armonk, New York (USA) can handle many complex workloads in a highly secure manner. For example, using OpenShift® technology offered by Red Hat® of Raleigh, North Carolina (USA), IBM® System / z can provide dynamic placement of workloads in a cloud-based model. In one or more implementations, OpenShift® technology includes the OpenShift® container platform, which uses the CoreOS® operating system offered by Red Hat® under its auspices. The CoreOS® system is considered immutable and is an open-source, lightweight operating system based on the Linux® kernel. It is designed to provide infrastructure for clustered deployments while focusing on automation, ease of application development, security, reliability, and scalability. (Note: Linux® is a registered trademark of Linus Torvalds.) Managing such a complex computing environment is a challenging task and requires strict control. For example, any changes made to a highly secured environment should always be monitored and should be done in a controlled manner. OpenShift® technology provides an operator framework to make changes and / or automate setup in the OpenShift® cloud platform. Using operators based on the operator framework on a highly secured environment requires additional security measures, such as ensuring that the cloud operator cannot tamper with configuration settings provided by a user or consumer. For example, in one or more embodiments, one or more trusted entities can be provided to attest to the configuration settings or changes made.Additionally, the configuration process should be tamper-proof so that users can have confidence that their computing resources (e.g., VMs or containers) are securely deployed to operate as desired.

[0024] 2 illustrates one embodiment of a technical environment in which one or more aspects disclosed herein may be implemented. As illustrated, technical environment 200 includes one or more user systems 205 operatively coupled to a host computing environment, such as a cloud-based computing environment 210, via one or more networks 201.

[0025] In one or more implementations, user system 205 is a user or consumer computer system or network operatively coupled to computing environment 210 by one or more networks 201. By way of example only, one or more networks 201 may be or include one or more buses or other links, telecommunications networks, local area networks (LANs), wide area networks (WANs) such as the Internet, or combinations thereof, and may include wired, wireless, fiber optic connections, etc. A network may include one or more wired and / or wireless networks capable of receiving and transmitting data, such as the data described herein as well as other data, depending on the implementation.

[0026] Host computing environment 210, in one embodiment, includes one or more computing systems or processing environments that may be distributed in a cloud-based environment. In the embodiment illustrated in FIG. 2, host computing environment 210 includes, by way of example, a digital signature server 211 for integrity checking encrypted data sets, a repository 212 for maintaining encrypted data sets, and a deployment engine 213 including one or more operators 214 for facilitating the configuration and deployment of user computing resources 215 on host computing environment 210. As noted, in one or more embodiments, computing resources 215 may be one or more virtual machines, one or more containers, or both, that are securely configured to run user workloads or applications.

[0027] Generally speaking, in one or more embodiments, computer systems, computer program products, and computer-implemented methods are provided herein for homomorphically encrypting user configuration setting data or files at a user system and securely transmitting the homomorphically encrypted data set for operator processing in a host computing environment. Operator processing, such as cloud operator processing in a cloud-based environment, is programmed to facilitate deployment of the user's resource configuration via an automated framework without knowledge of the content of the configuration data set. The automated framework uses one or more operators, which are (for example) program code or containers that operate on the homomorphically encrypted data set to perform the necessary data manipulation and analysis in an immutable environment and to ensure the integrity of the user's configuration data is maintained. In one embodiment, the deployment engine deploys one or more operators that, for example, manage standard templates of configuration settings for a particular computing resource type to be deployed, and finds one or more respective user-defined settings in the homomorphically encrypted data set received from the user system. The operator framework also implements an authentication process to integrity check retrieved encrypted data sets to ensure they actually originated from the user system and that their integrity is maintained.

[0028] 3 illustrates one embodiment of a process for facilitating secure placement of computing resources within a computing environment in accordance with one or more aspects of the present invention. Embodiments of the process of FIG. 3 may include computer-implemented methods, computer systems, and computer program products, in which program code executing on one or more processors receives a request to securely place computing resources in a computing environment (300) and obtains a homomorphically encrypted data set containing configuration data for a desired configuration of computing resources to be placed in the computing environment (302). Embodiments of the present invention also include program code that uses the homomorphically encrypted data set in configuring or defining placement of the computing resources in the desired configuration (304) without decrypting the homomorphically encrypted data set prior to placement.

[0029] In certain embodiments, using the homomorphically encrypted data set includes homomorphically identifying configuration settings for use in configuring the computing resource for placement without decrypting the homomorphically encrypted data set. In one or more embodiments, program code is provided for placing the computing resource in a secure enclave of a computing environment using the homomorphically identified configuration settings. In one or more embodiments, the computing resource is a virtual machine or container for running a user's workload or application.

[0030] In one or more embodiments of the present invention, program code is provided for defining a configuration template for a computing resource to be deployed and an obtained homomorphically encrypted key used to generate the received homomorphically encrypted data set, and homomorphically encrypting the configuration template using the obtained homomorphically encrypted key. In one embodiment, homomorphically identifying configuration settings includes comparing the homomorphically encrypted configuration template with the received homomorphically encrypted data set to identify the configuration settings without decrypting the homomorphically encrypted data set. Further, in one embodiment, defining the configuration template includes obtaining one or more default configuration settings for the computing resource and replacing a default configuration setting of the one or more default configuration settings with each identified configuration setting based on identifying the respective configuration setting when comparing the homomorphically encrypted configuration template with the received homomorphically encrypted data set.

[0031] In one or more embodiments of the present invention, program code is provided for invoking one or more deployment operators based on receiving a request to deploy a computing resource. The one or more deployment operators retrieve homomorphically encrypted data sets from a repository. In one embodiment, the homomorphically encrypted data sets retrieved from the repository are digitally signed to facilitate integrity checking, and program code is provided for performing an integrity check on the retrieved homomorphically encrypted data sets. In one embodiment, the homomorphically encrypted data sets are digitally signed using a blockchain.

[0032] Embodiments of the present invention are closely tied to computing and offer significantly more than existing approaches to deploying computing resources within a computing environment. For example, embodiments of the present invention provide program code executing on one or more processors that leverages various system interconnectivities and various computing-centric data analysis and action techniques to obtain a desired configuration for computing resources to be deployed in a computing environment without decrypting encrypted data sets. Both the computing system interconnectivities utilized by the program code and the computer-specific data processing techniques utilized enable various aspects of the present invention. Furthermore, embodiments of the present invention offer significantly more than existing approaches to deploying computing resources within a computing environment by maintaining encrypted configuration data sets for the computing resources prior to deploying the computing resources.

[0033] In embodiments of the present invention, the program code provides numerous functionality including, but not limited to, 1) program code for receiving a request to deploy computing resources in a computing environment; 2) program code for obtaining a homomorphically encrypted data set including configuration-related data for a desired configuration of computing resources to be deployed in the computing environment; and 3) program code for using the homomorphically encrypted data set in configuring for deployment of the computing resources, wherein the computing resources are configured for deployment in the desired configuration without decrypting the homomorphically encrypted data set.

[0034] As mentioned, one or more embodiments described herein facilitate secure computing resource allocation, in part, using homomorphically encrypted data sets. Homomorphic encryption is a type of encryption that allows for computations to be performed on encrypted data without first decrypting the data. The result of the computation is in encrypted form, and when decrypted, the output is the same as if the operation had been performed on unencrypted data. In particular, homomorphic encryption allows for operations to be performed on encrypted data without knowing the private key (i.e., without decryption). Homomorphic encryption includes numerous types of encryption approaches that can perform different classes of computations on encrypted data. These include partially homomorphic, somewhat homomorphic, leveled-fully-homomorphic, and fully homomorphic encryption. Fully homomorphic encryption is a cryptosystem that supports arbitrary computations on ciphertext.

[0035] By way of example, FIG. 4 illustrates one embodiment of homomorphic encryption. In FIG. 4, a computing environment is illustrated in which a trusted domain 400 outsources one or more computations 412 to an untrusted domain 410. As shown, plaintext data 401, such as an original set of numbers, is fully homomorphically encrypted 402, such as by using lattice cryptography (which is quantum-resistant), and the encrypted data set 411 is provided as ciphertext to the untrusted domain 410. The untrusted domain 410 obtains an associated public key from a key management module or server 404 in the trusted domain 400 to facilitate performing one or more fully homomorphic encryption (FHE) computations 412. The computation result 413 of the operation in encrypted form is then returned to the trusted domain 400 for decryption 405 to obtain an unencrypted output 406. As mentioned, homomorphic encryption advantageously enables processing of data without providing access to the data. This involves, in one embodiment, performing computations on the encrypted data itself rather than requiring decryption of the data. Homomorphic encryption may be provided using any of several open-source fully homomorphic encryption (FHE) libraries that implement various generations of FHE schemes to provide the desired encryption. For example, a list of available homomorphic encryption implementations is maintained by the Homomorphicencryption.org Industry Standards Consortium.

[0036] 5 and 6 illustrate one embodiment of a computing environment and process flow for secure computing resource placement in accordance with one or more aspects of the present invention.

[0037] Referring first to FIG. 5 , one embodiment of a technical environment 500 is illustrated, including one or more user systems 510, which may be one or more on-premises computer systems of a user or consumer in operative communication with one or more third-party computing environments, including, for example, a signing or authentication server system 520, a repository 530, and a host computing environment 540, such as a cloud computing environment, that securely deploys the user's desired computing resources. As noted, in one or more embodiments, the deployed computing resources are, for example, virtual machines that privately run the user's workloads or applications. In one or more other embodiments, the deployed computing resources include one or more containers. As will be appreciated, containers in cloud computing are an approach to system virtualization. A single container can be used to run anything from a small microservice or software process to a larger application. Within the container, all necessary executable binary code, libraries, and configuration files are provided.

[0038] 5 and 6 collectively, one embodiment of a secure computing resource deployment process according to one or more aspects described herein includes a consumer or user initiating creation (610) (FIG. 6) of a computing resource configuration, specifically, operator configuration file 511 (FIG. 5). The user system then invokes preparation (612) of a data set to be encrypted using fully homomorphic encryption (FHE), in one embodiment. The encryption process, in one embodiment, uses one or more secret or private keys obtained via a key management module, process, server, etc. 512 (FIG. 5) to generate secure and public keys (614) (FIG. 6). The generated secure keys are used, for example, to encrypt data using fully homomorphic encryption (616), resulting in a homomorphically encrypted data set or a homomorphically encrypted configuration file 513 (FIG. 5). 6, information for fetching the key may be added to the payload (618) before transferring the encrypted data set to a signing or authentication server 520 (which may be a host-based or cloud-based server) for signing (620) the payload contents with the public key. In the illustrated embodiment, the signed homomorphically encrypted data set may be stored (622) (FIG. 6) in a repository 530, which in one implementation is a host-based or cloud-based repository.

[0039] As illustrated in FIG. 6, a user or consumer system decides to create a computing resource (e.g., a virtual machine or container) in a host-based computing environment. As part of this, the user sends a request to the computing environment to the operator deployment engine 542 (FIG. 5), which, among other things, begins processing the user request (630) (FIG. 6). The deployment engine invokes one or more deployment operators to fetch encrypted data sets or payloads in parts (632) (FIG. 6) from the repository 530. An operator is one or more agents or utilities that assist with computing resource setup in the host-based computing environment and, in one or more embodiments, may be a collection of containers. In the illustrated implementation, an integrity check 634 (FIG. 6) is performed to ensure that the signed encrypted data sets are still valid and have not been tampered with. As part of this process, applicable signature information is fetched from the signing server 520 in anticipation of the integrity check. If not valid, the computing resource deployment process terminates (635) (FIG. 6). As mentioned, in one embodiment, signed and encrypted data may be implemented using a blockchain.

[0040] As illustrated in FIG. 6 , a setting template for configuration settings is defined (636) based on the desired computing resource (e.g., a virtual machine and / or container). In one or more embodiments, defining the setting template can include providing a standard template for the resource type and can include providing one or more default configuration setting values for the template. Once the setting template is retrieved, it is homomorphically encrypted (638) ( FIG. 6 ) using the same homomorphic private key used to encrypt the user's configuration settings file. The homomorphic private key can be retrieved from the key management server 512 ( FIG. 5 ) associated with the user's system. In one implementation, the resulting homomorphically encrypted setting template contains all the standard configuration settings for the computing resource to be configured and deployed. Essentially, the setting template contains a set of default settings, one or more of which can be replaced based on comparison with the retrieved homomorphically encrypted data set. In particular, in one implementation, the operator process compares two homomorphically encrypted data sets, one from the user system and the other generated by the host system, to identify one or more user-desired configuration settings for the computing resource. This comparison is performed homomorphically, for example, using existing homomorphic comparison methods, and when a user-desired configuration setting is identified, the encrypted configuration template is updated accordingly (642) (FIG. 6), and the process repeats for one or more configuration settings in the configuration template (644) (FIG. 6). In particular, this process repeats for each user-provided configuration setting or definition in the encrypted data set, and once a definition for deployment is obtained, the computing resource is deployed.

[0041] As illustrated in Figure 6, a host cloud administrator of the host computing environment does not have access to the decrypted version of the configuration settings during the secure computing resource placement process of Figure 6. For example, the administrator can manage the placement of computing resources but does not know the configuration settings, which remain in encrypted format until the resources are placed. In the embodiment of Figure 6, the comparison of the homomorphically encrypted data set and the placement definition configuration and computing resource placement 646 all occurs within the secure enclave 601 of the host or cloud computing environment. This process occurs using the homomorphically encrypted data without decrypting the data prior to placing the computing resources.

[0042] By way of example, FIG. 7 illustrates one embodiment of a configuration file entry 700, here with a resulting payload 710 indicating, for example, that the config_parameter "SELinux" is enabled and homomorphically encrypted with the user's private key (712). Another configuration parameter, "Security Context Constraints (SCC)," is also indicated as enabled in this example, with a corresponding encrypted data set indicated in the payload. As noted, the processes disclosed herein operate on homomorphically encrypted data sets. In particular, the host deployment operator, originating from the deployment engine process, uses the encrypted payload 710 to first obtain a public key from a signing server for integrity checking of the encrypted data set. Assuming the integrity check is correct, the process uses an operator running on the host system (e.g., a cloud computing environment) to homomorphically verify the configuration dataset to identify a particular encrypted dataset value, which is then used to update 722 a configuration template, which is itself encrypted with the same private key as discussed above. The host system then deploys 724 computing resources using the resulting encrypted deployment definition for the configuration settings, as described herein.

[0043] Those skilled in the art will note from the above description that computer program products, computer systems, and computer-implemented methods are provided herein for configuring a security-sensitive computing environment using a process that includes, for example, encrypting the contents of a configuration file at a user system using homomorphic encryption and sending the encrypted configuration file as an operator package data set (or blob), where a host system administrator, such as a cloud administrator, does not have access to the encrypted content. Authentication is performed to ensure the integrity of the encrypted data set is maintained, thereby preventing tampering with the content present in the package. In response to a deployed host system operator configuring a computing resource as desired, as described herein, access to the encrypted content of the configuration file is revoked, for example, based on an action tag. In one or more implementations, this process can further include recording authentication patterns to enforce integrity checking along a blockchain network for cross-validation of this process. In one or more embodiments, the processes described herein can be utilized in conjunction with a Kubernetes framework implemented in a host computing environment.

[0044] Further exemplary embodiments of computing environments for implementing one or more aspects of the present invention are described below with reference to FIGS.

[0045] One or more aspects may relate to or use cloud computing.

[0046] Although this disclosure includes detailed descriptions of cloud computing, it is understood that implementation of certain teachings recited herein is not limited to cloud computing environments. Rather, embodiments of the present invention are capable of being implemented in conjunction with any other type of computing environment now known or later developed.

[0047] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with the service provider. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0048] The characteristics are as follows:

[0049] On-demand self-service: Cloud consumers can automatically and unidirectionally provision computing capacity, such as server time and network storage, as needed, without the need for human interaction with the provider of the service.

[0050] Pervasive network access: Capabilities are available over the network and accessed through standard mechanisms that encourage use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0051] Resource Pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated as needed. Consumers generally have no control or knowledge of the exact location of the resources provided, although there is a notion of location independence in that they may be able to specify a location at a higher level of abstraction (e.g., country, state, or data center).

[0052] Rapid Elasticity: Capacity can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out and rapidly released to quickly scale in. To the consumer, this capacity that is available to provision often appears unlimited and can be purchased in any quantity at any time.

[0053] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of utilized services.

[0054] The service model is as follows:

[0055] Software as a Service (SaaS): The consumer is offered the ability to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0056] Platform as a Service (PaaS): The capability offered to consumers is to deploy applications they create or acquire, written using programming languages and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application hosting environment configuration.

[0057] Infrastructure as a Service (IaaS): The ability offered to consumers is to provision processing, storage, network, and other basic computing resources onto which they can deploy and run any software, which may include operating systems and applications. While consumers do not manage or control the underlying cloud infrastructure, they do have control over the operating systems, storage, deployed applications, and possibly limited control over select networking components (e.g., host firewalls).

[0058] The deployment model is as follows:

[0059] Private Cloud: The cloud infrastructure is operated exclusively for an organization. It may be managed by that organization or a third party and can exist on or off premises.

[0060] Community Cloud: The cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). The cloud infrastructure may be managed by the organizations or a third party and can reside on or off premises.

[0061] Public Cloud: Cloud infrastructure is made available to the general public or large industry groups and is owned by organizations that sell cloud services.

[0062] Hybrid Cloud: A cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0063] A cloud computing environment is a service oriented environment that focuses on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0064] A cloud computing node may include a computer system / server such as that illustrated in Figure 1. The computer system / server 102 of Figure 1 may be practiced in a distributed cloud computing environment where tasks are performed by remote processing devices linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices. The computer system / server 102 may implement and / or perform any of the functionality described above.

[0065] Referring now to FIG. 8 , an illustrative cloud computing environment 50 is illustrated. As shown, the cloud computing environment 50 can include one or more cloud computing nodes 10, with which local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or any combination thereof, can communicate. The nodes 10 can also communicate with each other. The nodes 10 may be physically or virtually grouped in one or more networks (not shown), such as private, community, public, or hybrid clouds, or any combination thereof, as described above. This enables the cloud computing environment 50 to offer infrastructure, platform, and / or software as a service, without requiring cloud consumers to maintain resources on their local computing devices. The types of computing devices 54A-N shown in FIG. 8 are intended to be illustrative only, and it will be understood that computing node 10 and cloud computing environment 50 can communicate with any type of computerized device over any type of network and / or network-addressable connection (e.g., using a web browser).

[0066] Referring to Figure 9, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 8) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 9 are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0067] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include a mainframe 61, a RISC (reduced instruction set computer) architecture-based server 62, a server 63, a blade server 64, storage devices 65, and network and networking components 66. In some embodiments, the software components include network application server software 67 and database software 68.

[0068] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0069] In one example, the management layer 80 can provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to perform tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources can include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection of data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 provides allocation and management of cloud computing resources so that requested service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides advance arrangements for and procurement of cloud computing resources for anticipated future requirements according to SLAs.

[0070] The workload layer 90 provides examples of functionality for which a cloud computing environment can be utilized. Examples of workloads and functions that can be provided from this layer include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instruction delivery 93, data analytics processing 94, transaction processing 95, and secure computing resource allocation processing 96.

[0071] The description of various embodiments of the present invention has been presented for purposes of illustration, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, practical applications, or technical improvements over technology found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

[0072] The present invention may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail integration, and may include one or more computer-readable storage media having computer-readable program instructions thereon for causing a processor to perform aspects of the present invention.

[0073] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick®, floppy disk, mechanically encoded devices such as punch cards or groove-in-ridge structures with instructions recorded thereon, and any suitable combination of the above. Computer-readable storage medium, as used herein, should not be construed as being a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted through a wire.

[0074] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the respective computing / processing device.

[0075] Computer-readable program instructions for carrying out the operations of the present invention may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or object-oriented programming languages such as Smalltalk®, C++, or others, and procedural programming languages such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection to the external computer may be made (e.g., through the Internet using an Internet service provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) can execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry to implement aspects of the present invention.

[0076] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0077] These computer-readable program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that the instructions, which execute on the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams, to produce a machine. These computer-readable program instructions may also be stored on a computer-readable storage medium that can instruct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular way, such that the computer-readable storage medium having instructions stored therein comprises an article of manufacture containing instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0078] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, such that the instructions, which execute on the computer, other programmable apparatus, or other device, implement the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0079] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, which includes one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending on the functionality involved. It will also be noted that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by special-purpose hardware-based systems that perform the specified functions or operations or execute a combination of special-purpose hardware and computer instructions.

[0080] In addition to the above, one or more aspects may be provided, offered, deployed, managed, serviced, etc. by a service provider that offers to manage a customer environment. For example, a service provider may create, maintain, support, etc. computer code and / or computer infrastructure that implements one or more aspects for one or more customers. In return, the service provider may receive compensation from the customer, by way of example, under a subscription and / or commission agreement. Additionally or alternatively, the service provider may receive compensation from sales of advertising content to one or more third parties.

[0081] In one aspect, an application for implementing one or more embodiments may be deployed, and in one example, deploying the application includes providing a computer infrastructure operable to implement one or more embodiments.

[0082] As a further aspect, a computing infrastructure may be provided that includes computer-readable code integrated into a computing system, wherein the code in combination with the computing system is capable of implementing one or more embodiments.

[0083] As a still further aspect, there may be provided a process for integrating a computing infrastructure comprising integrating computer-readable code into a computer system including a computer-readable medium, the computer medium including one or more embodiments, the code in combination with the computer system being capable of implementing one or more embodiments.

[0084] Although various embodiments have been described above, these are merely examples. For example, computing environments of other architectures may be used to incorporate and use one or more embodiments. Furthermore, different instructions, instruction formats, instruction fields, and / or instruction values may be used. Many variations are possible.

[0085] Additionally, other types of computing environments may be beneficial and may be used. By way of example, a data processing system suitable for storing and / or executing program code may be used, including at least two processors coupled directly or indirectly to memory elements through a system bus. Memory elements may include, for example, local memory, bulk storage, and cache memory used during the actual execution of the program code, where the cache memory provides temporary storage of at least some program code to reduce the number of times the code must be retrieved from bulk storage during execution.

[0086] Input / output, or I / O, devices (including but not limited to keyboards, displays, pointing devices, DASDs, tapes, CDs, DVDs, thumb drives, and other memory media, etc.) may be coupled to the system either directly or through intervening I / O controllers. Network adapters may also be coupled to the system to enable the data processing system to be coupled to other data processing systems or to remote printers or storage devices through intervening private or public networks. Modems, cable modems, and ETHERNET® cards are just a few of the types of network adapters available.

[0087] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It will be further understood that the terms "comprise" (and any form of "comprise," such as "comprises" and "comprising"), "have" (and any form of "have," such as "has" and "having"), "include" (and any form of "include," such as "includes" and "including"), and "contain" (and any form of "contain," such as "contains" and "containing") are open-ended linking verbs. Consequently, a method or device that "comprises," "has," "includes," or "contains" one or more steps or elements possesses those one or more steps or elements, but is not limited to possessing only those one or more steps or elements. Similarly, a method step or device element that "comprises," "has," "includes," or "contains" one or more features possesses those one or more features, but is not limited to possessing only those one or more features. Furthermore, a device or structure configured in a certain way, while configured in at least that way, may also be configured in ways not listed.

[0088] The corresponding structure, material, acts, and equivalents of all means-plus-function or step-plus-function elements in the following claims, when specifically claimed, are intended to include any structure, material, or act for performing a function in combination with other claimed elements. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or to limit the invention to the form disclosed. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The embodiments have been chosen and described in order to best explain the principles and practical application of one or more aspects of the invention, and to enable others skilled in the art to understand one or more aspects of the invention in various embodiments with various modifications as suited to the particular use contemplated.

Claims

1. 1. A computer program for facilitating secure computing resource placement, comprising: receiving a request to deploy a computing resource in a computing environment; obtaining a homomorphically encrypted data set, the homomorphically encrypted data set including configuration-related data for a desired configuration of the computing resources to be deployed in the computing environment; using the homomorphically encrypted data set in a configuration for deployment of the computing resources, wherein the computing resources are configured for deployment in the desired configuration without decrypting the homomorphically encrypted data set, the using comprising: and identifying the homomorphically encrypted configuration settings for configuring the computing resource for deployment without decrypting the homomorphically encrypted data set, wherein the identifying comprises comparing the obtained homomorphically encrypted data set with a homomorphically encrypted configuration template to identify the configuration settings without decrypting the homomorphically encrypted data set.

2. the computer program further causes the one or more processors to deploy the computing resource in a secure enclave of the computing environment using the identified configuration settings.

2. The computer program product of claim 1.

3. the computing resource is selected from the group consisting of a virtual machine and a container; 3. The computer program of claim 2.

4. The computer program further comprises: defining a configuration template for the computing resource to be deployed; Obtaining a homomorphic encryption key used to generate the received homomorphically encrypted data set; homomorphically encrypting the configuration template using the obtained homomorphic encryption key to generate the homomorphically encrypted configuration template for comparison with the obtained homomorphically encrypted data set; 2. The computer program product of claim 1, further comprising:

5. defining the settings template includes obtaining one or more default configuration settings for the computing resource; The computer program further comprises: and replacing a default configuration setting of the one or more default configuration settings with the identified respective configuration setting based on identifying the respective configuration setting from comparing the homomorphically encrypted configuration template with the received homomorphically encrypted data set. causing the one or more processors to 5. A computer program product according to claim 4.

6. The computer program further comprises: Invoking one or more placement operators based on receiving the request to place the computing resource. to the one or more processors, the one or more placement operators retrieve the homomorphically encrypted data sets from a repository; 2. The computer program product of claim 1.

7. the homomorphically encrypted data set obtained from the repository is digitally signed for integrity checking; The computer program further comprises: performing an integrity check on the obtained homomorphically encrypted data set. causing the one or more processors to 7. A computer program product according to claim 6.

8. 1. A computer system for facilitating secure computing resource placement, the computer system comprising: Memory and one or more processors operably coupled to the memory; Program code and Equipped with The program code: receiving a request to deploy a computing resource in a computing environment; obtaining a homomorphically encrypted data set, the homomorphically encrypted data set including configuration-related data for a desired configuration of the computing resources to be deployed in the computing environment; using the homomorphically encrypted data set in a configuration for deployment of the computing resources, wherein the computing resources are configured for deployment in the desired configuration without decrypting the homomorphically encrypted data set, the using comprising: identifying the homomorphically encrypted configuration settings for configuring the computing resource for deployment without decrypting the homomorphically encrypted data set, wherein the identifying includes comparing the obtained homomorphically encrypted data set with a homomorphically encrypted configuration template to identify the configuration settings without decrypting the homomorphically encrypted data set; executable by the one or more processors via the memory to perform a method including: Computer systems.

9. The method of claim 8, further comprising: placing the computing resource in a secure enclave of the computing environment using the identified configuration settings.

9. The computer system of claim 8.

10. the computing resource is selected from the group consisting of a virtual machine and a container; 10. The computer system of claim 9.

11. defining a configuration template for the computing resource to be deployed; Obtaining a homomorphic encryption key used to generate the received homomorphically encrypted data set; homomorphically encrypting the configuration template using the obtained homomorphic encryption key to generate the homomorphically encrypted configuration template for comparison with the obtained homomorphically encrypted data set; further comprising:

9. The computer system of claim 8.

12. Invoking one or more placement operators based on receiving the request to place the computing resource. further comprising the one or more placement operators retrieve the homomorphically encrypted data sets from a repository; 9. The computer system of claim 8.

13. the homomorphically encrypted data set obtained from the repository is digitally signed for integrity checking; The program instructions further include: performing an integrity check on the obtained homomorphically encrypted data set. causing the one or more processors to 13. The computer system of claim 12.

14. 1. A computer-implemented method comprising: by one or more processors, receiving a request to deploy a computing resource in a computing environment; obtaining a homomorphically encrypted data set, the homomorphically encrypted data set including configuration-related data for a desired configuration of the computing resources to be deployed in the computing environment; using the homomorphically encrypted data set in a configuration for deployment of the computing resources, wherein the computing resources are configured for deployment in the desired configuration without decrypting the homomorphically encrypted data set, the using comprising: identifying the homomorphically encrypted configuration settings for configuring the computing resource for deployment without decrypting the homomorphically encrypted data set, wherein the identifying includes comparing the obtained homomorphically encrypted data set with a homomorphically encrypted configuration template to identify the configuration settings without decrypting the homomorphically encrypted data set; 11. A computer-implemented method comprising:

15. by the one or more processors: defining a configuration template for the computing resource to be deployed; Obtaining a homomorphic encryption key used to generate the received homomorphically encrypted data set; homomorphically encrypting the configuration template using the obtained homomorphic encryption key to generate the homomorphically encrypted configuration template for comparison with the obtained homomorphically encrypted data set; further comprising:

15. The computer-implemented method of claim 14.

Images