Data Center Security via Resource Signature Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined data centers, detecting tampering or anomalies across pooled resources is challenging due to individual management of physical devices, leading to infrastructure security issues.
Innovation Solution
A mechanism is implemented to generate digital signatures for resources within a data center by hashing characteristics, creating an aggregate signature, and a rack signature, which is managed by a fabric manager to ensure authenticity and integrity of workloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If physical devices are managed individually in data centers, then device flexibility and independence are maintained, but detecting tampering and anomalies becomes difficult leading to security issues
Solution Approach 1:
The system segments the data center infrastructure into individual device signatures and collective pool signatures. Each physical device is characterized by unique attributes (hardware specs, firmware versions, configuration parameters) that form its signature. The collective pool signature is generated by aggregating individual device signatures through cryptographic hashing. This segmentation enables both individual device monitoring and overall pool integrity verification, resolving the contradiction between individual management and collective security monitoring.
Solution Approach 2:
Cryptographic hash functions serve as intermediaries that transform individual device characteristics into verifiable signatures without exposing sensitive raw data. The hash function acts as a mediator between device configuration and security verification, enabling tamper detection while maintaining device independence. Any modification to device attributes changes the hash signature, providing detectable security monitoring while preserving individual device management flexibility.
2Reliability
If digital signatures are generated for each resource and aggregated, then tampering detection capability is improved, but system complexity increases
Solution Approach 1:
The system merges individual device signatures into a single collective pool signature through cryptographic aggregation. This combining approach maintains the integrity benefits of individual signatures while simplifying verification - the collective signature provides a single point of verification for the entire resource pool. The fabric manager generates and stores this aggregated signature, reducing the complexity of managing multiple individual signatures while preserving tamper detection capabilities across all resources.
Data Source
AI summary
A system to facilitate data center security is described. The system includes a processor and a machine readable medium storing instructions that, when executed, cause the processor to receive a plurality of resources that are to be provided to process a workload, receive one or more characteristics associated with each of the plurality of resources, generate a resource signature for each of the plurality of resources using the one or more characteristics associated with each resource and generate an aggregated signature using the resource signatures generated for each of the plurality of resources.