HPC Compute Environment Isolation for Secure Data Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current High Performance Computing (HPC) systems lack effective security measures to protect data during the computation phase, as existing solutions primarily focus on data at rest and in transit, leaving data actively used by computing nodes vulnerable to unauthorized access.
Innovation Solution
A method is introduced where a compute environment is isolated from the rest of the HPC machine, restricting interaction to the client, and data is encrypted and decrypted within this environment to ensure secure processing, with optional steps for configuring resources to meet technical specifications and encrypting output data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted during computation, then security is improved, but computing speed deteriorates due to encryption/decryption overhead
Solution Approach 1:
Data is encrypted before being loaded into the compute environment, and decryption is performed only when necessary. This preliminary encryption action ensures security is established in advance, avoiding the need for continuous encryption/decryption during computation operations.
Solution Approach 2:
The system segments the HPC machine into isolated compute environments that are separated from the rest of the system. Each compute environment handles specific computation tasks with encrypted data, allowing security to be applied selectively only where needed rather than throughout the entire system.
2Reliability
If compute environments are isolated from the rest of the HPC machine, then security is improved, but system complexity increases
Solution Approach 1:
The HPC machine is divided into separate, isolated compute environments that function independently. Each compute environment is a self-contained unit with its own resources, providing security through separation while maintaining manageable system complexity through modular design.
Solution Approach 2:
A workload manager acts as an intermediary between the client and the isolated compute environments. This mediator handles resource allocation, job scheduling, and coordination, simplifying the interaction complexity while maintaining the security benefits of isolation.
3Reliability
If resources are gathered into a dedicated compute environment, then security is improved, but resource utilization efficiency deteriorates
Solution Approach 1:
The workload manager provides universal coordination capabilities that enable multiple compute environments to share common management resources. Each compute environment is dedicated for security, but the management infrastructure is universal and can serve multiple environments, improving overall resource utilization efficiency.
Solution Approach 2:
Resources are pre-configured and prepared in the compute environments before computation tasks are assigned. This preliminary preparation ensures that when tasks are distributed, resources are already optimized and ready, improving utilization efficiency without compromising the security of dedicated environments.
Data Source
Figure 1
Figure 2
AI summary
The invention relates to a method (100) for carrying out a computing job for a client on a High Performance Computing, HPC, machine, said method (100) comprising the following steps: - selecting (106), in said HPC machine, the resources for carrying out said computing job, said resources forming a so-called compute environment comprising one or several computing nodes, and - performing (126) the computing job in said compute environment; wherein said method (100) also comprises before the step (126) of performing the computing job, a step (116) for isolating said compute environment from the rest of the HPC machine so that interaction with said compute environment is restricted to said client. It also relates to a HPC machine configured for carrying out such a method.