Security-Aware Process Partitioning in Cloud Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing systems face inefficiencies in running integration scenarios across multiple tenants due to high costs and resource underutilization, as they require each tenant to have separate virtual machines (VMs) for maximum security, leading to significant overhead and inefficiency, especially when many tenants have only a few active flows.
Innovation Solution
Implement a security-aware partitioning method that analyzes integration scenarios to identify shareable and non-shareable processes, allowing shareable processes to be combined across tenants while isolating non-shareable ones, using graph partitioning and bin packing to optimize resource allocation and reduce costs by assigning processes to containers rather than dedicated VMs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate virtual machines are allocated to each tenant for maximum security isolation, then security is improved, but resource utilization deteriorates and costs increase
Solution Approach 1:
The patent segments processes into shareable and non-shareable components through graph partitioning. Non-shareable processes that require security isolation are separated from shareable processes, allowing the latter to be consolidated across tenants. This segmentation enables partial sharing while maintaining necessary security boundaries.
Solution Approach 2:
The patent merges shareable processes from multiple tenants into common processing units or containers. By identifying processes that can be safely shared through static analysis and graph partitioning, the system combines resources across tenant boundaries, improving utilization while maintaining isolation for non-shareable components.
2Reliability
If separate virtual machines are allocated to each tenant, then security isolation is improved, but system complexity and overhead increase
Solution Approach 1:
The system segments the isolation requirement into process-level granularity rather than tenant-level VM isolation. By identifying shareable versus non-shareable processes through static analysis, the system applies isolation only where necessary, reducing the number of virtual machines and associated overhead.
Solution Approach 2:
The patent creates universal processing units that can safely handle multiple tenants' workloads through dynamic allocation and isolation mechanisms. These processing units serve multiple functions across different tenants, reducing the need for dedicated VMs per tenant while maintaining security through controlled access to non-shareable processes.
3Reliability
If all processes are isolated in separate containers by tenant, then security is improved, but cost efficiency deteriorates due to resource underutilization
Solution Approach 1:
The patent segments processes into shareable and non-shareable categories through static analysis and graph partitioning. This allows non-shareable processes to be isolated in tenant-specific containers while shareable processes are consolidated in common containers, reducing the total number of containers and improving resource utilization.
Solution Approach 2:
The patent merges shareable processes from multiple tenants into common processing containers, improving resource utilization and reducing costs. The system dynamically allocates these shared resources to different tenants based on demand, while maintaining isolation for non-shareable processes that require dedicated containers.
Data Source
AI summary
Techniques are described for providing security-aware partitioning of processes. An example method includes identifying an integration scenario for optimization in a cloud-based system based on optimization constraints. The identified integration scenario is translated into a directed graph comprising connections between particular flows within the integration scenario. Each flow in the identified scenario is automatically analyzed to determine whether the flow is shareable across processing units associated with a different tenant, and each flow can be annotated in the direct graph with results of the analysis. At least one optimization to the integration scenario is determined based on the annotated directed graph and a set of optimization constraints. An assignment of flows to particular processing units is generated based on the determined at least one optimization.