Security Ring Scheduling for Isolated Distributed Workloads
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current distributed computing networks face challenges in isolating workloads with varying security requirements, leading to inadequate security and poor resource utilization, as conventional isolation techniques fail to provide scalability and flexibility.
Innovation Solution
Implementing workload security rings that physically isolate computing devices into distinct security levels, with a security ring controller determining the appropriate ring for each workload based on its security criteria, allowing for dynamic rebalancing and resource allocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security checks are performed on data in memory, then data security is improved, but processing speed deteriorates
Solution Approach 1:
The patent divides the security verification process into two segments: (1) hardware-based security ring that performs cryptographic operations and generates verification data, and (2) software-based verification that compares verification data with stored values. This segmentation allows security checks to be performed without burdening the main CPU, thus maintaining processing speed while improving data security.
Solution Approach 2:
The patent introduces an intermediary security ring component that acts as a bridge between the CPU and memory security verification. This intermediary handles the computationally intensive cryptographic operations separately, allowing the main processing system to continue at full speed while security verification occurs in parallel through the intermediary security ring.
2Reliability
If security rings are implemented for each workload, then security is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal security ring architecture that can handle multiple different workload types (cryptographic operations, database operations, file operations, etc.) through a single unified security verification mechanism. The security ring uses a standardized interface and verification process that works across different workload types, avoiding the need for separate security rings for each workload and thus reducing system complexity.
Solution Approach 2:
The patent changes the parameter of security verification from workload-specific implementations to a unified parameter-based approach where the security ring verifies workloads based on workload identifiers and verification data structures. This parameter change allows the same security ring hardware to adapt to different workload types without increasing physical complexity, maintaining security while simplifying the system architecture.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method that includes receiving a plurality of workloads (102), each associated with respective security criteria (104) and scheduled tor execution on a distributed computing system ( 140) divided, into a plurality of security rings ( 160) each associated, with a respective subset of computing devices (162 ) of the distributed computing system that is physically isolated from the other security rings. For each respective workload, die method includes determining, using the respective security criteria, a security level (410) of the respective workload and identifying, using the security level of the respective workload, one or more of the plurality of security rings that are eligible for executing the respective workload. The method also includes executing the respective workload on one or more computing devices selected from one of the respective subsets of computing devices associated with the identified one or more of the plurality of security rings eligible for executing the respective workload.