TEE-Based LCS Identity Verification for Tenant Resource Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face inefficiencies in allocating and managing computing resources for computer-implemented services, leading to potential over- or under-allocation, which can impact service quality and efficiency.
Innovation Solution
A system control processor manager divides computing resources into three logical sets (compute, control, and hardware) to dynamically allocate and manage resources based on specific service needs, using a trusted execution environment (TEE) for data security and identity verification, and brokers key management to ensure resource isolation among tenants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If computing resources are allocated statically, then resource allocation is simple, but service quality and efficiency deteriorate due to over- or under-allocation
Solution Approach 1:
The patent implements dynamic resource allocation by dividing computing resources into three logical sets (compute, control, and hardware) that can be dynamically allocated and managed based on specific service needs. The system control processor manager continuously monitors service requirements and adjusts resource allocation in real-time, transforming static allocation into a dynamic process that adapts to changing conditions, thereby improving service efficiency while managing complexity through structured organization.
2Reliability
If resource allocation is optimized, then service quality improves, but system complexity increases
Solution Approach 1:
The patent applies segmentation by dividing computing resources into three distinct logical sets: compute resources, control resources, and hardware resources. This segmentation allows each set to be managed independently with specific policies, simplifying the overall system complexity while enabling optimized allocation strategies for each resource type. The system control processor manager operates on these segmented resources to ensure reliable service delivery through targeted optimization rather than monolithic management.
Solution Approach 2:
The system control processor manager acts as an intermediary between resource allocation decisions and actual resource deployment. This intermediary layer simplifies system complexity by centralizing management functions, making resource allocation policies enforceable, and ensuring consistent service quality across all resource types. The intermediary handles the complexity of coordination and enforcement, allowing the system to achieve optimized service quality without proportionally increasing overall system complexity.
3Productivity
If multiple tenants share computing resources, then resource utilization efficiency improves, but isolation and security deteriorate
Solution Approach 1:
The patent implements local quality by applying different management policies and access controls to different logical sets of resources based on tenant requirements. Each tenant can have customized allocation strategies for compute, control, and hardware resources tailored to their specific needs and security requirements. This localized approach enables efficient resource utilization across multiple tenants while maintaining strong isolation boundaries, as each tenant's resources are managed according to their specific quality attributes and security policies.
Data Source
AI summary
A method for managing data includes obtaining, by a system control processor, a verification request for a logically composed system (LCS) associated with a tenant, in response to the verification request: identifying a corresponding trusted execution environment (TEE) associated with the tenant, sending a challenge question to the LCS for identity verification, obtaining, in response to the challenge question, a security response from the LCS, performing an identity verification for the LCS using a LCS-key pairing stored in secured storage of the TEE, making a determination, based on performing the identity verification, that the LCS is verified, and based on the determination, servicing a workload associated with the LCS.