Workload execution systems and methods
View Patent ↗In one embodiment, a method is executed by a computer system. The method includes receiving information related to a platform-portable workload, the information comprising a data security policy expressed as digitally signed metadata. The data security policy specifies one or more data security features that any platform executing the platform-portable workload should implement. The method further includes validating the digitally signed metadata as originating from an issuer of the platform-portable workload. In addition, the method includes, responsive to successful validation of the digitally signed metadata, automatically determining whether a particular platform can satisfy the data security policy based, at least in part, on a comparison of the digitally signed metadata with data security attributes of the particular platform. Further, the method includes, responsive to a determination that the particular platform cannot satisfy the data security policy, automatically preventing execution of the platform-portable workload on the particular platform.
1. A method comprising, by an information handling system comprising a processor and memory:
receiving information related to a platform-portable workload, the information comprising a data security policy expressed as digitally signed metadata, wherein the data security policy specifies one or more data security features that any platform allowed to execute the platform-portable workload is to implement;
validating the digitally signed metadata as originating from an issuer computer system that issued the platform-portable workload;
responsive to the validating, automatically determining that a particular platform cannot satisfy the data security policy based, at least in part, on a comparison of the digitally signed metadata with data security attributes of the particular platform; and
responsive to the automatically determining, automatically preventing execution of the platform-portable workload on the particular platform,
wherein the automatically preventing comprises:
selecting a second platform that is determined to satisfy the data security policy; and
transmitting the platform-portable workload to the second platform for execution.
2. The method of claim 1 , wherein the information handling system is associated with the particular platform.
3. The method of claim 1 , wherein the automatically preventing further comprises preventing the platform-portable workload from being sent to the particular platform for execution.
4. The method of claim 1 , wherein the selecting comprises selecting the second platform from among a plurality of platforms.
5. The method of claim 1 , wherein:
the information comprises an asserted signature of the issuer computer system and a digital certificate, the digital certificate comprising a public key; and
the validating comprises:
verifying that the digital certificate is from a trusted certificate authority; and
verifying that the asserted signature is valid using the public key.
6. The method of claim 1 , wherein the information related to the platform-portable workload is the platform-portable workload.
7. The method of claim 1 , wherein the digitally signed metadata conforms to a standard implemented by at least the issuer computer system and the information handling system.
8. The method of claim 1 , wherein the one or more data security features are selected from the group consisting of: physical security features, encryption features, user authentication features, virtualization features, network security features, security services offered, audit features, geolocation requirements, operating system version, and security standards supported.
9. An information handling system comprising a hardware processor and physical memory, wherein the hardware processor and physical memory in combination are configured to implement a method comprising:
receiving information related to a platform-portable workload, the information comprising a data security policy expressed as digitally signed metadata, wherein the data security policy specifies one or more data security features that any platform allowed to execute the platform-portable workload is to implement;
validating the digitally signed metadata as originating from an issuer computer system that issued the platform-portable workload;
responsive to the validating, automatically determining that a particular platform cannot satisfy the data security policy based, at least in part, on a comparison of the digitally signed metadata with data security attributes of the particular platform; and
responsive to the automatically determining, automatically preventing execution of the platform-portable workload on the particular platform,
wherein the automatically preventing comprises:
selecting a second platform that is determined to satisfy the data security policy; and
transmitting the platform-portable workload to the second platform for execution.
10. The information handling system of claim 9 , wherein the information handling system is associated with the particular platform.
11. The information handling system of claim 9 , wherein the selecting comprises selecting the second platform from among a plurality of platforms.
12. The information handling system of claim 9 , wherein:
the information comprises an asserted signature of the issuer computer system and a digital certificate, the digital certificate comprising a public key; and
the validating comprises:
verifying that the digital certificate is from a trusted certificate authority; and
verifying that the asserted signature is valid using the public key.
13. The information handling system of claim 9 , wherein the information related to the platform-portable workload is the platform-portable workload.
14. The information handling system of claim 9 , wherein the digitally signed metadata conforms to a standard implemented by at least the issuer computer system and the information handling system.
15. The information handling system of claim 9 , wherein the one or more data security features are selected from the group consisting of: physical security features, encryption features, user authentication features, virtualization features, network security features, security services offered, audit features, geolocation requirements, operating system version, and security standards supported.
16. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising:
receiving information related to a platform-portable workload, the information comprising a data security policy expressed as digitally signed metadata, wherein the data security policy specifies one or more data security features that any platform allowed to execute the platform-portable workload is to implement;
validating the digitally signed metadata as originating from an issuer computer system that issued the platform-portable workload;
responsive to the validating, automatically determining that a particular platform cannot satisfy the data security policy based, at least in part, on a comparison of the digitally signed metadata with data security attributes of the particular platform; and
responsive to the automatically determining, automatically preventing execution of the platform-portable workload on the particular platform,
wherein the automatically preventing comprises:
selecting a second platform that is determined to satisfy the data security policy; and
transmitting the platform-portable workload to the second platform for execution.