Security domains for aware placement of workloads within converged infrastructure information handling systems
Disclosed methods and systems discover trust and security information indicative of trust and security capabilities of information handling resources. Based on the trust and security information and a corresponding algorithm, a trust index may be calculated for a particular system. Trust index values may be used to influence subsequent placements of virtual machines, application services, or other objects. Discovery may include invoking resource-specific trust and security discovery adapters to access a resource manifest indicating an interface and trust and discovery artifacts associated with the resource of interest and determine which, if any, of the applicable trust and discovery artifacts are implemented in the applicable system. The trust index may be calculated by determining which trust and security artifacts a particular system includes and, for each such artifact, multiplying a trust assessment assigned to the artifact by a user configurable weighting and summing the resulting products for each artifact.
1. A method, comprising:
discovering trust and security information indicative of trust and security capabilities of information handling resources in a platform comprising one or more information handling systems;
calculating, based on the trust and security information and a trust and security algorithm, a trust and security value for each of the one or more information handling systems; and
placing one or more workload objects within the platform in accordance with the trust and security value of each of the one or more information handling systems;
wherein discovering the trust and security information includes invoking one or more trust and security discovery adapters configured to:
access a trust and security domain manifest indicative of trust and discovery artifacts associated with a resource; and
determine which of the trust and discovery artifacts are implemented in the resource;
wherein invoking one or more trust and security discovery adapters includes invoking a trust and security discovery adapter for each of a plurality of architectural layers associated with the resource, wherein the plurality of architectural layers includes:
a bare metal layer;
a firmware layer;
an operating system layer; and
a hypervisor layer.
2. The method of claim 1 , wherein the plurality of architectural layers includes an infrastructure services manager layer.
3. The method of claim 2 , further comprising:
for each artifact implemented in the resource:
obtain a trust index and a user configurable weighting; and
add the product of the trust index and the user configurable weighting to a total.
4. The method of claim 3 , wherein the one or more trust and security adapters include an operating system adapter and wherein the artifacts for the operating system adapter include a trusted platform module, a secure boot service, and a host guardian service.
5. The method of claim 1 , further comprising:
receiving administrator input indicative of one or more security compliance parameters, wherein said placing includes placing in virtual machines within the platform in compliance with the security compliance parameters.
6. The method of claim 5 , wherein the security compliance parameters include:
a shielded parameter for indicating placement on a server or virtual cluster running host guard service, and trusted platform modules; and
a secure encrypted parameter for indicating placement of virtual disks on self-encrypted drive storage devices.
7. The method of claim 5 , wherein the security compliance parameters include:
a submarine infrastructure parameter enabling placement on a server or virtual cluster without outgoing internet connectivity;
a data compliance parameter enabling placement on resources that comply with one or more data compliance regulations; and
a geo location parameter indicative of resources in different regions.
8. An information handling system, comprising:
a processor;
a network interface for communicating with management endpoints of information handling resources in a platform comprising one or more information handling systems;
a non-transitory computer readable medium including processor executable instructions that, when executed by the processor, cause the processor to perform one or more operations comprising:
obtaining trust and security information indicative of trust and security capabilities of information handling resources in a platform comprising one or more information handling systems;
calculating, based on the trust and security information and a trust and security algorithm, a trust and security value for each of the one or more information handling systems; and
placing one or more workload objects within the platform in accordance with the trust and security value of each of the one or more information handling systems;
wherein obtaining the trust and security information includes invoking one or more trust and security discovery adapters configured to:
access a trust and security domain manifest indicative of trust and discovery artifacts associated with a resource; and
determine which of the trust and discovery artifacts are implemented in the resource;
wherein invoking one or more trust and security discovery adapters includes invoking a trust and security discovery adapter for each of a plurality of architectural layers associated with the resource, wherein the plurality of architectural layers includes:
a bare metal layer;
a firmware layer;
an operating system layer; and
a hypervisor layer.
9. The information handling system of claim 8 , wherein the operations include:
for each artifact implemented in the resource:
obtain a trust index and a weighting; and
add the product of the trust index and the weighting to a total.
10. The information handling system of claim 9 , wherein the one or more trust and security adapters include an operating system adapter and wherein the artifacts for the operating system adapter include a trusted platform module, a secure boot service, and a host guardian service.
11. The information handling system of claim 9 , wherein the operations include:
receiving administrator input indicative of one or more security compliance parameters, wherein said placing includes placing in virtual machines within the platform in compliance with the security compliance parameters.
12. The information handling system of claim 11 , wherein the security compliance parameters include:
a shielded parameter for indicating placement on a server or virtual cluster running host guard service, and trusted platform modules; and
a secure encrypted parameter for indicating placement of virtual disks on self-encrypted drive storage devices.
13. The information handling system of claim 11 , wherein the security compliance parameters include:
a submarine infrastructure parameter enabling placement on a server or virtual cluster without outgoing internet connectivity;
a data compliance parameter enabling placement on resources that comply with one or more data compliance regulations; and
a geo location parameter indicative of resources in different regions.
14. A non-transitory computer readable medium including processor executable instructions that, when executed by a processor, cause the processor to perform one or more operations comprising:
obtaining trust and security information indicative of trust and security capabilities of information handling resources in a platform comprising one or more information handling systems;
calculating, based on the trust and security information and a trust and security algorithm, a trust and security value for each of the one or more information handling systems; and
placing one or more workload objects within the platform in accordance with the trust and security value of each of the one or more information handling systems;
wherein obtaining the trust and security information includes invoking one or more trust and security discovery adapters configured to:
access a trust and security domain manifest indicative of trust and discovery artifacts associated with a resource; and
determine which of the trust and discovery artifacts are implemented in the resource;
wherein invoking one or more trust and security discovery adapters includes invoking a trust and security discovery adapter for each of a plurality of architectural layers associated with the resource, wherein the plurality of architectural layers includes:
a bare metal layer;
a firmware layer;
an operating system layer; and
a hypervisor layer.
15. The non-transitory computer readable medium of claim 14 , wherein obtaining the trust and security information includes invoking one or more trust and security discovery adapters configured to:
access a resource manifest indicative of an interface and artifacts associated the resource; and
determine which of the artifacts are implemented in the resource.
16. The non-transitory computer readable medium of claim 15 , wherein the operations include:
for each artifact implemented in the resource:
obtain a trust index and a weighting; and
add the product of the trust index and the weighting to a total.
17. The non-transitory computer readable medium of claim 16 , wherein the one or more trust and security adapters include an operating system adapter and wherein the artifacts for the operating system adapter include a trusted platform module, a secure boot service, and a host guardian service.
18. The non-transitory computer readable medium of claim 14 , wherein the operations include:
receiving administrator input indicative of one or more security compliance parameters, wherein said placing includes placing in virtual machines within the platform in compliance with the security compliance parameters.
19. The non-transitory computer readable medium of claim 18 , wherein the security compliance parameters include:
a shielded parameter for indicating placement on a server or virtual cluster running host guard service, and trusted platform modules; and
a secure encrypted parameter for indicating placement of virtual disks on self-encrypted drive storage devices.