Decentralized computing resource management using distributed ledger
In a network including a plurality of computing resources associated with an enterprise, an identity is established for each of the computing resources in accordance with a decentralized identity management system maintained in accordance with a distributed ledger. The plurality of computing resources is managed in association with the distributed ledger, wherein managing comprises the enterprise posting one or more commands on the distributed ledger to enable one or more of the plurality of computing resources to obtain the one or more commands. In one non-limiting example, the computing resources are part of a geographically distributed IT infrastructure associated with the enterprise.
1. A method comprising:
in a network comprising a plurality of computing resources associated with an enterprise, establishing an identity for each of the computing resources in accordance with a decentralized identity management system maintained in accordance with a distributed ledger; and
managing the plurality of computing resources in association with the distributed ledger, wherein managing comprises the enterprise posting one or more commands on the distributed ledger to enable one or more of the plurality of computing resources to obtain the one or more commands;
wherein one or more of the computing resources belong to at least one group specified by the enterprise to enable the enterprise to manage the at least one group via the one or more posted commands;
wherein the at least one group has an encryption key associated therewith;
wherein the enterprise publishes the encryption key in an identity profile established with the decentralized identity management system, and wherein the encryption key is encrypted with a private key of the at least one group and with a public key of a given one of the computing resources in the at least one group;
wherein the managing step further comprises, before posting the one or more commands, encrypting the one or more commands with the encryption key associated with the group;
wherein the managing step further comprises posting a plain-text message with the one or more encrypted commands to indicate to the one or more computing resources belonging to the at least one group that the one or more encrypted commands affect the one or more computing resources of the at least one group;
wherein the method is implemented via one or more processing devices each comprising a processor coupled to a memory.
2. The method of claim 1 , wherein the encryption key associated with the at least one group comprises a private key.
3. The method of claim 1 , wherein the one or more computing resources belonging to the at least one group decrypt the one or more commands.
4. The method of claim 3 , wherein the one or more computing resources belonging to the at least one group process the one or more commands.
5. The method of claim 4 , wherein processing the one or more commands, for a given one of the one or more computing resources, further comprises storing at least a portion of the one or more commands or status information associated with the one or more commands in an identity profile of the given computing resource.
6. The method of claim 1 , wherein the managing step further comprises updating the encryption key for the at least one group.
7. The method of claim 6 , wherein the updating step further comprises posting a command on the distributed ledger to the at least one group to resynchronize the encryption key.
8. The method of claim 7 , wherein the command to resynchronize the encryption key further comprises a distributed ledger offset.
9. The method of claim 1 , wherein the network comprises a public network.
10. The method of claim 1 , wherein a time to create the one or more commands and post the one or more commands on the distributed ledger is independent of a number of the plurality of computing resources and a number of the plurality of computing resources affected by the one or more commands.
11. The method of claim 1 , wherein, for a subset of the plurality of computing resources that intermittently connect to the distributed ledger, a node representing the subset of computing resources, upon the node connecting to the distributed ledger, obtains the one or more commands from the distributed ledger and provides the one or more commands to the subset of computing resources.
12. The method of claim 1 , wherein the managing step further comprises a given one of the plurality of computing resources reporting command processing results together with a distributed ledger offset of a last set of processed commands.
13. The method of claim 1 , wherein the decentralized identity management system is adapted from a blockstack-based system and the distributed ledger is a blockchain distributed ledger.
14. A system comprising:
one or more processing devices configured to:
in a network comprising a plurality of computing resources associated with an enterprise, establish an identity for each of the computing resources in accordance with a decentralized identity management system maintained in accordance with a distributed ledger; and
manage the plurality of computing resources in association with the distributed ledger, wherein managing comprises the enterprise posting one or more commands on the distributed ledger to enable one or more of the plurality of computing resources to obtain the one or more commands;
wherein one or more of the computing resources belong to at least one group specified by the enterprise to enable the enterprise to manage the at least one group via the one or more posted commands;
wherein the at least one group has an encryption key associated therewith;
wherein the enterprise publishes the encryption key in an identity profile established with the decentralized identity management system, and wherein the encryption key is encrypted with a private key of the at least one group and with a public key of a given one of the computing resources in the at least one group;
wherein the managing step further comprises, before posting the one or more commands, encrypting the one or more commands with the encryption key associated with the group;
wherein the managing step further comprises posting a plain-text message with the one or more encrypted commands to indicate to the one or more computing resources belonging to the at least one group that the one or more encrypted commands affect the one or more computing resources of the at least one group.
15. The system of claim 14 , wherein the managing step further comprises updating the encryption key for the at least one group.
16. The system of claim 15 , wherein the updating step further comprises posting a command on the distributed ledger to the at least one group to resynchronize the encryption key.
17. The system of claim 16 , wherein the command to resynchronize the encryption key further comprises a distributed ledger offset.
18. An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device to:
in a network comprising a plurality of computing resources associated with an enterprise, establish an identity for each of the computing resources in accordance with a decentralized identity management system maintained in accordance with a distributed ledger; and
manage the plurality of computing resources in association with the distributed ledger, wherein managing comprises the enterprise posting one or more commands on the distributed ledger to enable one or more of the plurality of computing resources to obtain the one or more commands;
wherein one or more of the computing resources belong to at least one group specified by the enterprise to enable the enterprise to manage the at least one group via the one or more posted commands;
wherein the at least one group has an encryption key associated therewith;
wherein the enterprise publishes the encryption key in an identity profile established with the decentralized identity management system, and wherein the encryption key is encrypted with a private key of the at least one group and with a public key of a given one of the computing resources in the at least one group;
wherein the managing step further comprises, before posting the one or more commands, encrypting the one or more commands with the encryption key associated with the group;
wherein the managing step further comprises posting a plain-text message with the one or more encrypted commands to indicate to the one or more computing resources belonging to the at least one group that the one or more encrypted commands affect the one or more computing resources of the at least one group.
19. The article of manufacture of claim 18 , wherein the managing step further comprises updating the encryption key for the at least one group.
20. The article of manufacture of claim 19 , wherein the updating step further comprises posting a command on the distributed ledger to the at least one group to resynchronize the encryption key.