Tracking cloud workloads to isolate security breach exposure

#The present disclosure relates to identifying the impact of security breaches, and more particularly, to identifying workloads affected by security breaches.

#In public cloud computing applications, clients who dispatch workloads to a provider's cloud network for execution must trust the cloud provider to protect information about the workload and data computed from the workload in the provider's cloud infrastructure. Typically, that trust is based upon anonymity (e.g., the difficulty in identifying targets for attack in the vastness of the cloud infrastructure) and the overall security of the cloud infrastructure in which the workload is dispatched (e.g., the security provisions enforced in the cloud network, and the cloud infrastructure's general resistance to attacks by malicious parties). Cloud users may be reluctant to dispatch sensitive workloads since cloud users cannot be certain that workloads will not be compromised during execution, and further cannot isolate a particular workload being compromised from a general compromise of any element of a cloud infrastructure.

#Typically, workloads are protected by “big fences”, e.g., security measures designed to keep bad actors out of the cloud network, preventing breaches of hosted workloads. Security measures may also include log analysis of the intersection of workload and host equipment maintained by the cloud provider. The client or user of the cloud must place trust in the cloud provider to identify breaches and communicate their affected domain. In instances where a client does not maintain detailed records of the workload dispatch, the cloud provider's information regarding a breach may not be sufficient to isolate exposure from a security breach, leading to a need to invalidate unnecessarily large blocks of computation (data and results) based upon imprecision in the tracking of what elements were affected by a breach.

#The present disclosure is described in the detailed description which follows, in reference to the noted plurality of drawings by way of non-limiting examples of exemplary embodiments of the present disclosure.

#FIG. 1 shows an illustrative architecture of a computing system implementing aspects of the present disclosure.

#FIG. 2 shows an exemplary cloud computing environment in accordance with aspects of the present disclosure.

#The present disclosure relates to identifying the impact of security breaches, and more particularly, may identify workloads affected by security breaches. In embodiments, a cloud provider (e.g., a provider of cloud network services) may provide fine-grained identification of client workloads and data affected by a breach or compromise of the provider's cloud infrastructure. In embodiments, digital signatures can be used to generate a tamper-evident log of the “chain of custody” of a client's workload and its associated data as the workload (or portion of a workload) traverses the cloud provider's network infrastructure. In this way, a workload is tracked within the cloud as the workload is transferred between multiple network elements within the cloud.

#As described herein, the “network elements” can be all cloud or network infrastructure that is involved working on a particular job or workload. For example, as described herein, the workload can be tracked as it is transferred between network elements, such as servers, storage arrays, and/or other devices that host, process, and/or execute the workload.

#When a breach is detected, the provider can publish the list of affected network elements (e.g., servers, storage arrays, and/or other physical devices that host, process, and/or execute the workload) and a customer/user of the cloud provider's cloud can use this published information as a filter to identify any exposed workload and data elements based upon finding all workloads and data affected by a compromised element of the cloud. A breach can be any particular type of security breach.