# US 11,122,079 B1 · Obfuscation for high-performance computing systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,079 B1 - Document ID: US11122079B1 - Status: Granted - Kind: B1 - Application number: 16/377,971 - Filed: 2019-04-08 - Granted: 2021-09-14 - Earliest claimed: 2019-04-08 - Assignees: Architecture Technology Corporation - Applicants: Architecture Technology Corporation - Inventors: Scott Aloisio; Robert A. Joyce; Paul Nicotera; Matthew A. Stillerman - Web page: https://patentgrep.com/patent/US11122079B1 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - G06F 21/14: against software analysis or reverse engineering, e.g. by obfuscation - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)} - H04L 63/105: {Multiple levels of security} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1475: {Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/101: {Access control lists [ACL]} - H04L 2463/146: Tracing the source of attacks - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An example technique includes initializing, by an obfuscation computing system, communications with nodes in a distributed computing platform. The nodes include compute nodes that provide resources in the distributed computing platform and a controller node that performs resource management of the resources. The obfuscation computing system serves as an intermediary between the controller node and the compute nodes. The technique further includes outputting an interactive user interface (UI) providing a selection between a first privilege level and a second privilege level, and performing one of: based on the selection being for the first privilege level, a first obfuscation mechanism for the distributed computing platform to obfuscate digital traffic between a user computing system and the nodes, or based on the selection being for the second privilege level, a second obfuscation mechanism for the distributed computing platform to obfuscate digital traffic between the user computing system and the nodes. ## Claims ### Claim 1 A method comprising: initializing, by an obfuscation computing system, communications with a plurality of nodes in a distributed computing platform, wherein the plurality of nodes includes one or more compute nodes that provide one or more resources in the distributed computing platform, wherein the plurality of nodes further includes a controller node that performs resource management of the one or more resources in the distributed computing platform, and wherein the obfuscation computing system serves as an intermediary between the controller node and the one or more compute nodes; outputting, by the obfuscation computing system, an interactive user interface (UI) providing a selection between at least a first privilege level and a second privilege level; and performing, by the obfuscation computing system, an obfuscation mechanism based on a privilege level, including: based on the selection being associated with the first privilege level, performing a first obfuscation mechanism for the distributed computing platform to obfuscate digital traffic between a user computing system and the plurality of nodes, and based on the selection being associated with the second privilege level, performing a second obfuscation mechanism for the distributed computing platform to obfuscate digital traffic between the user computing system and the plurality of nodes, and wherein performing the second obfuscation mechanism comprises performing obfuscating operations on unobfuscated information that is received from the user computing system and then sent as obfuscated information to the controller or the one or more compute nodes, and performing reciprocal operations on obfuscated response information that is received from the controller or the one or more compute nodes and then sent as obfuscated response information to the user computing system, wherein the first privilege level is associated with privileged users of the user computing system and the second privilege level is associated with unprivileged users of the user computing system. ### Claim 2 (depends on 1) The method of claim 1, wherein the first privilege level is associated with privileged users of the user computing system, and wherein performing the first obfuscation mechanism comprises forwarding the digital traffic between the user computing system and the plurality of nodes in unaltered form. ### Claim 3 (depends on 1) The method of claim 1, wherein the second privilege level is associated with unprivileged users of the user computing system, and wherein performing the second obfuscation mechanism comprises applying code-level obfuscation to the digital traffic between the user computing system and the plurality of nodes in unaltered form. ### Claim 4 (depends on 3) The method of claim 3, wherein applying the code-level obfuscation comprises: obfuscating data associated with one or more received commands from the user computing system to generate one or more obfuscated commands; and sending the one or more obfuscated commands to at least one of the plurality of nodes in the distributed computing platform. ### Claim 5 (depends on 1) The method of claim 1, further comprising: designating at least one node of the plurality of nodes as a decoy node; detecting a portion of the digital traffic that requests access to the decoy node; and based on the portion of the digital traffic requesting the access to the decoy node: determining that a user identity requesting the access to the decoy node is a malicious user identity; and initiating a tripwire functionality with respect to the malicious user identity. ### Claim 6 (depends on 5) The method of claim 5, wherein initiating the tripwire functionality with respect to the malicious user identity comprises updating the interactive UI identifying the malicious user identity. ### Claim 7 (depends on 5) The method of claim 5, wherein designating the at least one node as the decoy node comprises: determining that the at least one decoy node is dormant with respect to activity over the distributed computing platform; and selecting the at least one node to be designated as the decoy node based on the at least one node being dormant with respect to the activity over the distributed computing platform. ### Claim 8 (depends on 1) The method of claim 1, further comprising: monitoring, by the obfuscation computing system, the digital traffic over the distributed computing platform; and outputting, by the obfuscation computing system, via the interactive UI, information describing the monitored digital traffic. ### Claim 9 An obfuscation system comprising: a memory; and processing circuitry in communication with the memory, the processing circuitry being configured to: initialize communications with a plurality of nodes in a distributed computing platform, wherein the plurality of nodes includes one or more compute nodes that provide one or more resources in the distributed computing platform, wherein the plurality of nodes further includes a controller node that performs resource management of the one or more resources in the distributed computing platform, and wherein the obfuscation system serves as an intermediary between the controller node and the one or more compute nodes; output an interactive user interface (UT) providing a selection between at least a first privilege level and a second privilege level; based on the selection being associated with the first privilege level, perform a first obfuscation mechanism for the distributed computing platform to obfuscate digital traffic between a user computing system and the plurality of nodes; and based on the selection being associated with the second privilege level, perform a second obfuscation mechanism for the distributed computing platform to obfuscate digital traffic between the user computing system and the plurality of nodes, and wherein performing the second obfuscation mechanism comprises performing obfuscating operations on unobfuscated information that is received from the user computing system and then sent as obfuscated information to the controller or the one or more compute nodes, and performing reciprocal operations on obfuscated response information that is received from the controller or the one or more compute nodes and then sent as obfuscated response information to the user computing system, wherein the first privilege level is associated with privileged users of the user computing system and the second privilege level is associated with unprivileged users of the user computing system. ### Claim 10 (depends on 9) The obfuscation system of claim 9, wherein the first privilege level is associated with privileged users of the user computing system, and wherein to perform the first obfuscation mechanism, the processing circuitry is configured to forward the digital traffic between the user computing system and the plurality of nodes in unaltered form. ### Claim 11 (depends on 10) The obfuscation system of claim 10, further comprising a network interface in communication with the processing circuitry, wherein to forward the digital traffic, the processing circuitry is configured forward the digital traffic via the network interface. ### Claim 12 (depends on 9) The obfuscation system of claim 9, wherein the second privilege level is associated with unprivileged users of the user computing system, and wherein to perform the second obfuscation mechanism, the processing circuitry is configured to apply code-level obfuscation to the digital traffic between the user computing system and the plurality of nodes in unaltered form. ### Claim 13 (depends on 12) The obfuscation system of claim 12, wherein to apply the code-level obfuscation, the processing circuitry is configured to: obfuscate data associated with one or more received from the user computing system to generate one or more obfuscated commands; and send the one or more obfuscated commands to at least one of the plurality of nodes in the distributed computing platform. ### Claim 14 (depends on 9) The obfuscation system of claim 9, wherein the processing circuitry is further configured to: designate at least one node of the plurality of nodes as a decoy node; detect a portion of the digital traffic that requests access to the decoy node; and based on the portion of the digital traffic requesting the access to the decoy node: determine that a user identity requesting the access to the decoy node is a malicious user identity; and initiate a tripwire functionality with respect to the malicious user identity. ### Claim 15 (depends on 14) The obfuscation system of claim 14, wherein to initiate the tripwire functionality with respect to the malicious user identity, the processing circuitry is configured to update the interactive UI identifying the malicious user identity. ### Claim 16 (depends on 14) The obfuscation system of claim 14, wherein to designate the at least one node as the decoy node, the processing circuitry is configured to: determine that the at least one decoy node is dormant with respect to activity over the distributed computing platform; and select the at least one node to be designated as the decoy node based on the at least one node being dormant with respect to the activity over the distributed computing platform. ### Claim 17 (depends on 9) The obfuscation system of claim 9, wherein the processing circuitry is further configured to receive, via the interactive UI, an indication of the selection. ### Claim 18 (depends on 9) The obfuscation system of claim 9, wherein the processing circuitry is further configured to: monitor the digital traffic over the distributed computing platform; and output, via the interactive UI, information describing the monitored digital traffic. ### Claim 19 (depends on 9) The obfuscation system of claim 9, further comprising an input device, wherein to receive the indication of the selection, the processing circuitry is configured to receive the indication of the selection via the input device and via the interactive UI. ### Claim 20 A non-transitory computer-readable storage medium encoded with instructions that, when executed, cause processing circuitry of an obfuscation system to: initialize communications with a plurality of nodes in a distributed computing platform, wherein the plurality of nodes includes one or more compute nodes that provide one or more resources in the distributed computing platform, wherein the plurality of nodes further includes a controller node that performs resource management of the one or more resources in the distributed computing platform, and wherein the obfuscation computing system serves as an intermediary between the controller node and the one or more compute nodes; output an interactive user interface (UT) providing a selection between at least a first privilege level and a second privilege level; and perform an obfuscation mechanism based on a privilege level, including: based on the selection being associated with the first privilege level, perform a first obfuscation mechanism for the distributed computing platform to obfuscate digital traffic between a user computing system and the plurality of nodes, and based on the selection being associated with the second privilege level, perform a second obfuscation mechanism for the distributed computing platform to obfuscate digital traffic between the user computing system and the plurality of nodes, and wherein performing the second obfuscation mechanism comprises performing obfuscating operations on unobfuscated information that is received from the user computing system and then sent as obfuscated information to the controller or the one or more compute nodes, and performing reciprocal operations on obfuscated response information that is received from the controller or the one or more compute nodes and then sent as obfuscated response information to the user computing system, wherein the first privilege level is associated with privileged users of the user computing system and the second privilege level is associated with unprivileged users of the user computing system.