Security system for using shared computational facilities
AssigneeROLLS-ROYCE plc
InventorBryan L LAPWORTH
Life of this patent
Estimating the term…
Abstract
A method and system for performing computational jobs securely on a shared computing resource. Data files for the computational job are encrypted on a secure system and the encrypted data files are stored in a data store on the shared computing resource. A key distribution server is established using a secure enclave on a front end of the shared computing resource. Cryptographic keys and application binaries are transferred to the enclave of the shared computing resource using a session key. The computational job is run using an application launcher on compute nodes of an untrusted execution environment of the shared computing resource, the application launcher obtaining the application binaries and the cryptographic keys from the key distribution server.
Claims19
A method of performing computational jobs securely on a shared computing resource, comprising:
- encrypting data files for a computational job on a secure system and storing the encrypted data files in a data store on the shared computing resource;
- establishing a key distribution server using a secure enclave on a front end of the shared computing resource;
- transferring cryptographic keys and application binaries to the secure enclave of the shared computing resource using a session key;
- running the computational job via an application launcher on compute nodes of an untrusted execution environment of the shared computing resource, said application launcher obtaining the application binaries for the computational job and the cryptographic keys for decrypting the encrypted data files from the key distribution server.
A shared computational system arranged to perform computational jobs instigated by a trusted system, the shared computational system comprising:
- a non-volatile data store arranged to store encrypted data files for a planned computational job;
- a key distribution server on a front end of the shared computational system having a secure enclave;
- an execution environment comprising multiple compute nodes and a key client for communication with the key distribution server so as to enable decryption of the data files and application binaries at launch-time for performing the planned computational job on the multiple compute nodes
- an application launcher on compute nodes of the shared computing resource, said application launcher arranged to obtain the application binaries and the cryptographic keys from the key distribution server.
Dependencies are inferred from the claim text.