Dataspace protection utilizing virtual private networks on a multi-node computer system

A computer implemented method for data security using virtual networks in a multi-node computer system, the method comprising the steps of:

• determining nodes to be protected;
• setting up a virtual private network to make the determined nodes become protected nodes by configuring access control data on the compute nodes to indicate one of a plurality of virtual networks is a virtual private network;
• providing data protection to nodes on the virtual private network through an access control mechanism, wherein data protection is provided based on the access control data in a system kernel in the nodes, wherein the access control data comprises the following for each virtual private network:
• class identification (ID), private flag that indicates the class ID is private, and an availability list that lists applications that are authorized to access the virtual private network;
• and
• allowing one or more authorized applications to access a protected node based on the access control data through a system call to the access control mechanism in the system kernel.

A computer implemented method for data security using virtual networks in a multi-node computer system, the method comprising the steps of:

• determining nodes to be protected in a massively parallel computer system;
• setting up a virtual private network to make the determined nodes become protected nodes by configuring a class routing table to set up a plurality of virtual networks, and by configuring access control data on the compute nodes to indicate one of the plurality of virtual networks is a virtual private network;
• providing data protection to nodes on the virtual private network through an access control mechanism, wherein data protection is provided based on the access control data in a system kernel in the nodes by intercepting read/write operations for an application that is not authorized to access data on a virtual private network and generating a failure indication, wherein the access control data comprises the following for each virtual private network:
• class identification (ID), private flag that indicates the class ID is private, and an availability list that lists applications that are authorized to access the virtual private network;
• and
• allowing one or more authorized applications to access a protected node based on the access control data through a system call to the access control mechanism in the system kernel.

A computer-readable article of manufacture comprising:

• an access setup mechanism that configures access control data on a plurality of compute nodes connected with a plurality of virtual networks, where the access control data indicates a virtual network is a virtual private network and what applications have access to the virtual private network;
• an access control mechanism that controls access to data in a memory on the plurality of compute nodes over the plurality of virtual networks based on the access control data to provide data protection to the nodes,
• wherein the access control mechanism located in a system kernel of the compute node provides data protection by allowing access to authorized applications based on the access control data through a system call to the system kernel, wherein the access control mechanism further provides data protection by intercepting data access for an application that is not authorized to access data on a virtual private network based on the access control data;
• wherein the access control data comprises the following for each virtual private network:
• class identification (ID), private flag that indicates the class ID is private, and an availability list that lists applications that are authorized to access the private virtual network;
• and
• non-transitory computer recordable media bearing the access setup mechanism and the access control mechanism.