HW Assisted Geo location and Boundary Control in the cloud
One of the key requirements for certain workloads moving from cloud servers from one location to another have to meet certain laws for data security, privacy, and other aspects of compliance. Determining the approximate physical location of a computing device, such as a cloud computing server, can be accomplished in many ways with traditional methods secured through operational controls and therefore cannot be trusted to meet cloud security needs.
The use case is to establish an automated hardware root of trust method for enforcing and monitoring geo location or boundary restrictions for cloud servers . A hardware root of trust is an inherently trusted combination of hardware and firmware that maintains the integrity of the platform and the asset/geo tag information that is stored in tamper-resistant hardware. This information is accessed by Cloud management and security tools using secure protocols to assert the integrity of the platform and Asset/Geo tag information of the computing device
link to Nova BluePrint: https:/
Blueprint information
- Status:
- Not started
- Approver:
- None
- Priority:
- Undefined
- Drafter:
- Jerry Wheeler
- Direction:
- Needs approval
- Assignee:
- None
- Definition:
- New
- Series goal:
- None
- Implementation:
-
Unknown
- Milestone target:
- None
- Started by
- Completed by
Related branches
Related bugs
Sprints
Whiteboard
Malini Bhandaru: Jerry, Nova uses gerrit review process to define and discuss a blueprint.
Please use this template: https:/
It is a text format, thus cannot include figures as is, but could include urls to the figures in your above wiki design doc.
Good job on the description and what additional this brings with respect to aggregates and availability zones.
Would be nice to have the location filter determine from the SAML assertion how to process the data, or perhaps the provisioning plugin be used to determine how to decode.
Additionally from a end user perspective, they might just want their VM to run in China or USA.
It would be good to have a location policy that says (country = USA, state = *) .. like wild cards to facilitate matching.
Trust/Location constraint may come via flavor extra specs or via image meta data.
While registering storage devices, it would also be good to be able to associate trust/location with them. Would complete out the design to mention these.
