OpenStack - User contributions [en]

Horizon-geo-trust-display

2014-09-04T22:01:44Z

Jerry Wheeler:

OpenStack Horizon dashboard displays compute nodes, instances, and images available in an OpenStack cloud instance.

The goal here is to display whether the compute node has booted in a trusted manner and its '''geo'''graphical properties. We propose integrating in the UI the ability to provision geo tags. Likewise, for virtual machine instances, would like to display the geo of the machine it is running on. For images, would like to display any trust or geo constraints associated with the image.

For purposes of illustration, please refer to the images below captured from a proof of concept implementation developed at Intel (images courtesy Jerry Wheeler).

== Possible Implementation ==
[[File:Geo-tag-instances.jpg|Trust and Geo Tags associated with a virtual machine instance.]]

[[File:Ge-tag-images.jpg|Trust and Geo Tags associated with a virtual machine instance.]]

== Requesting Feedback ==
=== Column Header ===
Please suggest a column title. The place holder is '''Trust-Status'''. '''Tags''' or '''Properties''' may be more generic.

=== Geo Icon or String ===
Use a '''map icon''' with a hover-over behavior that provides location details.
[[File:04_maps.png| map icon]]

or

Provide '''location-string''' such as country-string or city/state/country string with more details on hover-over.

or

'''location-string''' that is a link to a page with more details.

2014-08-27T20:08:22Z

Jerry Wheeler:

Trusted-Location-Control

2014-08-27T20:02:42Z

Jerry Wheeler:

== '''<big>Hardware assisted Geo and Asset Tagging </big> ==

While the cloud enables workloads and data to reside anywhere, users may be constrained to run their workloads and save their data in certain geographies due to regulatory requirements. This solution will extend to include trusting the location and boundary of the hardware resources, extending the current functionality of trusting the integrality of the compute platform to be free of malware and rootkits. Extensions from this solution enable associating geo and asset tags with hardware at provision time. Intel Trusted Execution Environment (TXT) and other measured launch environments (MLEs) facilitate measurement of provision time information into the Trusted Platform Module (TPM). Remote attestation services can then be used to ascertain that provision time meta-data have not been tampered. Geo and Asset tagging builds on the Trusted Compute Pools feature, covered in [[TrustedComputingPools]]

This blueprint details how geo and asset tagging can be incorporated and taken advantage of in OpenStack clouds to provide location and boundary control of workloads/OpenStack images. With Geo/Asset Tags, you can enforce policies to control placement, migration or bursting of workloads to trusted systems in specific geographical locations or boundaries, provide visibility and compliance of your workload policies to ensure tenants that of its compliance to Trust and location policies.

=== Principles of Operation ===

[[File:Principles-of-operation.jpg|800px]]

=== What is Geo/Asset Tag? ===

[[File:What-is-tag.jpg|800px]]

=== Proposed Changes ===

[[File:HW-Geo-tag overview.gif]]

=== Geo and Asset Tagging Solution ===

# Provision geo tags to Compute Hosts using ‘Remote Attestation solution’
## Create a tag or tags
## Create a selection ID by selecting one or more tags
## Provision a selection ID to the asset (ex: Compute Host). The Provisioning process will include generation of Asset Certificate and writing the SHA1 of the certificate to TPM’s NVRAM
## Reboot the host to complete the provisioning process, which will extend the hash to PCR 22 register of TPM.
## For more details follow the instructions in Remote Attestation Solution product guide.
# Create and Add Geo-Location/Asset-tag Policies to VM Image Properties in ‘Open Stack’
## The following changes have been made to the Images page under the Admin tab.
### Display of Trust Policies assigned to each Image.
### Trust Policies can be created and edited in the ‘Create Image’ tab and ‘Edit’ function for each Image.
## Trust Policies, for now, include Platform Integrity and Location and in the future will include VM Integrity.
## Trust Policies and related information as stored as Image properties in the glance database.
## If Trust Policy for Location is selected, Platform Integrity is automatically selected.
## When selecting the Location Trust; user will have option to create policy of one or more of the 5 Key name and value pairs.
## 5 key names include: Country, State, City. Region and Classification.
## Acceptable values for each Key Name will need to be selected from a drop down list. The acceptable values are fetched from the ‘Remote Attestation Solution’
## Below are screen shots of changes that displays ‘Trust Policies’ assigned to each image and Trust Policy creation/edit function in the Update Image page.

[[File:Ge-tag-images.jpg|1050px]]

# Asset/Location Filter in Scheduler to orchestrate and control ‘Trust Policies’.
## When a user selects an image to be launched for an instance, the scheduler retrieves the ‘Trust Policy’ for the Glance database
## Scheduler iterates through the available host and fetches the SAML assertion from the ‘Remote Attestation Service’ using Restful API.
## SAML Assertion is parsed to determine match to the ‘Trust Policy’ and once these iterations are completed, scheduler will complete the remaining filter operation and then picks the best ranked host to launch the instance.
# Trust Visibility within OpenStack Horizon
## Horizon dashboards have been updated to display Trust Status in 2 dashboards under the Admin Tab – Hypervisor and Instances
## The Hypervisor dashboard displays trust status of all Policies (Platform and Location). In addition, when you mouse over the location icon it will show the Asset/Geo tag provisioned in the Hardware of the host.
## Every time the Hypervisor dashboard is loaded, ‘Trust Status’ is updated by fetching the SAML assertion from the ‘Remote Attestation Service’ using Restful API.
## The Instance dashboard displays trust status of all Policies (Platform and Location). In addition, when you mouse over the location icon it will show the Location/ Tag Policy applied.
## if there are no Trust policies associated to the image the Instance is using, then the Trust Status for that instance will be empty.
## Trusted Icons for each policy will be displayed in ‘green’ and untrusted in ‘Red’
## Below are screen shots of the horizon hypervisor and instance dashboard.
[[File:Hypervisor-trust.jpg]]

=== Nova Aggregates and Availability Zones ===

The partitioning, resource reservation, and fault tolerance benefits, that Nova aggregates and availability zones bring, have a lot in common with geo/asset tags. However, the main difference is that trusted tags are provision time values, and attached to the hardware resource. The trusted geo/asset tag by virtue of being associated with a hardware root of trust is more valuable with respect to meeting regulatory requirements.

=== Nova Compute Node Provisioning ===

During compute nodes provisioning, geo/asset tags may also be assigned. These can be simple strings, such as, "3 rd Floor, Expo Center, Hong Kong", or complex, such as XML data providing sub-items such as GPS co-ordinates, postal address, and more, or json strings.

=== Nova Scheduler Filter ===

Asset /Geo Tag filters are specified. They will be very similar to today's Aggregate and Availability filters with the distinction that the data they retrieve from the Attestation service may need to be parsed. For instance, geo/asset tag is retrieved as XML.

=== Attestation Service ===

Existing Remote Attestation servers need to be upgraded to understand geo/asset tags, supporting the API to retrieve them for registered hardware resources. The geo/asset tags retrieved for hardware resource could be cached at the attestation service or even at the nova scheduler to speed scheduling decisions as long as the cached value is no older than some specifiable time window.

Trusted-Location-Control

2014-08-27T19:59:12Z

Jerry Wheeler:

== '''<big>Hardware assisted Geo and Asset Tagging </big> ==

While the cloud enables workloads and data to reside anywhere, users may be constrained to run their workloads and save their data in certain geographies due to regulatory requirements. This solution will extend to include trusting the location and boundary of the hardware resources, extending the current functionality of trusting the integrality of the compute platform to be free of malware and rootkits. Extensions from this solution enable associating geo and asset tags with hardware at provision time. Intel Trusted Execution Environment (TXT) and other measured launch environments (MLEs) facilitate measurement of provision time information into the Trusted Platform Module (TPM). Remote attestation services can then be used to ascertain that provision time meta-data have not been tampered. Geo and Asset tagging builds on the Trusted Compute Pools feature, covered in [[TrustedComputingPools]]

This blueprint details how geo and asset tagging can be incorporated and taken advantage of in OpenStack clouds to provide location and boundary control of workloads/OpenStack images. With Geo/Asset Tags, you can enforce policies to control placement, migration or bursting of workloads to trusted systems in specific geographical locations or boundaries, provide visibility and compliance of your workload policies to ensure tenants that of its compliance to Trust and location policies.

=== Principles of Operation ===

[[File:Principles-of-operation.jpg|800px]]

=== What is Geo/Asset Tag? ===

[[File:What-is-tag.jpg|800px]]

=== Proposed Changes ===

[[File:HW-Geo-tag overview.gif]]

=== Geo and Asset Tagging Solution ===

# Provision geo tags to Compute Hosts using ‘Remote Attestation solution’
## Create a tag or tags
## Create a selection ID by selecting one or more tags
## Provision a selection ID to the asset (ex: Compute Host). The Provisioning process will include generation of Asset Certificate and writing the SHA1 of the certificate to TPM’s NVRAM
## Reboot the host to complete the provisioning process, which will extend the hash to PCR 22 register of TPM.
## For more details follow the instructions in Remote Attestation Solution product guide.
# Create and Add Geo-Location/Asset-tag Policies to VM Image Properties in ‘Open Stack’
## The following changes have been made to the Images page under the Admin tab.
### Display of Trust Policies assigned to each Image.
### Trust Policies can be created and edited in the ‘Create Image’ tab and ‘Edit’ function for each Image.
## Trust Policies, for now, include Platform Integrity and Location and in the future will include VM Integrity.
## Trust Policies and related information as stored as Image properties in the glance database.
## If Trust Policy for Location is selected, Platform Integrity is automatically selected.
## When selecting the Location Trust; user will have option to create policy of one or more of the 5 Key name and value pairs.
## 5 key names include: Country, State, City. Region and Classification.
## Acceptable values for each Key Name will need to be selected from a drop down list. The acceptable values are fetched from the ‘Remote Attestation Solution’
## Below are screen shots of changes that displays ‘Trust Policies’ assigned to each image and Trust Policy creation/edit function in the Update Image page.
# Asset/Location Filter in Scheduler to orchestrate and control ‘Trust Policies’.
## When a user selects an image to be launched for an instance, the scheduler retrieves the ‘Trust Policy’ for the Glance database
## Scheduler iterates through the available host and fetches the SAML assertion from the ‘Remote Attestation Service’ using Restful API.
## SAML Assertion is parsed to determine match to the ‘Trust Policy’ and once these iterations are completed, scheduler will complete the remaining filter operation and then picks the best ranked host to launch the instance.
# Trust Visibility within OpenStack Horizon
## Horizon dashboards have been updated to display Trust Status in 2 dashboards under the Admin Tab – Hypervisor and Instances
## The Hypervisor dashboard displays trust status of all Policies (Platform and Location). In addition, when you mouse over the location icon it will show the Asset/Geo tag provisioned in the Hardware of the host.
## Every time the Hypervisor dashboard is loaded, ‘Trust Status’ is updated by fetching the SAML assertion from the ‘Remote Attestation Service’ using Restful API.
## The Instance dashboard displays trust status of all Policies (Platform and Location). In addition, when you mouse over the location icon it will show the Location/ Tag Policy applied.
## if there are no Trust policies associated to the image the Instance is using, then the Trust Status for that instance will be empty.
## Trusted Icons for each policy will be displayed in ‘green’ and untrusted in ‘Red’
## Below are screen shots of the horizon hypervisor and instance dashboard.
[[File:Hypervisor-trust.jpg]]

=== Nova Aggregates and Availability Zones ===

The partitioning, resource reservation, and fault tolerance benefits, that Nova aggregates and availability zones bring, have a lot in common with geo/asset tags. However, the main difference is that trusted tags are provision time values, and attached to the hardware resource. The trusted geo/asset tag by virtue of being associated with a hardware root of trust is more valuable with respect to meeting regulatory requirements.

=== Nova Compute Node Provisioning ===

During compute nodes provisioning, geo/asset tags may also be assigned. These can be simple strings, such as, "3 rd Floor, Expo Center, Hong Kong", or complex, such as XML data providing sub-items such as GPS co-ordinates, postal address, and more, or json strings.

=== Nova Scheduler Filter ===

Asset /Geo Tag filters are specified. They will be very similar to today's Aggregate and Availability filters with the distinction that the data they retrieve from the Attestation service may need to be parsed. For instance, geo/asset tag is retrieved as XML.

=== Attestation Service ===

Existing Remote Attestation servers need to be upgraded to understand geo/asset tags, supporting the API to retrieve them for registered hardware resources. The geo/asset tags retrieved for hardware resource could be cached at the attestation service or even at the nova scheduler to speed scheduling decisions as long as the cached value is no older than some specifiable time window.

Jerry Wheeler:

Trusted-Location-Control

2014-08-27T15:32:27Z

Jerry Wheeler:

== '''<big>Hardware assisted Geo and Asset Tagging </big> ==

While the cloud enables workloads and data to reside anywhere, users may be constrained to run their workloads and save their data in certain geographies due to regulatory requirements. This solution will extend to include trusting the location and boundary of the hardware resources, extending the current functionality of trusting the integrality of the compute platform to be free of malware and rootkits. Extensions from this solution enable associating geo and asset tags with hardware at provision time. Intel Trusted Execution Environment (TXT) and other measured launch environments (MLEs) facilitate measurement of provision time information into the Trusted Platform Module (TPM). Remote attestation services can then be used to ascertain that provision time meta-data have not been tampered. Geo and Asset tagging builds on the Trusted Compute Pools feature, covered in [[TrustedComputingPools]]

This blueprint details how geo and asset tagging can be incorporated and taken advantage of in OpenStack clouds to provide location and boundary control of workloads/OpenStack images. With Geo/Asset Tags, you can enforce policies to control placement, migration or bursting of workloads to trusted systems in specific geographical locations or boundaries, provide visibility and compliance of your workload policies to ensure tenants that of its compliance to Trust and location policies.

=== Principles of Operation ===

[[File:Principles-of-operation.jpg]]

=== What is Geo/Asset Tag? ===

[[File:What-is-tag.jpg]]

=== Proposed Changes ===

[[File:HW-Geo-tag overview.gif]]

=== Geo and Asset Tagging Solution ===

# Provision geo tags to Compute Hosts using ‘Remote Attestation solution’
## Create a tag or tags
## Create a selection ID by selecting one or more tags
## Provision a selection ID to the asset (ex: Compute Host). The Provisioning process will include generation of Asset Certificate and writing the SHA1 of the certificate to TPM’s NVRAM
## Reboot the host to complete the provisioning process, which will extend the hash to PCR 22 register of TPM.
## For more details follow the instructions in Remote Attestation Solution product guide.
# Create and Add Geo-Location/Asset-tag Policies to VM Image Properties in ‘Open Stack’
## The following changes have been made to the Images page under the Admin tab and Images & Snapshots and Instances under the Project tab within open stack
## fill technical details on changes – what code was change, where is data stored and more…
## <add screen shots>
##
[[File:Geo-tag-instances.jpg]]
##
##
##

##
## On Horizon dashboard Image creation/edit page(s), User to select a tag key from the pre-configured tag key list [Country, State/Province, City, Region, Classification]
## Associate the keys with the appropriate values
## On image creation or editing, Horizon updates the glance database to store the list of tag key/value pairs as image properties.
# Add Asset/Location Filter to Scheduler
## Naresh to add technical details including API calls.
## For the selected image, retrieves the list of tag key/value pairs from the glance database.
## For each host, retrieves the trust and geo-tag details
## Maps the image trust and geo-tag requirements with the server geo-tag and filters appropriately
## NOTE: This filter does not assign a weight to the hosts
## Screen shots before and after launching an instance with a image policy

=== Nova Aggregates and Availability Zones ===

The partitioning, resource reservation, and fault tolerance benefits that Nova aggregates and availability zones bring have a lot in common with geo tags. However, the main difference is that trusted tags are provision time values, and attached to the hardware resource. The trusted geo-tag by virtue of being associated with a hardware root of trust is more valuable with respect to meeting regulatory requirements.

=== Nova Compute Node Provisioning ===

During compute nodes provisioning for trust, geo-tags may also be assigned. These can be simple strings, such as, "3 rd Floor, Expo Center, Hong Kong", or complex, such as XML data providing sub-items such as GPS co-ordinates, postal address, and more, or json strings.

=== Nova Scheduler Filter ===

Asset /Geo Tag filters should be specified. They will be very similar to todays Aggregate and Availability filters with the distinction that the data they retrieve from the Attestation service may need to be parsed. For instance, geo-tag data may be retrieved as a json string or as XML. In the case of XML,

=== Attestation Service ===

Existing Remote Attestion servers need to be upgraded to understand geo tags, supporting the API to retrieve them for registered hardware resources. The geo tags retrieved for hardware resource could be cached at the attestation service or even at the nova scheduler to speed scheduling decisions as long as the cached value is no older than some specifiable time window.

The simplest geo tag is a string, while more complex variants are XML and json strings. A match policy (country match, state and country match, or city, state, and country match) and a formatter to parse a given representation is required to facilitate match.

2014-08-26T22:36:53Z

Jerry Wheeler:

== '''<big>Hardware assisted Geo and Asset Tagging </big> ==

While the cloud enables workloads and data to reside anywhere, users may be constrained to run their workloads and save their data in certain geographies due to regulatory requirements. This solution will extend to include trusting the location and boundary of the hardware resources, extending the current functionality of trusting the integrality of the compute platform to be free of malware and rootkits. Extensions from this solution enable associating geo and asset tags with hardware at provision time. Intel Trusted Execution Environment (TXT) and other measured launch environments (MLEs) facilitate measurement of provision time information into the Trusted Platform Module (TPM). Remote attestation services can then be used to ascertain that provision time meta-data have not been tampered. Geo and Asset tagging builds on the Trusted Compute Pools feature, covered in [[TrustedComputingPools]]

This blueprint details how geo and asset tagging can be incorporated and taken advantage of in OpenStack clouds to provide location and boundary control of workloads/OpenStack images. With Geo/Asset Tags, you can enforce policies to control placement, migration or bursting of workloads to trusted systems in specific geographical locations or boundaries, provide visibility and compliance of your workload policies to ensure tenants that of its compliance to Trust and location policies.

=== Principles of Operation ===

[[File:Principles-of-operation.jpg]]

=== What is Geo/Asset Tag? ===

[[File:What-is-tag.jpg]]

=== Proposed Changes ===

[[File:HW-Geo-tag overview.gif]]

== Geo and Asset tagging Solution ==

Provision geo tags to Compute Hosts using ‘Remote Attestation solution’
Create a tag or tags
Create a selection ID by selecting one or more tags
Provision a selection ID to the asset (ex: Compute Host). The Provisioning process will include generation of Asset Certificate and writing the SHA1 of the certificate to TPM’s NVRAM
Reboot the host to complete the provisioning process, which will extend the hash to PCR 22 register of TPM.
For more details follow the instructions in Remote Attestation Solution product guide.

# Add Geo-Location/Asset-tag VM Policies as VM Image Properties
## On Horizon dashboard Image creation/edit page(s), User to select a tag key from the pre-configured tag key list [Country, State/Province, City, Region, Classification]
## Associate the keys with the appropriate values
## On image creation or editing, Horizon updates the glance database to store the list of tag key/value pairs as image properties.
# Add Asset/Location Filter to Scheduler
## Create a new filter scheduler for geo-tag and trust attestation. It does the following
## For the selected image, retrieves the list of tag key/value pairs from the glance database.
## For each host, retrieves the trust and geo-tag details (Attestation service API: /mtwilson/v1/AttestationService/resources/saml/assertions/host)
## Maps the image trust and geo-tag requirements with the server geo-tag and filters appropriately.
## NOTE: This filter does not assign a weight to the hosts
# UI/Portal Extensions for Trust/Location info/attestation
## Adding Trust and geo location information to the horizon dashboard
## Added trust and geo-tag indicators(icons) to images, instances and hypervisor pages

=== Nova Aggregates and Availability Zones ===

The partitioning, resource reservation, and fault tolerance benefits that Nova aggregates and availability zones bring have a lot in common with geo tags. However, the main difference is that trusted tags are provision time values, and attached to the hardware resource. Re-purposing a machine is more easy via the command line with aggregates and availability zones, does not require machine reboot, but to modify trusted geo-tags more deliberate action is required, a machine reboot. The trusted geo-tag by virtue of being associated with a hardware root of trust is more valuable with respect to meeting regulatory requirements.

Further, the Attestation service could be independent of the cloud provider to increase credibility and better meet regulatory requirements. In addition, geo-tags can be verified with about 90% accuracy using software techniques using the Internet Protocol (IP) address of the device being attested.

This blueprint details how geo-tags can be incorporated and taken advantage of in OpenStack clouds.

=== Nova Compute Node Provisioning ===

During compute nodes provisioning for trust, geo-tags may also be assigned. These can be simple strings, such as, "3 rd Floor, Expo Center, Hong Kong", or complex, such as XML data providing sub-items such as GPS co-ordinates, postal address, and more, or json strings.

=== Dashboard ===
# Image properties field readily supports specifying geo and other asset tag constraints.
# Displaying VM and Image geo/asset tag affiliations. The Horizon UI for instance and Image lists could be extended to display in addition to current information, trusted and geo tags. For example, it would be logical to add a little trusted seal if a compute node is trusted, and by extension a VM running on the same compute node. A country flag would be a good geo indicator.
# Object listings Could also contain geo indicators.

=== Nova Scheduler Filter ===

Asset /Geo Tag filters should be specified. They will be very similar to todays Aggregate and Availability filters with the distinction that the data they retrieve from the Attestation service may need to be parsed. For instance, geo-tag data may be retrieved as a json string or as XML. In the case of XML,

=== Attestation Service ===

Existing Attestion services need to be upgraded to understand geo tags, support an API to retrieve them for registered hardware resources. The geo tags retrieved for hardware resource could be cached at the attestation service or even at the nova scheduler to speed scheduling decisions as long as the cached value is no older than some specifiable time window.

The simplest geo tag is a string, while more complex variants are XML and json strings. A match policy (country match, state and country match, or city, state, and country match) and a formatter to parse a given representation is required to facilitate match.

File:What-is-tag.jpg

2014-08-26T22:32:44Z

Jerry Wheeler:

Trusted-Location-Control

2014-08-26T22:30:49Z

Jerry Wheeler:

== '''<big>Hardware assisted Geo and Asset Tagging </big> ==

While the cloud enables workloads and data to reside anywhere, users may be constrained to run their workloads and save their data in certain geographies due to regulatory requirements. This solution will extend to include trusting the location and boundary of the hardware resources, extending the current functionality of trusting the integrality of the compute platform to be free of malware and rootkits. Extensions from this solution enable associating geo and asset tags with hardware at provision time. Intel Trusted Execution Environment (TXT) and other measured launch environments (MLEs) facilitate measurement of provision time information into the Trusted Platform Module (TPM). Remote attestation services can then be used to ascertain that provision time meta-data have not been tampered. Geo and Asset tagging builds on the Trusted Compute Pools feature, covered in [[TrustedComputingPools]]

This blueprint details how geo and asset tagging can be incorporated and taken advantage of in OpenStack clouds to provide location and boundary control of workloads/OpenStack images. With Geo/Asset Tags, you can enforce policies to control placement, migration or bursting of workloads to trusted systems in specific geographical locations or boundaries, provide visibility and compliance of your workload policies to ensure tenants that of its compliance to Trust and location policies.

=== Principles of Operation ===

[[File:Principles-of-operation.jpg]]

=== Proposed Changes ===

[[File:HW-Geo-tag overview.gif]]

== Geo-Location/Asset-tag process ==

# Provision Geo-Location/Asset-tag to Host
## Create a tag or tags in the Attestation Server
## Create a selection with one or more tags
## Provision host with hash of the selection
## Write the geo-tag to the TPM
# Add Geo-Location/Asset-tag VM Policies as VM Image Properties
## On Horizon dashboard Image creation/edit page(s), User to select a tag key from the pre-configured tag key list [Country, State/Province, City, Region, Classification]
## Associate the keys with the appropriate values
## On image creation or editing, Horizon updates the glance database to store the list of tag key/value pairs as image properties.
# Add Asset/Location Filter to Scheduler
## Create a new filter scheduler for geo-tag and trust attestation. It does the following
## For the selected image, retrieves the list of tag key/value pairs from the glance database.
## For each host, retrieves the trust and geo-tag details (Attestation service API: /mtwilson/v1/AttestationService/resources/saml/assertions/host)
## Maps the image trust and geo-tag requirements with the server geo-tag and filters appropriately.
## NOTE: This filter does not assign a weight to the hosts
# UI/Portal Extensions for Trust/Location info/attestation
## Adding Trust and geo location information to the horizon dashboard
## Added trust and geo-tag indicators(icons) to images, instances and hypervisor pages

=== Nova Aggregates and Availability Zones ===

The partitioning, resource reservation, and fault tolerance benefits that Nova aggregates and availability zones bring have a lot in common with geo tags. However, the main difference is that trusted tags are provision time values, and attached to the hardware resource. Re-purposing a machine is more easy via the command line with aggregates and availability zones, does not require machine reboot, but to modify trusted geo-tags more deliberate action is required, a machine reboot. The trusted geo-tag by virtue of being associated with a hardware root of trust is more valuable with respect to meeting regulatory requirements.

Further, the Attestation service could be independent of the cloud provider to increase credibility and better meet regulatory requirements. In addition, geo-tags can be verified with about 90% accuracy using software techniques using the Internet Protocol (IP) address of the device being attested.

This blueprint details how geo-tags can be incorporated and taken advantage of in OpenStack clouds.

=== Nova Compute Node Provisioning ===

During compute nodes provisioning for trust, geo-tags may also be assigned. These can be simple strings, such as, "3 rd Floor, Expo Center, Hong Kong", or complex, such as XML data providing sub-items such as GPS co-ordinates, postal address, and more, or json strings.

=== Dashboard ===
# Image properties field readily supports specifying geo and other asset tag constraints.
# Displaying VM and Image geo/asset tag affiliations. The Horizon UI for instance and Image lists could be extended to display in addition to current information, trusted and geo tags. For example, it would be logical to add a little trusted seal if a compute node is trusted, and by extension a VM running on the same compute node. A country flag would be a good geo indicator.
# Object listings Could also contain geo indicators.

=== Nova Scheduler Filter ===

Asset /Geo Tag filters should be specified. They will be very similar to todays Aggregate and Availability filters with the distinction that the data they retrieve from the Attestation service may need to be parsed. For instance, geo-tag data may be retrieved as a json string or as XML. In the case of XML,

=== Attestation Service ===

Existing Attestion services need to be upgraded to understand geo tags, support an API to retrieve them for registered hardware resources. The geo tags retrieved for hardware resource could be cached at the attestation service or even at the nova scheduler to speed scheduling decisions as long as the cached value is no older than some specifiable time window.

The simplest geo tag is a string, while more complex variants are XML and json strings. A match policy (country match, state and country match, or city, state, and country match) and a formatter to parse a given representation is required to facilitate match.

File:Principles-of-operation.jpg

2014-08-26T22:25:08Z

Jerry Wheeler:

Trusted-Location-Control

2014-08-22T15:30:28Z

Jerry Wheeler: /* Geo-Location/Asset-tag process */

== '''<big>Hardware assisted Geo location and Asset Tagging</big> ==

While the cloud enables workloads and data to reside anywhere, users may be constrained to run their workloads and save their data in certain geographies due to regulatory reasons. This extends beyond trusting the cloud's hardware resources to be free of malware and rootkits. Extensions to Trusted Compute Pools (TCP) enable associating with hardware at provision time geo-tags. Intel Trusted Execution Environment (TXT) and other measured launch environments (MLEs) facilitate measuring such provision time information into the Trusted Platform Module (TPM). Attestation services can be used to ascertain that provision time meta data have not been tampered.

Asset and Geo Tags can be used to:

Monitor and Enforce policies to control placement, migration or bursting to trusted systems in specific geographical locations

# Control workload placement
# Provide Control and Visibility to Cloud End-users
## Display in dashboard the asset/geo associations of VM and hosts
## Generate audit logs of Hardware/VMs/data with asset/geo details.

Geo Tagging builds on the Trusted Compute Pools feature, covered in [[TrustedComputingPools]]

=== Proposed Changes ===

[[File:HW-Geo-tag overview.gif]]

== Geo-Location/Asset-tag process ==

# Provision Geo-Location/Asset-tag to Host
## Create a tag or tags in the Attestation Server
## Create a selection with one or more tags
## Provision host with hash of the selection
## Write the geo-tag to the TPM
# Add Geo-Location/Asset-tag VM Policies as VM Image Properties
## On Horizon dashboard Image creation/edit page(s), User to select a tag key from the pre-configured tag key list [Country, State/Province, City, Region, Classification]
## Associate the keys with the appropriate values
## On image creation or editing, Horizon updates the glance database to store the list of tag key/value pairs as image properties.
# Add Asset/Location Filter to Scheduler
## Create a new filter scheduler for geo-tag and trust attestation. It does the following
## For the selected image, retrieves the list of tag key/value pairs from the glance database.
## For each host, retrieves the trust and geo-tag details
## Maps the image trust and geo-tag requirements with the server geo-tag and filters appropriately.
## NOTE: This filter does not assign a weight to the hosts
# UI/Portal Extensions for Trust/Location info/attestation
## Adding Trust and geo location information to the horizon dashboard
## Added trust and geo-tag indicators(icons) to images, instances and hypervisor pages

=== Nova Aggregates and Availability Zones ===

The partitioning, resource reservation, and fault tolerance benefits that Nova aggregates and availability zones bring have a lot in common with geo tags. However, the main difference is that trusted tags are provision time values, and attached to the hardware resource. Re-purposing a machine is more easy via the command line with aggregates and availability zones, does not require machine reboot, but to modify trusted geo-tags more deliberate action is required, a machine reboot. The trusted geo-tag by virtue of being associated with a hardware root of trust is more valuable with respect to meeting regulatory requirements.

Further, the Attestation service could be independent of the cloud provider to increase credibility and better meet regulatory requirements. In addition, geo-tags can be verified with about 90% accuracy using software techniques using the Internet Protocol (IP) address of the device being attested.

This blueprint details how geo-tags can be incorporated and taken advantage of in OpenStack clouds.

=== Nova Compute Node Provisioning ===

During compute nodes provisioning for trust, geo-tags may also be assigned. These can be simple strings, such as, "3 rd Floor, Expo Center, Hong Kong", or complex, such as XML data providing sub-items such as GPS co-ordinates, postal address, and more, or json strings.

=== Dashboard ===
# Flavor Extra Specs, Volume Extra Specs The extra specs field readily supports specifying geo and other asset tag constraints.
# Displaying VM and Volume geo/asset tag affiliations The Horizon UI for instance and volume lists could be extended to display in addition to current information, trusted and geo tags. For instance, it would be logical to add a little trusted seal if a compute node is trusted, and by extension a VM running on the same compute node. A country flag would be a good geo indicator.
# Object listings Could also contain geo indicators.

=== Nova Scheduler Filter ===

Asset /Geo Tag filters should be specified. They will be very similar to todays Aggregate and Availability filters with the distinction that the data they retrieve from the Attestation service may need to be parsed. For instance, geo-tag data may be retrieved as a json string or as XML. In the case of XML,

=== Attestation Service ===

Existing Attestion services need to be upgraded to understand geo tags, support an API to retrieve them for registered hardware resources. The geo tags retrieved for hardware resource could be cached at the attestation service or even at the nova scheduler to speed scheduling decisions as long as the cached value is no older than some specifiable time window.

The simplest geo tag is a string, while more complex variants are XML and json strings. A match policy (country match, state and country match, or city, state, and country match) and a formatter to parse a given representation is required to facilitate match.