US 12,244,601 B2
Trusted and connected multi-domain node clusters
Anahit Tarkhanyan, Cupertino, CA (US); Reshma Lal, Portland, OR (US); Jianping Xu, Portland, OR (US); and Christine E. Severns-Williams, Deephaven, MN (US)
Assigned to Intel Corporation, Santa Clara, CA (US)
Filed by Intel Corporation, Santa Clara, CA (US)
Filed on Dec. 2, 2021, as Appl. No. 17/541,155.
Prior Publication US 2022/0094690 A1, Mar. 24, 2022
Int. Cl. H04L 9/40 (2022.01); G06F 9/50 (2006.01)
CPC H04L 63/104 (2013.01) [G06F 9/505 (2013.01); H04L 63/0435 (2013.01); H04L 63/20 (2013.01)] 25 Claims
OG exemplary drawing
 
1. One or more non-transitory computer readable storage media including instructions stored thereon that, when executed by one or more processors, are to cause the one or more processors to:
receive, by a first orchestration element that manages a first plurality of resources in a first compute domain of a multi-domain environment, a first request for two or more resources for a workload of a tenant;
select, based on the first request, a first node cluster from the first compute domain to be provisioned for the workload and to include a first compute node as a first resource of the two or more resources;
send, to a second orchestration element that manages a second plurality of resources in a second compute domain in the multi-domain environment, a second request for at least a second resource of the two or more resources for the workload;
receive attestation results for a second node cluster selected from the second compute domain by the second orchestration element based on the second request, the second node cluster to include a second compute node as the second resource;
establish a trusted group of node clusters for the workload including the first node cluster and the second node cluster based, at least in part, on determining that the first compute node in the first node cluster meets a first security requirement of a workload execution policy associated with the workload and on the attestation results indicating that the second compute node in the second node cluster meets a second security requirement of the workload execution policy;
obtain a first key to be used to cryptographically secure first communications between the first node cluster including at least the first compute node and the second node cluster including at least the second compute node; and
obtain a second key to be used to cryptographically secure second communications between the tenant and one or more compute nodes in the first node cluster.