Abstract: A method for placing a workload on one or more resources based on security requirements of the workload, a declared security policy, and security capabilities of the resources, includes determining the security requirements of the workload and the declared security policy, searching for and finding a resource that meets the security requirements of the workload and the declared security policy, and deploying the workload onto the resource. The method further includes, after deploying the workload onto the resource, discovering that the resource does not meet the security requirements of the workload and the declared security policy, determining that a new environment has a resource having security capabilities that meet the security requirements of the workload and the declared security policy, and deploying the workload onto the resource in the new environment.

Abstract: A method and system are disclosed in which a secure computing infrastructure is established and maintained. The method requires that upon any attestation event, a component to be added or newly activated (i.e., used the first time) be checked for its trustworthiness, where the checking includes cryptographic proof of the trustworthiness of the component. If the component is not trustworthy, then security precautions are taken to protect the secure computing infrastructure. Those precautions include refusing to accept the component, quarantining the component, encrypting and decrypting all traffic to and from the component, or allowing the component to perform only non-secure operations.