Abstract: The technology disclosed herein provides an enhanced access control mechanism that uses a proof-of-work key wrapping system to temporally restrict access to data. An example method may include: determining, by a processing device, characteristics of a computing device; accessing a cryptographic key for accessing content; selecting a set of cryptographic attributes for wrapping the cryptographic key, wherein the set of cryptographic attributes are selected to enable the computing device to derive the cryptographic key from a wrapped key in a predetermined duration of time; and providing the wrapped key and an indication of at least one of the cryptographic attributes to the computing device.

Abstract: The technology disclosed herein provides a proof-of-work key wrapping system that cryptographically controls access to data. An example method may include: selecting a set of cryptographic attributes in view of a characteristic of a computing device; obtaining, by a processing device, a cryptographic key; encrypting, by the processing device, the cryptographic key in view of the set of cryptographic attributes to produce a wrapped key; and providing the wrapped key and at least one of the cryptographic attributes to the computing device, wherein the at least one cryptographic attribute facilitates deriving the cryptographic key from the wrapped key.

Abstract: Technologies for monitoring service level agreement (SLA) performance in an end-to-end SLA monitoring architecture include a network functions virtualization (NFV) SLA controller configured to manage SLA agents initialized in various network processing components of the end-to-end SLA monitoring architecture. To do so, the NFV SLA controller is configured to provide instruction to the SLA agents indicating which types of telemetry data to monitor and receive the requested telemetry data, as securely collected and securely packaged by the SLA agents. The NFV SLA controller is further configured to securely analyze the received telemetry data to determine one or more performance metrics and compare performance benchmarks against the performance metrics to generate an SLA report that includes the results of the comparison. Other embodiments are described and claimed.

Abstract: Technologies for simulating service degradation in telemetry data include a simulator device. The simulator device is to identify a telemetry data stream from a production system to a first management system. The simulator device is also to fork a copy of the telemetry data stream for transmission to a second management system, determine perturbations associated with a determined service degradation type, and apply the perturbations to the forked telemetry data stream. Other embodiments are also described and claimed.

Abstract: A round-robin network security system implemented by a number of peer devices included in a plurality of networked peer devices. The round-robin security system permits the rotation of the system security controller among at least a portion of the peer devices. Each of the peer devices uses a defined trust assessment ruleset to determine whether the system security controller is trusted/trustworthy. An untrusted system security controller peer device is replaced by another of the peer devices selected by the peer devices. The current system security controller peer device transfers system threat information and security risk information collected from the peer devices to the new system security controller elected by the peer devices.

Abstract: A round-robin network security system implemented by a number of peer devices included in a plurality of networked peer devices. The round-robin security system permits the rotation of the system security controller among at least a portion of the peer devices. Each of the peer devices uses a defined trust assessment ruleset to determine whether the system security controller is trusted/trustworthy. An untrusted system security controller peer device is replaced by another of the peer devices selected by the peer devices. The current system security controller peer device transfers system threat information and security risk information collected from the peer devices to the new system security controller elected by the peer devices.

Abstract: Technologies for monitoring service level agreement (SLA) performance in an end-to-end SLA monitoring architecture include a network functions virtualization (NFV) SLA controller configured to manage SLA agents initialized in various network processing components of the end-to-end SLA monitoring architecture. To do so, the NFV SLA controller is configured to provide instruction to the SLA agents indicating which types of telemetry data to monitor and receive the requested telemetry data, as securely collected and securely packaged by the SLA agents. The NFV SLA controller is further configured to securely analyze the received telemetry data to determine one or more performance metrics and compare performance benchmarks against the performance metrics to generate an SLA report that includes the results of the comparison. Other embodiments are described and claimed.

Abstract: A virtualization computing platform may host a virtual machine. The virtual machine may be hosted by a first set of resources of the virtualization computing platform. A second set of resources for hosting the virtual machine may be identified. The second set of resources may comprise resources of the virtualization computing platform that are distinct from the first set of resources. At least a portion of a plurality of files associated with the virtual machine may be copied from the first set of resources to the second set of resources. A virtual memory swap file may be identified from among the plurality of files associated with the virtual machine. Based on identifying the virtual memory swap file as a virtual memory swap file, the virtual memory swap file may be treated differently from one or more other of the plurality of files associated with the virtual machine.

Abstract: Methods and systems for performing secure administration of virtual domain resource allocation are provided herein. A cloud service provider (CSP) may provide instances of virtual machines to one or more contracting user entities. The cloud service provider may store an authorization database identifying one or more resources (e.g., storage, CPU, etc.) that each of the different contracting user entities is authorized to use on a virtual machine server device. The CSP may subsequently receive a request from an unverified entity to instantiate a virtual machine with access to one or more resources. The request may include security information. The CSP validates the request by verifying the unverified entity using the first security information (e.g., checking a PKI certificate, requiring a login/password, etc.) and, when the request is validated, provides access to the verified entity to a subset of the requested one or more resources based on the authorization database.

Abstract: A virtualization computing platform may host a virtual machine. The virtual machine may be hosted by a first set of resources of the virtualization computing platform. A second set of resources for hosting the virtual machine may be identified. The second set of resources may comprise resources of the virtualization computing platform that are distinct from the first set of resources. At least a portion of a plurality of files associated with the virtual machine may be copied from the first set of resources to the second set of resources. A virtual memory swap file may be identified from among the plurality of files associated with the virtual machine. Based on identifying the virtual memory swap file as a virtual memory swap file, the virtual memory swap file may be treated differently from one or more other of the plurality of files associated with the virtual machine.

Abstract: Methods and systems for performing secure administration of virtual domain resource allocation are provided herein. A cloud service provider (CSP) may provide instances of virtual machines to one or more contracting user entities. The cloud service provider may store an authorization database identifying one or more resources (e.g., storage, CPU, etc.) that each of the different contracting user entities is authorized to use on a virtual machine server device. The CSP may subsequently receive a request from an unverified entity to instantiate a virtual machine with access to one or more resources. The request may include security information. The CSP validates the request by verifying the unverified entity using the first security information (e.g., checking a PKI certificate, requiring a login/password, etc.) and, when the request is validated, provides access to the verified entity to a subset of the requested one or more resources based on the authorization database.

Abstract: A system and a method are provided for retrieving decryption keys from a secure location that is separate from the encrypted data. In particular, for each decryption key, there is an associated key ID, public and private authentication key pair and a storage key. The decryption key is encrypted and can be decrypted with the storage key. A key-server securely stores the encrypted decryption key, key ID and public authentication key. A separate key-host stores the storage key, key ID and private authentication key. For the key-host to retrieve the encrypted decryption key, the key-server first authenticates the key-host using the authentication keys. Upon receipt of the encrypted decryption key, the key-host decrypts the encrypted key using the storage key. The decryption key is then used for decrypting the encrypted data.

Abstract: Methods and systems for performing secure administration of virtual domain resource allocation are provided herein. A cloud service provider (CSP) may provide instances of virtual machines to one or more contracting user entities. The cloud service provider may store an authorization database identifying one or more resources (e.g., storage, CPU, etc.) that each of the different contracting user entities is authorized to use on a virtual machine server device. The CSP may subsequently receive a request from an unverified entity to instantiate a virtual machine with access to one or more resources. The request may include security information. The CSP validates the request by verifying the unverified entity using the first security information (e.g., checking a PKI certificate, requiring a login/password, etc.) and, when the request is validated, provides access to the verified entity to a subset of the requested one or more resources based on the authorization database.

Abstract: Methods and systems for performing secure administration of virtual domain resource allocation are provided herein. A cloud service provider (CSP) may provide instances of virtual machines to one or more contracting user entities. The cloud service provider may store an authorization database identifying one or more resources (e.g., storage, CPU, etc.) that each of the different contracting user entities is authorized to use on a virtual machine server device. The CSP may subsequently receive a request from an unverified entity to instantiate a virtual machine with access to one or more resources. The request may include security information. The CSP validates the request by verifying the unverified entity using the first security information (e.g., checking a PKI certificate, requiring a login/password, etc.) and, when the request is validated, provides access to the verified entity to a subset of the requested one or more resources based on the authorization database.

Abstract: A system and a method are provided for retrieving decryption keys from a secure location that is separate from the encrypted data. In particular, for each decryption key, there is an associated key ID, public and private authentication key pair and a storage key. The decryption key is encrypted and can be decrypted with the storage key. A key-server securely stores the encrypted decryption key, key ID and public authentication key. A separate key-host stores the storage key, key ID and private authentication key. For the key-host to retrieve the encrypted decryption key, the key-server first authenticates the key-host using the authentication keys. Upon receipt of the encrypted decryption key, the key-host decrypts the encrypted key using the storage key. The decryption key is then used for decrypting the encrypted data.