JPWO2021006973A5

JPWO2021006973A5 -

Info

Publication number: JPWO2021006973A5
Application number: JP2021572526A
Authority: JP
Publication date: 2023-05-19

Claims

A computing system,
one or more processors;
one or more storing computer-executable instructions executable by said one or more processors to configure said computing system to implement a method for creating a container-based memory enclave; a computer readable storage medium;
The method includes
identifying a container image having a security component used to authenticate a particular security configuration used by a host system running on the first security realm;
instantiating a new container using the container image, the new container being stored in the enclave memory at the particular memory address of the host system when the new container is instantiated; configured to utilize an enclave memory in a second security realm of the host system based on the copy of the security component that has been created, the container image is referred to as linking the new container to: providing what is referred to as a memory address of a copy of the security component stored in the enclave memory of the host system;
to what is referred to as the memory address in order to authenticate the linking of the new container to the specific memory address of the security component stored in the enclave memory at the specific memory address of the host system. a purported link of the new container to a purported memory address of a copy of the security component stored in the enclave memory so that the purported link of the new container is modified; to a specific memory address of the security component stored at the specific memory address of the host system, during or after instantiation of the new container;
calculation system, including

Said modifying what is referred to as said link causes said particular memory of said security component to be stored in said enclave memory at said particular memory address of said host system. 2. The computing system of claim 1 , comprising overwriting with an address .

Said modifying what is referred to as said link comprises creating a link to said particular memory address of said security component stored in said enclave memory at said particular memory address of said host system. , the computing system of claim 1.

said modifying said link to include or refer to said specific memory address of said security component stored in said enclave memory at said specific memory address of said host system; 2. The computing system of claim 1, comprising updating what is referred to as the memory address in a mapping table associated with a security component.

The method comprises creating the mapping table and adding the by-reference address to the mapping table using metadata associated with the new container during or after instantiation of the new container. 5. The computing system of claim 4, further comprising:

2. The computing system of claim 1, wherein said security component comprises a library file.

2. The computing system of claim 1, wherein the security component includes data used to generate an authentication report regarding the security configuration of the new container.

The computer-executable instructions are further executable by the one or more processors to configure the computing system to authenticate security assurances associated with the security configuration of the new container. Item 8. The computing system according to Item 7.

A method for creating a container-based memory enclave, comprising:
identifying a container image having a security component used to authenticate a particular security configuration used by a host system running on the first security realm;
instantiating a new container using the container image, the new container being stored in the enclave memory at the particular memory address of the host system when the new container is instantiated; configured to utilize an enclave memory in a second security realm of the host system based on the copy of the security component that has been created, the container image is referred to as linking the new container to: providing what is referred to as a memory address of a copy of the security component stored in the enclave memory of the host system;
to what is referred to as the memory address in order to authenticate the linking of the new container to the specific memory address of the security component stored in the enclave memory at the specific memory address of the host system. a purported link of the new container to a purported memory address of a copy of the security component stored in the enclave memory so that the purported link of the new container is modified; to a specific memory address of the security component stored at the specific memory address of the host system, during or after instantiation of the new container;
method including.

Said modifying what is referred to as said link causes said particular memory of said security component to be stored in said enclave memory at said particular memory address of said host system. 10. The method of claim 9, comprising overwriting with an address.

Said modifying what is referred to as said link comprises creating a link to said particular memory address of said security component stored in said enclave memory at said particular memory address of said host system. 10. The method of claim 9.

said modifying said link to include or refer to said specific memory address of said security component stored in said enclave memory at said specific memory address of said host system; 10. The method of claim 9, comprising updating a mapping table associated with the new container.

The security component includes data used to generate a certification report regarding the security configuration of the new container, and the method includes performing certification of security assurances associated with the security configuration of the new container. 10. The method of claim 9.