JPWO2021086737A5

JPWO2021086737A5 -

Info

Publication number: JPWO2021086737A5
Application number: JP2022520807A
Authority: JP
Publication date: 2023-09-20

Claims

A method for enforcing policy restrictions on execution of an application program within a first computing environment, the method comprising:
obtaining application policy data corresponding to the application program from a second computing environment different from the first computing environment, wherein the application policy data is obtained when the first computing environment is a container virtual computing environment; defining a first precondition to be bypassed;
inspecting a cryptographic infrastructure of the first computing environment;
performing environment type verification comprising at least one of: testing code integrity infrastructure of the first computing environment; or testing hypervisor functionality within the first computing environment;
limiting the execution of the application program based on the first precondition if the performed environment type verification determines that the first computing environment is not a container virtual computing environment.

2. The method of claim 1, wherein the verifying the cryptographic infrastructure includes verifying proper attestation of an operating system of the first computing environment.

3. The method of claim 2, wherein the verifying the cryptographic infrastructure includes verifying proper attestation of a combination of the operating system and the application program of the first computing environment.

3. The method of claim 2, wherein the verifying the proper attestation of the operating system of the first computing environment includes communicating with a remote attestation service external to the first computing environment. .

The verifying the proper attestation of the operating system of the first computing environment includes verifying attestation measurements from a first trusted platform module (TPM) in the first computing environment to the second computing environment. 3. The method of claim 2, comprising comparing with attestation measurements from a second TPM within a computing environment.

2. The checking of the cryptographic infrastructure comprises verifying that a certificate in a first certificate store of the first computing environment is signed by a predetermined root of trust. The method described in.

2. The method of claim 1, wherein the inspecting the code integrity infrastructure includes verifying the hash of an active code integrity policy file against a security catalog that includes hashes of known good code integrity policy files. Method described.

8. The method of claim 7, wherein the verifying the code integrity infrastructure includes verifying that the security catalog is signed by one of a predetermined trusted organization's certificate.

2. The method of claim 1, wherein the checking the hypervisor functionality includes checking whether hypervisor-appropriate processor functionality is exposed by a central processing unit of the first computing environment.

One or more computer-readable storage media containing computer-executable instructions that, when executed within a first computing environment, perform the steps recited in claim 1.

2. The method of claim 1, wherein the performing the environment type validation includes checking whether a predetermined system driver component is present within the first computing environment.

2. The method of claim 1, wherein the performing the environment type validation includes checking whether a resource management stack is deactivated within the first computing environment.

2. The method of claim 1, wherein the performing the environment type verification includes checking whether a predetermined firmware variable is set to a predetermined value in firmware of the first computing environment.

2. The method of claim 1, wherein the first precondition restricts execution of the application program to a hardware machine identifier of a particular computing device.

2. The method of claim 1, further comprising verifying the obtained application policy data by referencing a policy management service external to the first computing environment.

one or more processing devices;
one or more computer-readable storage media containing computer-executable instructions, the computer-executable instructions, when executed by at least a portion of the processing device, causing the computing device to:
obtaining application policy data corresponding to an application program from a second computing environment different from a first computing environment, wherein the application policy data is bypassed when the first computing environment is a container virtual computing environment; specifying a first pre-condition to be performed;
inspecting a cryptographic infrastructure of the first computing environment;
inspecting a code integrity infrastructure of the first computing environment; or
testing hypervisor functionality within the first computing environment;
performing an environment type validation that includes at least one of the following;
restricting the execution of the application program based on the first precondition if the performed environment type verification determines that the first computing environment is not a container virtual computing environment;
A computing device that performs

17. The computing device of claim 16, wherein both the first computing environment and the second computing environment are hosted by the computing device.

the first computing environment is hosted by the computing device, the second computing environment is hosted by a second computing device different from the computing device, and the second computing environment is communicatively coupled to the computing device. 17. The computing device according to claim 16.