SHARING CONTAINER DATA INSIDE A TENANT'S POD UNDER DIFFERENT TRUSTED EXECUTION ENVIRONMENTS (TEES)

    公开(公告)号:US20220391494A1

    公开(公告)日:2022-12-08

    申请号:US17889989

    申请日:2022-08-17

    Abstract: In a multitenant environment, confidential containers for the tenant having a trusted execution environment (TEE) which have security attested, can share data within the pod or between pods. The ability to share data for confidential containers of the same tenant eliminates the need to have multiple copies for different confidential containers. Thus, a storage device can store shared data specific to a tenant of the multitenant environment, and a caching service backed by protected hardware can manage access to the shared data. Management of the shared data can include attesting a key for a confidential container to verify that the confidential container is part of the TEE for a pod for the tenant, and access the shared data from the storage device for the confidential container based on the attested key.

    METHOD AND APPARATUS FOR IMPROVED CONTAINER IMAGE DEPLOYMENT

    公开(公告)号:US20220335139A1

    公开(公告)日:2022-10-20

    申请号:US17853800

    申请日:2022-06-29

    Abstract: A method is described. The method includes sending a first request for portions of the container image. The method includes sending a second request for respective security keys for the portions of the container image. The method includes receiving the portions of the container image in encrypted form. The method includes receiving the respective security keys encrypted with a public key of an enclave of a trusted execution environment. The method includes decrypting the respective security keys with a private key of the enclave of the trusted execution environment. The method includes decrypting the encrypted portions of the container image with the decrypted respective keys.

Patent Agency Ranking