System call policies for containers

    公开(公告)号:US10650138B2

    公开(公告)日:2020-05-12

    申请号:US15417955

    申请日:2017-01-27

    Abstract: Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.

    Verifying network elements
    3.
    发明授权

    公开(公告)号:US11757717B2

    公开(公告)日:2023-09-12

    申请号:US15500918

    申请日:2014-11-28

    CPC classification number: H04L41/0866 H04L41/0893 H04L41/12 H04L41/28

    Abstract: Examples relate to verifying network elements. In one example, a computing device may: receive, from a client device, a request for attestation of a back-end network, the request including back-end configuration requirements; obtain, from a network controller that controls the back-end network, a controller configuration that specifies each network element included in the back-end network; provide each network element included in the back-end network with a request for attestation of a network element configuration of the network element; receive, from each network element, response data that specifies the network element configuration of the network element; verify that the response data received from each network element meets the back-end configuration requirements included in the request for attestation of the back-end network; and provide the client device with data verifying that the back-end network meets the back-end configuration requirements.

    Cryptographic data
    5.
    发明授权

    公开(公告)号:US10686612B2

    公开(公告)日:2020-06-16

    申请号:US15573688

    申请日:2015-07-30

    Abstract: Examples set out herein provide a method comprising using first cryptographic key data specific to a computing device to verify a package of machine readable instructions to run on the computing device. The verified package may be executed to generate a random number using a true random number generator of the computing device, and to store the generated random number. Second cryptographic key data may be generated by a pseudorandom number generator of the computing device based on a seed comprising a combination of the random number as a first seed portion and a second seed portion. A portion of the second cryptographic key data may be sent to a certifying authority. The method may further comprising receiving a certification value based on the sent portion of the second cryptographic key data from the certifying authority and storing the certification value.

    Cryptographic evidence of persisted capabilities

    公开(公告)号:US10461926B2

    公开(公告)日:2019-10-29

    申请号:US15252392

    申请日:2016-08-31

    Abstract: Example implementations relate to cryptographic evidence of persisted capabilities. In an example implementation, in response to a request to access a persisted capability stored in a globally shared memory, a system may decide whether to trust the persisted capability by verification of cryptographic evidence accompanying the persisted capability. The system may load the persisted capability upon a decision to trust the persisted capability based on successful verification.

Patent Agency Ranking