Microsoft Technology Licensing, LLC

Deepu Chandy Thomas

Stefan Thom

Hari R Pulapaka

Benjamin M Schultz

Brian Clifford Telfer

Amber Tianqi Guo

Frederick Justus Smith

Giridhar Viswanathan

Maxwell Christopher Renke

Taylor James Stark

John Andrew Starks

Lars Reuther

Frederick J Smith, Iv

Judy J Liu

Trusted execution of a workload payload is brokered among multiple trusted execution platforms. The workload payload is received from a source computing system and includes input data, trusted execution code, and one or more trusted execution policies. At least one of the multiple trusted execution platforms is selected based on the one or more trusted execution policies. A brokered payload is generated to include executable trusted execution code and the input data. The brokered payload is communicated to the selected at least one trusted execution platform. A brokered result generated from the brokered payload by the selected at least one trusted execution platform is received. A workload result based on the brokered result is returned to the source computing platform.

Trusted execution broker

A fine-grain selectable partially privileged container virtual computing environment provides a vehicle by which processes that are directed to modifying specific aspects of a host computing environment can be delivered to, and executed upon, the host computing environment while simultaneously maintaining the advantageous and desirable protections and isolations between the remaining aspects of the host computing environment and the partially privileged container computing environment. Such partial privilege is provided based upon directly or indirectly delineated actions that are allowed to be undertaken on the host computing environment by processes executing within the partially privileged container virtual computing environment and actions which are not allowed. Aspects of the host computing environment operating system, such as the kernel, are extended to interface with container-centric mechanisms to receive information upon which actions can be allowed or denied by the kernel even if the process attempting such actions would otherwise have sufficient privilege.

Partially privileged lightweight virtualization environments

Memory is partitioned and isolated in container-based memory enclaves. The container-based memory enclaves have attestable security guarantees. During provisioning of the container-based memory enclaves from a container image, a purported link in the container to a memory address of the enclave is modified to verifiably link to an actual memory address of the host, such as partitioned memory enclave. In some instances, enclave attestation reports can be validated without transmitting corresponding attestation requests to remote attestation services, based on previous attestation of one or more previous container attestation reports from a similar container and without requiring end-to-end attestation between the container and remote attestation service for each new attestation request.

Using secure memory enclaves from the context of process containers

Growing community of inventors

Bellevue, WA, United States of America

Deepu Chandy Thomas