Microsoft Technology Licensing, LLC

Maxwell Christopher Renke

Hari R Pulapaka

Benjamin M Schultz

Frederick Justus Smith

Giridhar Viswanathan

Amber Tianqi Guo

Deepu Chandy Thomas

Taylor James Stark

Yevgeniy Bak

David Guy Weston

Apurva Ashvinkumar Thanky

Vijaykumar Sharma

Andrea Allievi

Memory is partitioned and isolated in container-based memory enclaves. The container-based memory enclaves have attestable security guarantees. During provisioning of the container-based memory enclaves from a container image, a purported link in the container to a memory address of the enclave is modified to verifiably link to an actual memory address of the host, such as partitioned memory enclave. In some instances, enclave attestation reports can be validated without transmitting corresponding attestation requests to remote attestation services, based on previous attestation of one or more previous container attestation reports from a similar container and without requiring end-to-end attestation between the container and remote attestation service for each new attestation request.

Using secure memory enclaves from the context of process containers

Enacting a compliance action using an assessment that considers a mix of coldpatches and hotpatches includes identifying a policy defining the compliance condition based on patching status of a software component. A patching state of the software component is determined, including identifying evidence of coldpatched binary file(s) and hotpatch binary file(s) applicable to the software component, and using the evidence to determine whether or not the hotpatch binary file(s) have been applied to a memory image into which an instance of the software component is loaded. Based on the policy and on the patching state of the software component, a compliance action is enacted for the compliance condition. The compliance action includes generating a health report or a health attestation, initiating a patching action, initiating an execution control action, and the like.

System compliance based on a mix of hotpatches and coldpatches

Growing community of inventors

Sammamish, WA, United States of America

Maxwell Christopher Renke