Red Hat, Inc.

Sergio Lopez Pascual

Michael Tsirkin

Daniel J Walsh

Giuseppe Scrivano

A system and method of performing a mutual attestation procedure for a trusted execution environment (TEE) of a cloud service system. The method includes receiving, by the cloud service provider, a request to provide a trusted service to a client device. The method includes performing, by a processing device of the cloud service provider using a first TEE, a mutual attestation procedure with a second TEE to obtain a grant to execute a third TEE that is trusted by the second TEE. The method includes initiating, using the second TEE, an execution of the third TEE responsive to obtaining the grant. The method includes providing, using the third TEE, the trusted service to the client device, where the client device trusts the trusted service.

Zero-trust attestation in cloud computing

The technology disclosed herein enables customized hardware initialization code to be provided over a computer network and used to enable a virtual machine to boot in a more secure manner. An example method may include: receiving a request to start a virtual machine; transmitting, by a processing device, configuration data of a host device over a computer network to a service, wherein the configuration data comprises a resource identifier of the host device; receiving hardware initialization code over the computer network from the service, wherein the hardware initialization code comprises the resource identifier; updating, by the processing device, the virtual machine to comprise the hardware initialization code; and causing the virtual machine to execute in a trusted execution environment of the host device, wherein the virtual machine executes the hardware initialization code and uses the resource identifier.

Customized initialization code delivery over network for zero-trust virtual machine

Systems and methods for deploying and running webassembly workloads on compute nodes using a webassembly unikernel. A computing device having a processor generates, using a container engine, a container runtime. The computing device generates, using the container runtime, a unikernel configured to run a plurality of webassembly applications, thereby resulting in a webassembly unikernel. The computing device may receive a request to run an application. A container image corresponding to the application may be retrieved, via the container engine, from a container registry. A webassembly payload may be stored for the application from the container image. Furthermore, the computing device may cause the webassembly unikernel to run the webassembly payload for the application.

Unikernel for webassembly containers

A system includes a memory and a processor. The memory is in communication with the processor and configured to initialize a secure interface configured to provide access to a virtual machine (VM) from a device, where the VM is associated with a level of security. A buffer is allocated and associated with the secure interface, where the level of security of the VM indicates whether the device has access to guest memory of the VM via the buffer. The buffer is then provided to the device. Inputs/outputs (I/Os) are sent between the device and the VM using the secure interface.

Secure modular devices

A system includes a hypervisor, a virtual machine (VM), and a host system. The VM includes a kernel and an application and the VM is in communication with the hypervisor. The host system includes a memory and one or more processors, where the one or more processors are in communication with the memory. The host system hosts the VM and the hypervisor. The one or more processors is configured to perform creating, via the kernel, a first socket accessible to the application. A second socket in communication with an endpoint is created at the host system. A virtual communication channel between the hypervisor and the kernel of the VM connects the first socket to the hypervisor. The hypervisor is configured to transmit inputs/outputs (I/Os) received from the application through the virtual channel to the endpoint via the second socket.

Network transparency on virtual machines using socket impersonation

Systems and methods are presented for creating encrypted containers in cloud computing environments. In one embodiment, a method is provided that includes receiving a request to create a virtual machine at an application node. The request may contain encryption parameters for use in encrypting the virtual machine. The virtual machine may be created at the application node and may include an associated memory for use during execution of the virtual machine. An encryption key may be received and the memory may be encrypted. An encrypted container image and may be mounted within the virtual machine. The encrypted container image may be executed within the virtual machine.

Growing community of inventors

Madrid, Spain

Sergio Lopez Pascual