Protecting cognitive code and client data in a public cloud via deployment of data and executables into a stateless secure partition

• US 10,685,106 B2
• Filed: 03/10/2018
• Issued: 06/16/2020
• Est. Priority Date: 03/10/2018
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Boivie, Richard H., Bradbury, Jonathan D., Hall, William E., Hunt, Guerney D. H., Leenstra, Jentje, Linton, Jeb R., O'Connor, Jr., James A., Palmer, Elaine R., Pendarakis, Dimitrios
• Primary Examiner(s): Shaw, Peter C
• Application Number:
  US15/917,619
• Publication Number:
  US 20190278907A1
• Time in Patent Office: 829 Days
• Field of Search: 726 26
• CPC Class Codes: G06F 2009/45579 I/O management, e.g. providing access to device drivers or storage
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/544 Buffers; Shared memory; Pipes
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A secure cloud computing environment protects the confidentiality of application code from a customer while simultaneously protecting the confidentiality of a customer'"'"'s data from intentional or inadvertent leaks by the application code. This result is accomplished without the need to trust the application code and without requiring human surveillance or intervention. A client secure virtual machine (SVM) is accessible by a client who supplies commands, operand data and application data. An appliance SVM has the application code loaded therein and includes an application program interface that accesses a memory area shared by both SVMs. All access to the appliance SVM is initially revoked by an ultravisor, except for the shared memory. The appliance SVM processes the commands without ever saving any persistent state of the application data. The ultravisor manages an SVM by maintaining exclusive control over a device tree used by the operating system of the SVM.

Claims

1. A method of protecting client data from unauthorized disclosure comprising:

loading appliance code in an appliance which includes a secure virtual machine that uses a set of computing resources;

revoking all access to devices from within the appliance except for a shared memory wherein the appliance code includes an application program interface that uses the shared memory and wherein all access to a logical partition of the appliance is revoked when the partition is activated;

receiving commands, operand data and application data at the appliance via the shared memory;

processing the commands, operand data and application data by the appliance code in the appliance to yield results without recording any application data on persistent media; and

communicating the results of said processing to a client of the appliance via the shared memory.

2. The method of claim 1 wherein the appliance is a first secure virtual machine, the set of computing resources is a first set of computing resources, and further comprising creating the client which includes a second secure virtual machine that uses a second set of the computing resources, wherein the appliance and client operate in a system environment having a security mode imposed by an ultravisor embodied in microcode, and the client uses the ultravisor to allocate the shared memory and causes the appliance to be started with a token used to access the shared memory.

3. The method of claim 2 wherein the ultravisor maintains exclusive access control over the computing resources and limits access to both the appliance and the client.

4. The method of claim 3 wherein:

the ultravisor receives a request from the client to provide the shared memory and responsively creates the token; and

the appliance receives an encrypted version of the token from the client, decrypts the encrypted version using a public key, and requests access to the shared memory from the ultravisor using the token.

5. The method of claim 3 wherein the ultravisor prevents the appliance from communicating with any devices by controlling a device tree used by an operating system of the appliance.

6. The method of claim 1 further comprising:

saving all data from a memory of the partition in encrypted persistent storage;

deleting the data from the memory; and

deactivating the partition.

7. The method of claim 1 wherein the appliance is deployed to the partition from a different logical partition.

8. The method of claim 2 wherein the ultravisor prevents any entity other than the client from accessing the appliance while also preventing the client from accessing the appliance code.

9. A secure computing system comprising:

an appliance including a secure virtual machine constructed from a set of computing resources;

appliance code residing in the appliance; and

means for revoking all access to devices from within the appliance except for a shared memory wherein the appliance code includes an application program interface that uses the shared memory and wherein all access to a logical partition of the appliance is revoked when the partition is activated;

wherein the appliance processes commands, operand data and application data received via the shared memory using the appliance code to yield results without recording any application data on persistent media, and communicates the results to a client of the appliance via the shared memory.

10. The secure computing system of claim 9 wherein the secure virtual machine is a first secure virtual machine, the set of computing resources is a first set of computing resources, and further comprising a client which includes a second secure virtual machine that uses a second set of the computing resources wherein the appliance and client operate in a system environment having a security mode imposed by an ultravisor embodied in microcode, and the client uses the ultravisor to allocate the shared memory and causes the appliance to be started with a token used to access the shared memory.

11. The secure computing system of claim 9 wherein the ultravisor maintains exclusive access control over the computing resources and limits access to both the appliance and the client.

12. The secure computing system of claim 11 wherein:

the ultravisor receives a request from the client to provide the shared memory and responsively creates the token; and

the appliance receives an encrypted version of the token from the client, decrypts the encrypted version using a public key, and requests access to the shared memory from the ultravisor using the token.

13. The secure computing system of claim 11 wherein the ultravisor prevents the appliance from communicating with any devices by controlling a device tree used by an operating system of the appliance.

14. The secure computing system of claim 9 wherein the ultravisor saves all data from a memory of the partition in encrypted persistent storage, deletes the data from the memory, and deactivates the partition.

15. The secure computing system of claim 9 wherein the appliance is deployed to the partition from a different logical partition.

16. The secure computing system of claim 10 wherein the ultravisor prevents any entity other than the client from accessing the appliance while also preventing the client from accessing the appliance code.

17. A computer program product comprising:

a computer readable storage medium; and

program instructions residing in said storage medium for protecting client data from unauthorized disclosure by loading appliance code in an appliance which includes a secure virtual machine that uses a set of computing resources, revoking all access to devices from within the appliance except for a shared memory wherein the appliance code includes an application program interface that uses the shared memory and wherein said program instructions revoke all access to a logical partition of the appliance when the partition is activated, receiving commands, operand data and application data at the appliance via the shared memory, processing the commands, operand data and application data by the appliance code in the appliance to yield results without recording any application data on persistent media, and communicating the results to a client of the appliance via the shared memory.