Protecting cognitive code and client data in a public cloud via deployment of data and executables into a stateless secure partition

US10685106B2 · kind B2 · utility

Assignee

• International Business Machines Corporation · US

Inventors

• Richard H. Boivie · Hawthorne, US
• Jonathan D. Bradbury · Poughkeepsie, US
• William E. Hall · Clinton, US
• Guerney D. H. Hunt · Yorktown Heights, US
• Jentje Leenstra · Nagold, DE
• Jeb R. Linton · Manassas, US
• James A. O'Connor · Ulster Park, US
• Elaine R. Palmer · Hanover, US
• Dimitrios Pendarakis · Westport, US

Key dates

• Filing date: Mar 10, 2018
• Grant date: Jun 16, 2020
• Expiry date: Dec 12, 2038

Classification

• Technology area (CPC G): Physics
• CPC primary: G06F2221/2143
• WIPO field: Computer technology
• WIPO sector: Electrical engineering

Abstract

A secure cloud computing environment protects the confidentiality of application code from a customer while simultaneously protecting the confidentiality of a customer's data from intentional or inadvertent leaks by the application code. This result is accomplished without the need to trust the application code and without requiring human surveillance or intervention. A client secure virtual machine (SVM) is accessible by a client who supplies commands, operand data and application data. An appliance SVM has the application code loaded therein and includes an application program interface that accesses a memory area shared by both SVMs. All access to the appliance SVM is initially revoked by an ultravisor, except for the shared memory. The appliance SVM processes the commands without ever saving any persistent state of the application data. The ultravisor manages an SVM by maintaining exclusive control over a device tree used by the operating system of the SVM.