Secure Execution Client Owner Environment Control Character

Abstract

A method, computer program product, and system in which a security interface control determines whether an instance of a secure client image can be executed based on metadata. A security interface control ("SC") obtains metadata linked to an image of an owner's secure client and managed by a virtual machine monitor, the metadata including a control indicating whether the virtual machine monitor is allowed to execute a secure client instance generated with the image in a computing system based on system settings in the computing system. The SC intercepts a command issued by the virtual machine monitor to start an instance. The SC determines the presence or absence of the system settings in the computing system. The SC determines whether the virtual machine monitor is allowed to execute the instance. If allowed, the SC enables the virtual machine monitor to start the instance. Otherwise, the SC ignores the command.

Description

Background Art

[0001] Cryptographic elements are important technical components in today's computer systems and information transmission networks. Information can be stored or transmitted in a cryptographically secure form to avoid unauthorized access to the stored or transmitted information. In some cases, purely software-based technologies can be used, in other cases, hardware-supported and security-specific elements can be used for such data protection.

[0002] A hypervisor, or virtual machine manager, controls the various clients (e.g., virtual machines, virtual servers) that can access system resources. Different clients managed by a common hypervisor can be generated by different owners. Some of these clients may be secure clients. Traditional hypervisors have full control over all clients that are hosted. In particular, the hypervisor is able to inspect and even modify all memory of the hosted clients. In a cloud environment, this setup requires that the hypervisor and its administrators be fully trusted.

[0003] A secure guest is a client that can be hosted by a non-(fully) trusted hypervisor. The image of such a guest will be protected when it is loaded, and the protection of the contents of the resources allocated to the guest (e.g., memory, CPU registers) will be maintained throughout the lifetime of the guest. The protection of the guest includes at least integrity protection (e.g., the hypervisor cannot maliciously change any guest state), and may also include maintaining the confidentiality of the original image, code, and data running in the guest. These services can be applied to any interface between a secure entity and another untrusted entity that traditionally allows the other entity to access secure resources. Summary of the invention

[0004] The disadvantages of the prior art are overcome and additional advantages are provided by providing a method that enables an owner to control the execution of a secure client in a given technical environment. The method includes, for example: obtaining, by a secure interface control in a computing system, metadata linked to an image of a secure client of the owner and managed by a hypervisor, wherein the secure interface control is communicatively coupled to the hypervisor, wherein the hypervisor manages one or more clients, wherein the metadata includes one or more control characters, wherein each of the one or more control characters indicates to the secure interface control whether the hypervisor is allowed to execute an instance of the secure client generated using the image in the computing system based on the presence or absence of one or more system settings in the computing system; intercepting, by the secure interface control, a command of the hypervisor to launch an instance of the secure client from the image of the secure client; determining, by the secure interface control, the presence or absence of the one or more system settings in the computing system; determining, by the secure interface control, whether the hypervisor is allowed to execute the instance based on the one or more control characters and the presence or absence of the one or more system settings; based on determining that the hypervisor is allowed to execute the instance, enabling the hypervisor to launch the instance in the computing system based on the intercepted command communicated to the hypervisor by the secure interface control; and ignoring the command by the secure interface control based on determining that the hypervisor is not allowed to execute the instance.

[0005] The disadvantages of the prior art are overcome and additional advantages are provided by providing a computer program product that enables an owner to control the execution of a secure client in a given technical environment. The computer program product is a computer-readable storage medium that is readable by one or more processors and stores instructions for execution by the one or more processors, the instructions for performing a method. The method, for example, includes: obtaining, by one or more processors in a computing system, metadata linked to an image of a secure client of an owner and managed by a monitor, wherein the one or more processors are communicatively coupled to a virtual machine monitor, wherein the virtual machine monitor manages one or more clients, wherein the metadata includes one or more control characters, wherein each of the one or more control characters indicates to a security interface control whether the virtual machine monitor is allowed to execute an instance of the secure client generated using the image in the computing system based on the presence or absence of one or more system settings in the computing system; intercepting, by the one or more processors, a command of the virtual machine monitor to launch an instance of the secure client from the image of the secure client; determining, by the one or more processors, the presence or absence of the one or more system settings in the computing system; determining, by the one or more processors, whether the virtual machine monitor is allowed to execute the instance based on the one or more control characters and the presence or absence of the one or more system settings; based on determining that the virtual machine monitor is allowed to execute the instance, the one or more processors communicate the intercepted command to the virtual machine monitor so that the virtual machine monitor can launch the instance in the computing system; and based on determining that the virtual machine monitor is not allowed to execute the instance, the one or more processors ignore the command.

[0006] The shortcomings of the prior art are overcome and additional advantages are provided by providing a system that enables an owner to control the execution of a secure client in a given technology environment. The system includes a memory, one or more processors in communication with the memory, and program instructions executable by the one or more processors through the memory, the program instructions being used to perform a method, the method comprising, for example: obtaining, by one or more processors in a computing system, metadata linked to an image of a secure client of an owner and managed by a monitor, wherein the one or more processors are communicatively coupled to a virtual machine monitor, wherein the virtual machine monitor manages one or more clients, wherein the metadata includes one or more control characters, wherein each of the one or more control characters indicates to a security interface control whether the virtual machine monitor is allowed to execute an instance of the secure client generated using the image in the computing system based on the presence or absence of one or more system settings in the computing system; intercepting, by the one or more processors, a command of the virtual machine monitor to launch an instance of the secure client from the image of the secure client; determining, by the one or more processors, the presence or absence of the one or more system settings in the computing system; determining, by the one or more processors, whether the virtual machine monitor is allowed to execute the instance based on the one or more control characters and the presence or absence of the one or more system settings; based on determining that the virtual machine monitor is allowed to execute the instance, the one or more processors enable the virtual machine monitor to launch the instance in the computing system based on communicating the intercepted command to the virtual machine monitor; and based on determining that the virtual machine monitor is not allowed to execute the instance, ignoring the command by the one or more processors.

[0007] Methods and systems related to one or more aspects are also described and claimed herein. Additionally, services related to one or more aspects are described and claimed.

[0008] Additional features are achieved through the techniques described herein. Other embodiments and aspects are described in detail herein and are considered part of the claimed aspects. For example, in some embodiments of the invention, the one or more processors or security interface controls obtaining metadata further comprises: decrypting, by the one or more processors or security interface controls, a portion of metadata linked to an image of a secure client, wherein the metadata is integrity protected and the portion containing encrypted measurements of a boot image of the secure client is encrypted by a key derived from a private key.

[0009] In some embodiments of the invention, said encrypted portion of metadata comprises said one or more control symbols.

[0010] In some embodiments of the invention, each of the one or more control symbols comprises an environmental constraint.

[0011] In some embodiments of the invention, the environmental constraint is selected from the group consisting of: a system configured to perform hardware measurements, and a system configured to use a non-system specific host key.

[0012] In some embodiments of the invention, the private key is owned by and used exclusively by the security interface control.

[0013] In some embodiments of the present invention, the key derived from the private key is shared between the security interface control and the owner.

[0014] In some embodiments of the invention, the metadata includes a value derived from a boot image of the secure client computed using a collision resistant one-way function.

[0015] In some embodiments of the present invention, the one or more control characters each include a positive designation or a negative designation for a given system setting, wherein a positive designation indicates that a secure client instance is allowed to be executed in a computing system containing the given system setting, and a negative designation indicates that a secure client instance is not allowed to be executed in a computing system containing the given system setting.

[0016] In some embodiments of the invention, the metadata is inaccessible to instances of the secure client.

[0017] In some embodiments of the present invention, determining whether to allow a virtual machine monitor to execute an instance further includes: identifying, by a security interface control, a control character among the one or more control characters that is related to a setting in the one or more system settings; and determining, by the security interface control, based on the control character, whether the control character enables or restricts the execution instance.

[0018] In some embodiments of the present invention, the method further includes: during the operation of the instance, monitoring the one or more system settings by the security interface control; determining by the security interface control that at least one of the one or more settings changes during the runtime; identifying by the security interface control a given control symbol among the one or more control symbols that is related to the at least one setting; and determining by the security interface control whether to allow the virtual machine monitor to execute the instance based on the at least one setting and the given control symbol.

[0019] In some embodiments of the present invention, intercepting, by the security interface control, a command to launch an instance of a security client from an image of the security client further includes: performing, by the security interface control, an integrity check on the metadata; and based on successfully completing the integrity check, reading, by the security interface control, the one or more control characters in the metadata. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] One or more aspects are particularly pointed out and distinctly claimed as examples in the claims at the end of the specification. The above and one or more aspects, objects, features and advantages will be apparent from the following detailed description taken in conjunction with the accompanying drawings, in which:

[0021] Figure 1 is a workflow illustrating certain aspects of some embodiments of the present invention;

[0022] Figure 2 Various aspects of some embodiments of the present invention are shown;

[0023] Figure 3 is a workflow illustrating certain aspects of some embodiments of the present invention;

[0024] Figure 4 One embodiment of a computing node that may be used in a cloud computing environment is shown;

[0025] Figure 5 shows a cloud computing environment according to an embodiment of the present invention; and

[0026] Figure 6 An abstract model layer according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0027] The accompanying drawings further illustrate the present invention and are used to explain the principles of the present invention together with the detailed description of the present invention. In the accompanying drawings, the same reference numerals refer to the same or functionally similar elements throughout the individual views, and these drawings are incorporated in and form a part of the present specification. As will be appreciated by those skilled in the art, the accompanying drawings are provided to facilitate understanding and illustrate aspects of certain embodiments of the present invention. The present invention is not limited to the embodiments depicted in the accompanying drawings.

[0028] As will be appreciated by those skilled in the art, program code as referred to throughout this application includes both software and hardware. For example, program code in certain embodiments of the present invention includes fixed-function hardware, while other embodiments utilize software-based implementations of the described functionality. Certain embodiments combine both types of program code. An example of program code, also referred to as one or more programs, is described in Figure 4 A program / utility 40 , depicted in FIG. 2 as having a set (at least one) of program modules 42 , may be stored in memory 28 .

[0029] A virtual machine (VM) running as a client under the control of a host hypervisor relies on the hypervisor to transparently provide virtualization services to the client. These services can be applied to any interface between a secure entity and another trusted entity that traditionally allows the other entity to access secure resources. The term "client system" or "client" can refer to, for example, an operating system executed in a virtual machine (VM) on a hypervisor. Users can be assigned to client systems. Specific encryption keys can be assigned to client systems. The hypervisor can be used to perform such assignments. A client system can be, for example, a virtual machine, i.e., a VM, running or executing a client operating system.

[0030] The term "content" may refer to any character-based string. The string may include readable text or any other binary data.

[0031] The term "cryptographically linked" is used to indicate that a first component is cryptographically linked to a second component, indicating that the first component is integrity protected and contains a measure of all data contained in the second component. The measure is generated using a collision-resistant one-way function. Examples of such measures include, but are not limited to, cryptographic hashes, message authentication codes, and / or cryptographic signatures.

[0032] Embodiments of the present invention include computer-implemented methods, computer program products, and computer systems that include program code executed on at least one processing circuit and / or hardware, the processing circuit and / or hardware including program code that enables an owner of a secure execution (SE) client to instruct a secure interface control in hardware, firmware, or a combination thereof to instruct the secure interface control to allow or not allow the secure client to run in a specific host environment. In embodiments of the present invention, the client owner's instructions are specific to a specific client image. Thus, the owner communicates one or more environmental constraints to the secure interface control of each client so that the secure interface control can enforce the one or more constraints in a given system. In embodiments of the present invention, the owner communicates the details of a given secure client through image metadata that is cryptographically linked to the boot image of the secure client, and the secure interface control enforces these specified details for the given secure client. In some embodiments of the present invention, metadata associated with the secure client is integrity protected (e.g., at least a portion of the metadata may be encrypted). The metadata may include a value derived by the program code from the boot image of the secure client, which is calculated by the program code using a collision-resistant one-way function (e.g., a cryptographic hash function). Anti-collision functions provide security for these values ​​because application of the anti-collision functions makes it computationally infeasible to construct alternative images that can derive the same value thereof. In some embodiments of the invention, the metadata includes specific positive and negative designations associated with various environmental constraints. In some embodiments of the invention, the metadata includes installation data for the secure client (e.g., a secure execution (SE) header).

[0033] In an embodiment of the present invention, a security interface control prevents a (host) system from executing a security client that conflicts with system settings. The security interface control prevents such conflicts in two ways: by denying a request to launch a security client based on determining that a control symbol in metadata cryptographically linked to the security client image indicates that the security client is incompatible with the system; and by monitoring the technical environment behind the execution of the security client and determining that changes in the technical environment have caused the security client to no longer be compatible with the technical environment. If, during operation, a change in the technical environment in which the security client is executing creates a conflict with the control symbol (when the control symbol in metadata cryptographically linked to the security client image originally allowed the security interface control to launch the security client), the security interface control initiates termination of the security client through the hypervisor. For example, in an embodiment of the present invention, when the security interface control evaluates whether to launch a secure client: 1) the security interface control reads various control characters representing environmental constraints in the metadata of the image cryptographically linked to the secure client; 2) the security interface control compares these control characters with the system settings of the host system in which the image will be executed once launched; 3) if the system settings match the environmental controls in the metadata, the security interface control launches the secure client; and 4) the security interface control monitors the system settings of the technical environment in which the secure client is executed, and, during operation, if the security interface control determines that the system settings have changed in a manner that conflicts with the control characters, the security interface control terminates the secure client. Examples of system settings that may be embodied in the control characters containing the environmental constraints in the metadata may include, but are not limited to: 1) systems configured to perform hardware measurements; and 2) systems configured to use non-system-specific host keys.

[0034] Figure 1 1 is a workflow 100 illustrating certain functions of some embodiments of the present invention. Figure 1As shown, in an embodiment of the present invention, in order to achieve secure execution, a secure client image is linked from metadata in an encrypted manner, and the metadata is securely communicated to the secure interface control (e.g., a trusted hardware and / or software component, trusted firmware) based on a private host key that can only be accessed by the secure interface control. In an embodiment of the present invention, the owner of the secure client determines the behavior of the secure interface control, allowing or prohibiting the execution of the secure client in certain technical environments. Compared with existing secure client security methods, an advantage of an embodiment of the present invention is that the fine-grained control in the metadata enforced by the secure interface control allows the owner to restrict the execution of the secure client to address specific security issues. For example, the owner can control whether the secure interface control can start the secure client on a host system configured to perform hardware measurements and / or a host system configured to use non-system-specific host keys. In some embodiments of the present invention, program code executed on at least one processing circuit and / or provided by hardware constrains the execution of the secure client.

[0035] refer to Figure 1 In some embodiments of the present invention, a security interface control (e.g., hardware, software, firmware, combination, etc.) intercepts a request to launch a secure client based on an image of the secure client (105). The security interface control obtains metadata linked to the secure client to be launched from the owner of the secure client (110). In some embodiments of the present invention, the metadata is integrity protected and cryptographically linked to the boot image of the secure client to be launched by the (SE) owner. The metadata contains controls, each of which represents a restriction on the secure client; these restrictions include environmental restrictions.

[0036] Back to Figure 1 In one embodiment of the present invention, the security interface control performs an integrity check on the metadata (120). If the security control interface determines that the metadata fails the integrity check, the security interface control returns an error to the owner (or other requestor of the secure client instance) (125). By returning an error to the owner based on the failed integrity check, the security interface control cancels the launch of the requested secure client. Even if the metadata passes the integrity check, the security interface control can still abort the launch of the secure client.

[0037] If the security interface control determines that the metadata passes the integrity check, the security interface control obtains the control symbol in the metadata (130). The security interface control analyzes the system settings of the host system to determine whether the system settings are compatible with the control symbol in the metadata to determine whether to allow the secure client to be launched in the system (140). If the security interface control determines based on the metadata that the secure client is not allowed to be launched, the security interface control returns an error to the owner and / or entity requesting to launch the secure client (145). By returning the error, the security interface control has aborted the attempt to launch the secure client. In some embodiments of the present invention, the security interface control ignores the request to launch the secure client. Depending on the configuration of the security interface control, the response to the hypervisor's command to launch the secure client (from the image) may be different when the metadata linked to the image indicates that the secure client is not allowed to be used in a given system based on the incompatibility of the control symbol with the system settings. If the security interface control determines based on the metadata and the system settings that the secure client is allowed, the security interface control enables the hypervisor to launch the secure client based on the image (150). Because the security interface control intercepts the attempt to launch the secure client, the security interface control interrupts the command to launch the secure client before the secure client is launched. Thus, the security interface control effectively denies requests that conflict with system settings based on the control characters in the metadata. The blocking or allowing of various security clients is accomplished by the security interface control before any other component of the system can launch the security client. For example, in some embodiments of the present invention, the control characters in the metadata of the image linked to the security client can instruct the security interface control to constrain the security client based on the host system being configured to perform hardware measurements and / or based on the host system being configured to use non-system-specific host keys.

[0038] Return to Figure 1 As described above, during the execution of the secure client, the security interface control may monitor system settings (160), and if the security interface control determines that a system setting that previously indicated that the secure client was allowed to execute in the environment has changed in a manner that conflicts with the control symbol, the security interface control may terminate the secure client (and / or cause the hypervisor to terminate the secure client) during execution (170). The security interface control may continue to monitor the system settings to detect the occurrence of such changes (165). In some embodiments of the invention, the security interface control instructs (e.g., forces) the hypervisor to terminate the secure client.

[0039] Figure 2 is a technical environment 200 including various aspects of some embodiments of the present invention. Figure 2The components of the technical environment 200 of the present invention illustrate how the security interface control enables the client owner to control the functionality of the client image through encryption unique to each owner, and the security interface control enables / disables the execution of a secure client based on a given image in a specific host environment. For secure execution, the secure client 210 is cryptographically linked to metadata 240, which is securely communicated to the security interface control 230 (e.g., trusted firmware, trusted components, etc.) based on a private host key that can only be accessed by the security interface control 230. The owner of the secure client 210 controls the security interface control 230 to allow or prohibit the execution of the secure client 210 based on the environmental constraints imposed by the owner. For example, the environmental constraints imposed by the owner through the security interface control 230 can limit the execution of the secure client in a host system configured for hardware measurement and / or a host system configured to use non-system-specific host keys. In some embodiments of the present invention, the key used to encrypt a portion of the metadata is derived using a private key that can only be accessed by the security interface control 230. Based on the owner's preferences as indicated in metadata 240 associated with secure client 210, security interface control 230 controls the launching of secure client 210 based on system settings 270. Security interface control 230 also monitors system settings 270 during runtime so that if and when system settings 270 change such that control symbol 260 no longer indicates that secure client 210 is compatible with technical environment 200, security interface control 230 can cause hypervisor 220 to terminate secure client 210.

[0040] In some embodiments of the present invention, a secure client 210 (e.g., a virtual machine, a virtual server) is controlled by a virtual machine monitor 220 (e.g., a virtual machine manager). A secure interface control 250 obtains metadata associated with a secure client 240 from the secure client 210 through the virtual machine monitor 220. The metadata 240 is integrity protected (and a portion of the metadata 220, namely, a secret 250 of the secure client, is also confidentiality protected (i.e., encrypted)). In some embodiments of the present invention, the metadata 240 is cryptographically linked to the boot image of the secure client 210. In some embodiments of the present invention, the secret 250 of the secure client is contained in the installation data (e.g., a secure execution (SE) header) of the secure client obtained from the owner by the security interface control 230. In some embodiments of the present invention, the metadata 240 contains values ​​derived from the boot image of the secure client 210, which are calculated using a collision-resistant one-way function (e.g., a cryptographic hash function) such that it is computationally infeasible to construct an alternative image that can derive the same value thereof.

[0041] like Figure 2As shown, metadata linked to secure client 240 includes secret 250. In some embodiments of the invention, the metadata of the client is integrity protected and the secret is encrypted using a key derived from a private key owned by secure interface control 230. The data encrypted by the key may contain cryptographic measures of the boot image of a given client. Thus, in some embodiments of the invention, the portion of metadata 240 containing secret 250 is encrypted by a key that only secure interface control 230 can compute. Metadata 240 need not be accessible to secure client 210 itself.

[0042] Metadata 240 is linked to the image of secure client 210, and secret 250 is cryptographically linked to the image of the secure client, but it is not part of the client. Instead, it is transmitted independently to a secure interface control (e.g., firmware, trusted component, software, hardware, etc.) as described herein (e.g., Figure 1 , 110). In embodiments of the invention, secret 250 is transmitted as part of the client metadata over a secure channel (i.e., encrypted) and cryptographically linked to the client. In some embodiments of the invention, metadata 240 is cryptographically linked to the client (e.g., contains a signature of the client image), so that metadata for one client cannot be misused as metadata for another client. Thus, security interface control 230 can verify that the client image and metadata / secret belong together (e.g., Figure 1 , 120). The metadata 240 transmitted (e.g., independently, via a secure channel) to the security interface control 230 is integrity and confidentiality protected.

[0043] In addition to including secrets 250, metadata 240 further includes control characters 260 that are utilized by security interface control 230 to allow and disallow the hypervisor to launch / execute secure client 210. Whether secure client 210 is allowed to launch (and in some cases continue to run) in technical environment 200 is determined by security interface control 230 based on comparing control characters 260 in metadata 240 with system settings 270. Security interface control 230 does not allow hypervisor 220 to launch secure client 210, and, at runtime, may cause hypervisor 220 to terminate secure client 210 based on restrictions described by metadata 240 (e.g., control characters 260) that indicate incompatibility with technical environment 200 based on system settings 270. In some embodiments of the present invention, metadata 240 includes control characters 260 that, if positive, indicate compatibility with aspects of a given technical environment, and, if negative, indicate constraints on running in a given technical environment. If the system setting 270 is changed after the security client 210 was previously launched based on the previous system setting 270 value, the security interface control 230 may cause the virtual machine monitor 220 to terminate the security client 210 when it is running because the security interface control 230 determines that the changed system setting 270 is incompatible with the control symbol 260, so that the control symbol 260 indicates that the security client 210 is restricted from executing in the technical environment 200.

[0044] In embodiments of the present invention, a control 260 in metadata 240 of an image linked to a secure client 210 represents one or more environmental constraints. In some embodiments of the present invention, depending on the setting of a given one of the control 260, the secure client 210 may or may not be started if the associated environmental constraint is satisfied (e.g., by a system setting 270). For example, when such a control is negative, the security interface control 230 may prohibit the launching of the secure client (e.g., by a hypervisor 220) when the associated environmental constraint is satisfied. Otherwise, if the control is positive, the security interface control 230 may allow the launching of the secure client 210 (e.g., by a hypervisor 220) when the associated environmental constraint is satisfied. When evaluating the metadata 240 of the secure client 210, the security interface control 230 may read the control 260, and for each control, the secure client 210 determines, based on the system setting 270, whether the computing environment 200 satisfies the associated environmental constraint of each control.

[0045] Figure 3 3 is a workflow 300 illustrating various aspects of some embodiments of the present invention. Figure 3As shown, aspects of various embodiments of the present invention enable the owner of a secure execution client to instruct a security interface control to allow or not allow the owner's secure client to run in a particular host environment. The client owner's decision can be specific to a particular client image, and the client owner typically communicates the decision to the system using metadata that is cryptographically linked to the secure client, which is enforced by the system (i.e., through the security interface control).

[0046] return Figure 3 In some embodiments of the present invention, a security interface control in a computing system obtains metadata linked to an image of a secure client to be launched by a virtual machine monitor, wherein the security interface control is communicatively coupled to the virtual machine monitor, wherein the virtual machine monitor manages one or more clients, wherein the metadata includes one or more control characters, wherein each of the one or more control characters indicates to the security interface control whether the secure client is allowed to execute in a specific technical environment (310). The metadata itself may be inaccessible to the secure client. As part of obtaining the metadata, in some embodiments of the present invention, the security interface control decrypts a portion of the metadata linked to the image of the secure client. The metadata is integrity protected, and, in some embodiments of the present invention, the portion is encrypted by a key derived from a private key and includes an encrypted measurement of a boot image of the secure client. The private key may be owned by the security interface control and may only be used by the security interface control. The key derived from the private key may (e.g., only) be shared between the security interface control and the owner. In some embodiments of the present invention, the metadata includes a value derived from the boot image of the secure client computed using a collision-resistant one-way function.

[0047] like Figure 2 As shown, one or more control characters (such as Figure 2 , 260) is metadata (such as Figure 2 , 240). In some embodiments of the present invention, the one or more control characters are contained in an encrypted portion of the metadata. The security interface control can decrypt the portion of the metadata, which is linked to the boot image of the secure client, wherein the metadata is integrity protected and the encrypted portion includes an encrypted measurement of the boot image of the secure client, the encrypted portion is encrypted by a key derived from a private key. In some embodiments of the present invention, the private key is implemented by a key derived from a private key that includes an encrypted measurement of the boot image of the secure client. The control characters may include positive designations or negative designations for various system settings, where a positive designation indicates that the secure client is allowed to execute based on a given system setting, and a negative designation indicates that the secure client is not allowed to execute based on a given system setting.

[0048] refer to Figure 3 , the security interface control intercepts a command to launch a secure client based on an image (320). In some embodiments of the present invention, the command is issued by a virtual machine monitor (e.g., a non-secure entity) executed by a client of a management host system. The security interface control determines whether to allow the secure client to execute in a technical environment defined by a system setting based on one or more control characters (330). In order to determine whether to allow the secure client to execute, in some embodiments of the present invention, the security interface control identifies a control character associated with one or more system settings in the one or more control characters (334). The security interface control determines whether the control character enables or restricts execution of the secure client based on the system setting (336).

[0049] Based on determining that the secure client is allowed to execute, the security interface control enables the hypervisor to begin executing the secure client based on the image within the computing system (340). Based on determining that the secure client is not allowed to execute, the security interface control ignores the command to start the secure client (345). By ignoring the command, the security control interface prevents the hypervisor from beginning to execute the secure client.

[0050] In some embodiments of the present invention, during the execution of the secure client, the security interface control determines that a setting has been changed (350). The security interface control determines whether the secure client is allowed to execute in a technical environment defined by the system setting (based on the change) based on one or more control characters (330). To determine whether the secure client is allowed to execute, in some embodiments of the present invention, the security interface control identifies a control character associated with one or more system settings in the one or more control characters (332). The security interface control determines whether the control character enables or restricts execution of the secure client based on the system setting (334). Based on determining that execution of the secure client is allowed, the security interface control enables the virtual machine monitor to continue to execute the secure client based on the image within the computing system (340). Based on determining that execution of the secure client is not allowed, the security interface control causes the virtual machine monitor to terminate the secure client (335).

[0051] Embodiments of the present invention include computer-implemented methods, computer program products, and computer systems, wherein a security interface control in a computing system, which may be any one or a combination of firmware, hardware, and software, obtains metadata linked to an image of a secure client to be launched by an owner and managed by a virtual machine monitor. The virtual machine monitor manages one or more clients, and the metadata includes one or more control characters. Each of the one or more control characters indicates to the security interface control whether the security interface control is allowed to launch (or maintain) a secure client generated using an image based on system settings. For example, in some embodiments of the present invention, program code of a security interface control (software, hardware, and / or firmware, etc.) in a computing system obtains metadata linked to an image of a secure client of an owner and managed by a virtual machine monitor, the security interface control is communicatively coupled to the virtual machine monitor, the virtual machine monitor manages one or more clients, wherein each of the one or more control characters indicates to the security interface control whether the virtual machine monitor is allowed to execute an instance of a secure client generated using an image in the computing system based on the presence or absence of one or more system settings in the computing system. The program code intercepts a command of the virtual machine monitor to launch an instance of a secure client from an image of a secure client. The program code determines the presence or absence of one or more system settings in the computing system. The program code determines whether to allow the hypervisor to execute the instance based on the presence or absence of the one or more control characters and the one or more system settings. Based on determining that the hypervisor is allowed to execute the instance, the program code enables the hypervisor to launch the instance in the computing system based on communicating the intercepted command to the hypervisor. Based on determining that the hypervisor is not allowed to execute the instance, the program code ignores the command.

[0052] In some embodiments of the present invention, when the program code obtains the metadata, the program code decrypts a portion of the metadata linked to the secure client image, wherein the metadata is integrity protected and the portion containing the encrypted measurement of the boot image of the secure client is encrypted by a key derived from the private key. In some embodiments of the present invention, the encrypted portion of the metadata includes one or more control characters. Each of the one or more control characters may include an environmental constraint. In some embodiments of the present invention, the environmental constraint is selected from the group consisting of: a system configured to perform hardware measurements, and a system configured to use a non-system specific host key.

[0053] In some embodiments of the present invention, the private key is owned by the security interface control and is used exclusively by the security interface control.

[0054] In some embodiments of the invention, a key derived from a private key is shared between the security interface control and the owner.

[0055] In some embodiments of the invention, the metadata includes a value derived from a boot image of the secure client computed using a collision resistant one-way function.

[0056] In some embodiments of the present invention, the one or more control characters each include a positive designation or a negative designation for a given system setting, wherein a positive designation indicates that a secure client instance is allowed to be executed in a computing system containing the given system setting, and a negative designation indicates that a secure client instance is not allowed to be executed in a computing system containing the given system setting.

[0057] In some embodiments of the invention, the metadata is inaccessible to the secure client instance.

[0058] In some embodiments of the present invention, the program code for determining whether to allow a virtual machine monitor to execute an instance also includes: program code for identifying a control character in the one or more control characters that is related to a setting in the one or more system settings; and program code for determining whether the control character enables or restricts the execution of the instance based on the control character.

[0059] In some embodiments of the invention, program code monitors the one or more system settings during runtime of the instance. The program code determines that at least one of the one or more settings changes during the runtime. The program code identifies a given control character of the one or more control characters that is associated with the at least one setting. The program code determines whether to allow a virtual machine monitor to execute the instance based on the at least one setting and the given control character. Based on determining that the virtual machine monitor is not allowed to execute the instance, the program code may terminate the instance via the virtual machine monitor.

[0060] In some embodiments of the present invention, the program code that intercepts a command to launch an instance of a secure client from an image of the secure client further includes: program code that performs an integrity check on metadata; based on successfully completing the integrity check, the program code reads the one or more control characters in the metadata.

[0061] Reference now Figure 4 , a schematic diagram of an example of a computing node, which may be a cloud computing node 10. Cloud computing node 10 is only an example of a suitable cloud computing node and is not intended to impose any limitations on the scope of use or functionality of the embodiments of the present invention described herein. Regardless, cloud computing node 10 is capable of implementing and / or performing any of the functions described above. In one embodiment of the present invention, secure client 210 ( Figure 2 )、Security interface control 230( Figure 2 ) and / or a virtual machine monitor 220 ( Figure 2 ) can be understood as in the cloud computing node 10 ( Figure 4), if not executed on the cloud computing node 10, then executed on one or more general-purpose computing nodes that include various aspects of the cloud computing node 10.

[0062] In the cloud computing node 10 there is a computer system / server 12, which can operate with many other general or special purpose computing system environments or configurations. Examples of known computing systems, environments, and / or configurations that may be suitable for use with the computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices, and the like.

[0063] Computer system / server 12 may be described in the general context of computer system executable instructions (e.g., program modules) being executed by the computer system. In general, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform specific tasks or implement specific abstract data types. Computer system / server 12 may be implemented in a distributed cloud computing environment, where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in local and remote computer system storage media including memory storage devices.

[0064] like Figure 4 As shown, a computer system / server 12 that can be used as a cloud computing node 10 is shown in the form of a general-purpose computing device. Components of the computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, a system memory 28, and a bus 18 that couples various system components including the system memory 28 to the processor 16.

[0065] Bus 18 represents one or more of several bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0066] Computer system / server 12 typically includes a variety of computer system readable media. Such media can be any available media that can be accessed by computer system / server 12, including volatile and non-volatile media, removable and non-removable media.

[0067] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache 32. The computer system / server 12 may also include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 34 may be provided for reading and writing to a non-removable, non-volatile magnetic medium (not shown, commonly referred to as a "hard drive"). Although not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM or other optical media) may be provided. In this case, each may be connected to the bus 18 via one or more data media interfaces. As will be further described and described below, the memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of an embodiment of the present invention.

[0068] A program / utility 40 having a set (at least one) of program modules 42 may be stored in memory 28 by way of example and not limitation, as may an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may include an implementation of a networking environment. Program modules 42 generally perform the functions and / or methods of embodiments of the present invention as described herein.

[0069] The computer system / server 12 may also communicate with one or more external devices 14 such as a keyboard, a pointing device, a display 24, etc.; with one or more devices that enable a user to interact with the computer system / server 12; and / or with any device that enables the computer system / server 12 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may occur through an input / output (I / O) interface 22. The computer system / server 12 may also communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet) through a network adapter 20. As shown, the network adapter 20 communicates with other components of the computer system / server 12 through a bus 18. It should be understood that, although not shown, other hardware and / or software components may also be used in conjunction with the computer system / server 12. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.

[0070] It should be understood that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Instead, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0071] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with a service provider. The cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0072] Features are as follows:

[0073] On-demand self-service: Cloud consumers can unilaterally provision computing capabilities, such as server time and network storage, automatically on demand without requiring manual interaction with the service provider.

[0074] Broad network access: Capabilities are provided over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs). Resource pooling: Providers' computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated as needed. There is a sense of location independence, as consumers typically have no control or knowledge of the exact location of the provided resources, but may be able to specify a location at a higher level of abstraction (e.g., country, state, or data center). Rapid elasticity: Capabilities can be provisioned quickly and elastically, in some cases automatically scaling up quickly, and releasing quickly to scaling down quickly. To consumers, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time.

[0075] Measured services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being used.

[0076] The service model is as follows:

[0077] Software as a Service (SaaS): The functionality provided to the consumer is to use the provider's applications running on the cloud infrastructure. These applications are accessible from different client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even individual application functionality, with the possible exception of limited user-specific application configuration settings.

[0078] Platform as a Service (PaaS): The functionality provided to the consumer is to deploy consumer-created or acquired applications on the cloud infrastructure, which are created using programming languages ​​and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly the configuration of the application hosting environment.

[0079] Infrastructure as a Service (IaaS): The functionality provided to consumers is to provide processing, storage, networking, and other basic computing resources on which consumers can deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0080] The deployment model is as follows:

[0081] Private Cloud: Cloud infrastructure is operated solely for an organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0082] Community cloud: The cloud infrastructure is shared by multiple organizations and supports a specific community with common concerns (e.g., mission, security requirements, policy, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0083] Public cloud: Cloud infrastructure is available to the general public or large industry groups and is owned by an organization that sells cloud services.

[0084] Hybrid cloud: A cloud infrastructure composed of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0085] The cloud computing environment is service-oriented, focusing on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is the infrastructure that includes a network of interconnected nodes.

[0086] See now Figure 5, depicting an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10, and local computing devices used by cloud consumers (such as personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N) can communicate with the cloud computing nodes 10. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as in the private clouds, community clouds, public clouds, or hybrid clouds described above, or a combination thereof. This allows the cloud computing environment 50 to provide infrastructure, platforms, and / or software as a service for which cloud consumers do not need to maintain resources on local computing devices. It should be understood that Figure 5 The types of computing devices 54A-N shown in are intended to be illustrative only, and computing node 10 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network addressable connection (eg, using a web browser).

[0087] See now Figure 6 , showing the cloud computing environment 50 ( Figure 5 ) provides a set of functional abstraction layers. It should be understood in advance that Figure 6 The components, layers and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0088] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: host 61; server 62 based on RISC (Reduced Instruction Set Computer) architecture; server 63; blade server 64; storage 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0089] Virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers 71 ; virtual storage 72 ; virtual networks 73 , including virtual private networks; virtual applications and operating systems 74 ; and virtual clients 75 .

[0090] In one example, the management layer 80 may provide the functionality described below. Resource provisioning 81 provides dynamic acquisition of computing resources and other resources for performing tasks within a cloud computing environment. Metering and pricing 82 provides cost tracking when resources are utilized within a cloud computing environment, and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection of data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-arrangement and procurement of cloud computing resources for future requirements for cloud computing resources anticipated according to the SLA.

[0091] The workload layer 90 provides examples of functions that can take advantage of the cloud computing environment. Examples of workloads and functions that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analysis processing 94; transaction processing 95; and controlling the execution of secure clients based on environmental factors through secure interface controls 96.

[0092] The present invention may be a system, method and / or computer program product of any possible integrated technical detail level. The computer program product may include a computer-readable storage medium (or medium) having computer-readable program instructions thereon, and the computer-readable program instructions are used to cause a processor to perform various aspects of the present invention.

[0093] A computer-readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device (such as a punch card or a raised structure in a groove with instructions recorded thereon), and any suitable combination of the above. As used herein, a computer-readable storage medium should not be interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by a fiber optic cable), or an electrical signal transmitted by a wire.

[0094] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives computer-readable program instructions from the network and forwards these computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0095] The computer-readable program instructions for performing the operation of the present technical solution can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcodes, firmware instructions, state setting data, configuration data of integrated circuits, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and procedural programming languages, such as "C" programming language or similar programming languages. The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer, partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network (including a local area network (LAN) or a wide area network (WAN)), or can be connected to an external computer (for example, by using the Internet of an Internet service provider). In some embodiments, an electronic circuit (including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA)) can execute a computer-readable program instruction to personalize the electronic circuit by using the state information of the computer-readable program instructions, so as to perform various aspects of the present invention.

[0096] Various aspects of the technical solution are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the technical solution. It should be understood that each box in the flowchart and / or block diagram and the combination of boxes in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0097] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine that, when executed by a processor of the computer or other programmable data processing apparatus, creates a device for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that can instruct a computer, a programmable data processing apparatus, and / or other device to function in a particular manner, such that a computer-readable storage medium having instructions stored therein includes an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0098] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other apparatus that causes a series of operating steps to be performed on a computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions and actions specified in one or more blocks in the flowchart and / or block diagram.

[0099] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the different embodiments of the present technical solution. To this end, each box in the flowchart or block diagram can represent a part of a module, segment or instruction, which includes one or more executable instructions for realizing the specified logical function. In some alternative embodiments, the functions marked in the box may not occur in the order marked in the figure. For example, depending on the functions involved, the two boxes shown in succession can actually be executed substantially at the same time, or these boxes can sometimes be executed in the opposite order. It will also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented by a system based on special-purpose hardware, and the system based on special-purpose hardware performs a specified function or action or performs a combination of special-purpose hardware and computer instructions.

[0100] The terms used herein are only used for the purpose of describing specific embodiments and are not intended to be limiting. As used herein, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that when the terms "comprise" and / or "comprising" are used in this specification, they specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0101] The corresponding structures, materials, actions, and equivalents of all means or step plus function elements (if any) in the following claims are intended to include any structure, material, or action for performing a function in combination with other claim elements of a specific claim. A description of one or more embodiments has been given for the purpose of illustration and description, but is not intended to be exhaustive or limited to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to best explain various aspects and practical applications so that those of ordinary skill in the art can understand different embodiments with different modifications suitable for the intended specific use.

Claims

1. A computer-implemented method comprising: obtaining, by a security interface control in a computing system, metadata linked to an image of a secure client of an owner and managed by a hypervisor, wherein the security interface control is communicatively coupled to the hypervisor, wherein the hypervisor manages one or more clients, wherein the metadata includes one or more control characters, wherein each of the one or more control characters indicates to the security interface control whether to allow the hypervisor to execute an instance of the secure client generated with the image in the computing system based on the presence or absence of one or more system settings in the computing system; intercepting, by the security interface control, a command of the hypervisor to start an instance of the secure client from the image of the secure client; determining, by the security interface control, the presence or absence of the one or more system settings in the computing system; determining, by the security interface control, whether to allow the hypervisor to execute the instance based on the presence or absence of the one or more control characters and the one or more system settings; Based on the determination, the hypervisor is allowed to execute the instance: The secure interface control communicates the intercepted command to the hypervisor, so that the hypervisor can launch the instance in the computing system; monitoring, by a security interface control, the one or more system settings; determining, by the security interface control, that at least one of the one or more settings changes during runtime; identifying, by the security interface control, a given one of the one or more control characters associated with the at least one setting; and determining, by the security interface control, whether to allow the virtual machine monitor to execute the instance based on the at least one setting and the given control character; and The command is ignored by the security interface control based on determining that the hypervisor is not allowed to execute the instance.

2. The computer-implemented method of claim 1 , wherein: Obtaining metadata further includes: A portion of metadata linked to an image of a secure client is decrypted by a security interface control, wherein the metadata is integrity protected and the portion containing an encrypted metric of a boot image of the secure client is encrypted by a key derived from the private key.

3. The computer-implemented method of claim 1 , wherein: The encrypted portion of the metadata includes the one or more control characters.

4. The computer-implemented method of claim 1 , wherein each of the one or more control symbols comprises an environmental constraint.

5. The computer-implemented method of claim 4, wherein: The environmental constraint is selected from the group consisting of: a system configured to perform hardware measurement, and a system configured to use a non-system specific host key.

6. The computer-implemented method of claim 2, wherein: The private key is owned by the security interface control and is used exclusively by the security interface control.

7. The computer-implemented method of claim 6, wherein: The key derived from the private key is shared between the security interface control and the owner.

8. The computer-implemented method of any one of claims 1 to 7, wherein: The metadata includes a value derived from the secure client's boot image computed using a collision-resistant one-way function.

9. The computer-implemented method of any one of claims 1 to 7, wherein: The one or more control characters each include a positive designation or a negative designation for a given system setting, wherein a positive designation indicates that the secure client instance is allowed to execute in a computing system that includes the given system setting, and a negative designation indicates that the secure client instance is not allowed to execute in a computing system that includes the given system setting.

10. The computer-implemented method of any one of claims 1 to 7, wherein: The metadata is inaccessible to instances of the secure client.

11. The computer-implemented method of any one of claims 1 to 7, wherein: Determining whether to allow the hypervisor to execute the instance further includes: identifying, by the security interface control, a control character from among the one or more control characters that is associated with a setting from among the one or more system settings; and The security interface control determines whether the control character enables or restricts the execution instance according to the control character.

12. The computer-implemented method of claim 1 , further comprising: The instance is terminated by the security interface control through the hypervisor based on a determination that the hypervisor is not permitted to execute the instance.

13. The computer-implemented method of any one of claims 1 to 7, wherein: The command intercepted by the security interface control to start an instance of the secure client from the image of the secure client further includes: Integrity checks on metadata are performed by security interface controls; and Based on successfully completing the integrity check, the one or more control characters in the metadata are read by the security interface control.

14. A computer program product comprising: A computer-readable storage medium is readable by one or more processors and stores instructions for execution by one or more processors, the instructions being used to execute a method, the method comprising: obtaining, by one or more processors in a computing system, metadata linked to an image of a secure client of an owner and managed by a monitor, wherein the one or more processors are communicatively coupled to a hypervisor, wherein the hypervisor manages the one or more clients, wherein the metadata includes one or more control characters, wherein each of the one or more control characters indicates to a security interface control whether to allow the hypervisor to execute an instance of a secure client generated with the image in the computing system based on the presence or absence of one or more system settings in the computing system; intercepting, by one or more processors, a command of the hypervisor to launch an instance of a secure client from an image of the secure client; determining, by one or more processors, the presence or absence of the one or more system settings in the computing system; determining, by the one or more processors, whether to allow the hypervisor to execute the instance based on the presence or absence of the one or more control characters and the one or more system settings; Based on the determination, the hypervisor is allowed to execute the instance: enabling the hypervisor to launch an instance in the computing system based on communicating the intercepted command to the hypervisor by the one or more processors; monitoring, by a security interface control, the one or more system settings; determining, by the security interface control, that at least one of the one or more settings changes during runtime; identifying, by the security interface control, a given one of the one or more control characters associated with the at least one setting; and determining, by the security interface control, whether to allow the virtual machine monitor to execute the instance based on the at least one setting and the given control character; and Based on determining that the hypervisor is not allowed to execute the instance, the command is ignored by the one or more processors.

15. The computer program product of claim 14, wherein: Obtaining metadata further includes: A portion of metadata linked to an image of the secure client is decrypted by the one or more processors, wherein the metadata is integrity protected and the portion containing encrypted metrics of a boot image of the secure client is encrypted by a key derived from the private key.

16. The computer program product of claim 15, wherein: The encrypted portion of the metadata includes the one or more control characters.

17. The computer program product of any one of claims 14 to 16, wherein each of the one or more control symbols comprises an environmental constraint.

18. The computer program product of claim 17, wherein: The environmental constraint is selected from the group consisting of: a system configured to perform hardware measurement, and a system configured to use a non-system specific host key.

19. A system comprising: Memory; one or more processors in communication with the memory; Program instructions executable by one or more processors through a memory to perform a method, the method comprising: obtaining, by one or more processors in a computing system, metadata linked to an image of a secure client of an owner and managed by a monitor, wherein the one or more processors are communicatively coupled to a hypervisor, wherein the hypervisor manages the one or more clients, wherein the metadata includes one or more control characters, wherein each of the one or more control characters indicates to a security interface control whether to allow the hypervisor to execute an instance of a secure client generated with the image in the computing system based on the presence or absence of one or more system settings in the computing system; intercepting, by one or more processors, a command of the hypervisor to launch an instance of a secure client from an image of the secure client; determining, by one or more processors, the presence or absence of the one or more system settings in the computing system; determining, by the one or more processors, whether to allow the hypervisor to execute the instance based on the presence or absence of the one or more control characters and the one or more system settings; Based on the determination, the hypervisor is allowed to execute the instance: enabling the hypervisor to launch an instance in the computing system based on communicating the intercepted command to the hypervisor by the one or more processors; monitoring, by a security interface control, the one or more system settings; determining, by the security interface control, that at least one of the one or more settings changes during runtime; identifying, by the security interface control, a given one of the one or more control characters associated with the at least one setting; and determining, by the security interface control, whether to allow the virtual machine monitor to execute the instance based on the at least one setting and the given control character; and Based on determining that the hypervisor is not allowed to execute the instance, the command is ignored by the one or more processors.

Images