Method, system, and apparatus for integrating user application container image into cloud computing platform

Abstract

A method of integrating user application container image into a cloud computing platform is disclosed. The method comprises receiving from a user the container image where the user application and its dependencies are packed into the container image. The method further comprises converting the received container image into a confidential Unikernel image that is deployable inside of trusted execution environment enclave of a cloud computing platform. The Unikernel image includes the user application and its dependencies and Unikernel operating system customised to the user application.

Description

[0001] METHOD, SYSTEM, AND APPARATUS FOR INTEGRATING USER APPLICATION CONTAINER IMAGE INTO CLOUD COMPUTING PLATFORM

[0002] TECHNICAL FIELD

[0003] The present disclosure relates generally to the field of cloud computing and more specifically, to a method, system, and apparatus for integrating a user application container image into a cloud computing platform.

[0004] BACKGROUND

[0005] Evolving demands for better performance in cloud data centres are driving a fundamental change in cloud infrastructure. Conventional monolithic architecture, where hardware resources, such as CPUs, accelerators, and memory are tied to a machine limits the flexibility in managing resources. Confidential cloud computing is a modem way to keep sensitive data safe when the sensitive data is being handled in the cloud infrastructure. Furthermore, confidential cloud computing uses special environments called trusted execution environments (TEEs) such as Intel SGX, Intel TDX, ARM CCA, AMD SEV SNR, and the like. Confidential cloud computing provides a user in various industries with secure virtual machines that are protected from unauthorized access. Moreover, confidential cloud computing supports remote attestation which allows a user to establish trust to their application miming in a secure enclave, or secure virtual machine deployed in a remote host in the cloud infrastructure. In a cloud computing environment, confidential VMs with container support offer an easy way to “lift and shift” legacy applications to run them securely inside the TEEs causing a larger trusted computing base (TCB) size in comparison to confidential computing technologies targeted at a process level like Intel SGX, as the users are required to place trust in the guest OS.

[0006] However, the field of confidential cloud computing faces certain challenges and limitations. Two fundamental issues arise with the use of confidential virtual machines (VMs). Firstly, the inclusion of a general-purpose operating system (Guest OS) within the VM leads to a larger trusted computing base (TCB) size, which can potentially increase the attack surface and compromise the security of a system. Secondly, the presence of a bloated Guest OS results in increased application overhead and longer boot times, which hinders efficiency and performance of the confidential VMs, impacting usability and practicality of the system.

[0007] Conventionally, the confidential cloud computing techniques require the users to trust the Guest OS, which contributes to the bloating of the TCB size. Furthermore, many additional services and features offered by the Guest OS are often not utilized by a user application, leading to unnecessary overhead. Therefore, there is a need for a mechanism for confidential and lightweight virtualization for applications in the cloud computing.

[0008] Therefore, in light of the foregoing discussion, there exists a need to overcome the aforementioned drawbacks associated with the conventional methods and conventional systems for integrating the user application container image into a cloud computing platform.

[0009] SUMMARY

[0010] The present disclosure provides a method of integrating a user application container image into a cloud computing platform and a corresponding system. Furthermore, the present disclosure further provides an apparatus for integrating a user application container image into a cloud computing platform. The present disclosure provides a solution to the existing problem of how to provide a method and a mechanism for confidential and lightweight virtualization for applications in the cloud computing. An objective of the present disclosure is to provide a solution that overcomes at least partially the problems encountered in the prior art and provides an improved method, system, and apparatus for integrating the user application container image into the cloud computing platform.

[0011] One or more objectives of the present disclosure are achieved by the solutions provided in the enclosed independent claims. Advantageous implementations of the present disclosure are further defined in the dependent claims.

[0012] In one aspect, the present disclosure provides a method of integrating a user application container image into a cloud computing platform. The method includes receiving from a user a container image where a user application and its dependencies are packed into the container image. The method further includes converting the received container image into a confidential Unikemel image that is deployable inside of a trusted execution environment enclave of the cloud computing platform. The Unikemel image includes the user application and its dependencies and a Unikemel operating system customised to the user application.

[0013] Advantageously, the method leverages containerization technology to provide a standardized and portable approach for packaging and deploying the user applications. Furthermore, the method uses a layered file systems and include a specialized toolchain to simplify the process, enhancing scalability, flexibility, and security. Moreover, by virtue of converting the user's container image into the confidential Unikemel image deploy able within the trusted execution environment (TEE) enclave, the method ensures the confidentiality and security of the user application and its data. The TEE provides strong isolation, protecting the user application from external threats. Furthermore, the use of Unikemels, which are specialized, lightweight operating systems tailored to the user's application, leads to improved performance and efficient resource utilization. By eliminating unnecessary features and reducing the number of isolated domains, the method enhances user application’s performance and memory efficiency. Additionally, the generation of cryptographic measurements for various components of software stack, including the loader, linker, Unikemel OS, and the user application, enables integrity verification and remote attestation, which ensures the trustworthiness of the deployed image and facilitates the detection of potential unauthorized use by competitors.

[0014] In an implementation form, the method includes creating a security policy. The security policy protects the user application from untrusted components of the cloud computing platform. The conversion includes generating measurements for components of a software stack in the confidential Unikemel image. The security policy is created based on the generated measurements.

[0015] The security policy isolates the user's application from any untrusted or potentially malicious components within the cloud computing platform and creates a secure boundary around the user application, preventing unauthorized access or interference from untrusted components. Furthermore, by restricting the components that can interact with the user's application to only those listed in the security policy, the attack surface is significantly reduced.

[0016] In another implementation form, the method is performed by a confidential application image generator toolchain.

[0017] Advantageously, the confidential application image generator toolchain can be seamlessly integrated into existing container tooling ecosystems, such as Docker or Kubemetes, which application developers are already familiar with, that allows developers to continue using their preferred tools and workflows, while the confidential application image generator toolchain handles the necessary modifications and conversions in the background.

[0018] In another implementation form, the method includes deploying the confidential Unikemel image inside of the trusted execution environment enclave. Advantageously, the TEE enclaves provide a secure and isolated execution environment that is logically separated from the rest of a system, including the operating system and other applications. Furthermore, isolated execution environment ensures that the confidential Unikemel image and its user application data remain confidential and protected from unauthorized access or tampering, even in the presence of compromised or malicious components outside the enclave.

[0019] In a further implementation form, the method includes performing remote attestation to the deployed confidential Unikemel image in the cloud computing platform.

[0020] By performing remote attestation to the deployed confidential Unikemel image, the method provides a robust mechanism for verifying the integrity and establishing trust in the execution environment within the cloud computing platform, which enhances security, enables early detection of potential threats, supports continuous monitoring, enables scalability and automation, and helps meet regulatory compliance requirements, ultimately providing cloud users with increased confidence in the security and reliability of their applications running in the confidential cloud computing platform.

[0021] In a further implementation form, the confidential Unikemel image also includes a loader for securely initialising the Unikemel operating system which in turn securely loads a runtime environment.

[0022] By incorporating a loader for securely initializing the Unikemel operating system and subsequently loading the runtime environment, the method establishes a trusted and secure foundation for the execution of the user' s application within the trusted execution environment, which enhances the overall security, integrity, and trustworthiness of the execution environment, reducing the attack surface and enabling integration with remote attestation mechanisms for continuous verification and monitoring.

[0023] In a further implementation, the measurements include measurements for a loader module, a linker module, the Unikemel operating system, and the user application.

[0024] By including measurements for the loader module, the linker module, the Unikemel operating system, and the user application, the method enables granular integrity verification, establishes a robust chain of trust, supports comprehensive remote attestation, allows for targeted remediation, reduces the trusted computing base, and provides extensibility for future updates or changes to the software stack.

[0025] In a further implementation, the measurements are used as a reference for attestation.

[0026] By using measurements as a reference, the confidential cloud computing platform can compare the current state of the system and / or software against a trusted baseline, which also allows for the detection of any unauthorized changes or tampering, ensuring that the system remains secure and trustworthy.

[0027] In a further implementation, a remote attestation and management module performs remote attestation to verify an integrity of the components.

[0028] By conducting remote attestation, the method can verify whether the components have been tampered with or modified without authorization, which helps to ensure the overall security and trustworthiness of the system, even when components are located in different physical locations or across a network.

[0029] In a further implementation form, the security policy is uploaded to a remote attestation and management module which performs remote attestation to verify an integrity of the components, using the security policy. Advantageously, by uploading the security policy to the remote attestation and management module, the method performs remote attestation to ensure the integrity of system components while adhering to the specified security guidelines outlined in the security policy, which provides a comprehensive security framework where the system's components are continuously verified against the established security standards.

[0030] In another aspect, a system comprising means adapted for carrying out all the steps of the method according to any preceding method claim.

[0031] The disclosed system achieves all the advantages and technical effects of the method for integrating the user application container image into the cloud computing platform of the present disclosure.

[0032] In yet another aspect, the present disclosure provides an apparatus for integrating a user application container image into a cloud computing platform. The apparatus comprises a receiving unit, configured to receive from a user a container image where a user application and its dependencies are packed into the container image. The apparatus also comprises a converting unit, configured to convert the received container image into a confidential Unikemel image that is deployable inside of a trusted execution environment enclave of the cloud computing platform. The Unikemel image includes the user application and its dependencies and a Unikemel operating system customised to the user application.

[0033] The disclosed apparatus achieves all the advantages and technical effects of the method for integrating the user application container image into the cloud computing platform of the present disclosure.

[0034] It is to be appreciated that all the aforementioned implementation forms can be combined.

[0035] It has to be noted that all devices, elements, circuitry, units, and means described in the present application could be implemented in the software or hardware elements or any kind of combination thereof. All steps which are performed by the various entities described in the present application as well as the functionalities described to be performed by the various entities are intended to mean that the respective entity is adapted to or configured to perform the respective steps and functionalities. Even if, in the following description of specific embodiments, a specific functionality or step to be performed by external entities is not reflected in the description of a specific detailed element of that entity which performs that specific step or functionality, it should be clear for a skilled person that these methods and functionalities can be implemented in respective software or hardware elements, or any kind of combination thereof. It will be appreciated that features of the present disclosure are susceptible to being combined in various combinations without departing from the scope of the present disclosure as defined by the appended claims.

[0036] Additional aspects, advantages, features, and objects of the present disclosure would be made apparent from the drawings and the detailed description of the illustrative implementations construed in conjunction with the appended claims that follow.

[0037] BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The summary above, as well as the following detailed description of illustrative embodiments, is better understood when read in conjunction with the appended drawings. For the purpose of illustrating the present disclosure, exemplary constructions of the disclosure are shown in the drawings. However, the present disclosure is not limited to specific methods and instrumentalities disclosed herein. Moreover, those in the art will understand that the drawings are not to scale. Wherever possible, like elements have been indicated by identical numbers. Embodiments of the present disclosure will now be described, by way of example only, with reference to the following diagrams wherein:

[0039] FIG. 1 is a diagram that depicts a system for integrating a user application container image into a cloud computing platform, in accordance with an embodiment of the present disclosure;

[0040] FIG. 2 is a diagram that depicts an apparatus for integrating a user application container image into a cloud computing platform, in accordance with an embodiment of the present disclosure;

[0041] FIG. 3 is a diagram that depicts building and deploying a confidential Unikemel in the cloud computing platform, in accordance with an embodiment of the present disclosure;

[0042] FIG. 4 is a diagram that depicts conversion of a container image into a confidential Unikemel image, in accordance with another embodiment of the present disclosure;

[0043] FIG. 5 is a diagram that depicts a remote attestation and management module, in accordance with another embodiment of the present disclosure; and

[0044] FIG. 6 is a flow chart that depicts a method for integrating a user application container image into a cloud computing platform, in accordance with an embodiment of the present disclosure.

[0045] In the accompanying drawings, an underlined number is employed to represent an item over which the underlined number is positioned or an item to which the underlined number is adjacent. A non-underlined number relates to an item identified by a line linking the non-underlined number to the item. When a number is non-underlined and accompanied by an associated arrow, the non-underlined number is used to identify a general item at which the arrow is pointing.

[0046] DETAILED DESCRIPTION OF EMBODIMENTS

[0047] The following detailed description illustrates embodiments of the present disclosure and ways in which they can be implemented. Although some modes of carrying out the present disclosure have been disclosed, those skilled in the art would recognize that other embodiments for carrying out or practicing the present disclosure are also possible.

[0048] FIG. 1 is a diagram that depicts a system for integrating a user application container image into a cloud computing platform, in accordance with an embodiment of the present disclosure. With reference to FIG. 1 , there is shown a system 100 for integrating the user application container image into the cloud computing platform. The system 100 comprises a user application 102 and its dependencies packed into a container image 104. The container image 104 belongs to a user 106. The system 100 also comprises a Unikemel image 108. The Unikemel image 108 further comprises the user application 102, a Unikemel operating system 110, and a loader 112. The Unikemel image 108 is deployed in a trusted execution environment 114. The system 100 is deployed on a cloud computing platform 116.

[0049] The user application 102 refers to a main software program that is developed and used by the user 106 on the system 100. The user application 102 could be any software program designed to perform specific tasks or functions, such as a web server, database application, or data analytics tool. In an example of a cloud computing environment, the user application 102 may be a web application used for online shopping, a customer relationship management (CRM) system, a financial management software, and the like. Further, the dependencies of the user application 102 refer to the external components and libraries that the user application 102 relies on to function properly. The dependencies may include software libraries, frameworks, modules, and other resources that provide necessary functionality or support to the application. In an example, if the user application 102 is a web server, its dependencies might include libraries for handling HTTP requests, database connectors, and security modules.

[0050] The container image 104 refers to an executable software package that contains everything needed to run a piece of software, including the application code, runtime, libraries, environment variables, and dependencies. In an example, the container image 104 for a web application may include the web server software, application code, and necessary libraries packaged together. The user application 102 and the dependencies of the user application 102 are packed into the container image 104.

[0051] The user 106 refers to an individual entity who interacts with the system 100 and the user application 102 to perform the required tasks. The user 106 may be a developer, a system administrator, or an end-user who is involved in creating, deploying, managing, or using the system 100. In an example, the user 106 might be responsible for developing and deploying the user application 102, configuring security policies, and interacting with the cloud computing platform 116.

[0052] The Unikemel image 108 refers to a specialized, lightweight, standalone, and executable software package that contains only necessary components and libraries required to run the user application 102. The Unikemel image 108 is tailored to specific needs of the user application 102, resulting in a lightweight and efficient execution environment. In an example, the Unikemel image 108 for a web server application may include only the essential networking, file system, and HTTP server components required to serve web requests.

[0053] The Unikemel operating system 110 refers to an operating system designed specifically for Unikemel-based applications. The Unikemel operating system 110 is optimized for running single-purpose, lightweight applications such as the user application 102 within isolated execution environments such as the trusted execution environment 114. The Unikemel operating system 110 may include minimal kernel functionality tailored to the specific requirements of the user application 102, resulting in improved performance, reduced resource overhead, and enhanced security of the cloud computing platform 116.

[0054] The loader 112 refers to a component of the system 100 responsible for loading the Unikemel operating system 110. Thereafter, the Unikemal operating system together with the linker loads the application 102 and its dependencies. The loader 112 performs tasks such as allocating memory space, resolving external dependencies, and preparing the executable files and programs for execution. In the present disclosure, the loader 112 may specifically pertain to the component responsible for loading the application code, libraries, and other resources required for running the user application 102 within the trusted execution environment 114.

[0055] The trusted execution environment 114 to a secure and isolated execution environment provided by hardware and software mechanisms to protect sensitive code and data from unauthorized access, tampering, or disclosure. In an example, the trusted execution environment 114 may include Intel SGX (Software Guard Extensions), that provides hardware-based isolated execution environments for protecting sensitive code and data from unauthorized access or modification. Other examples may include ARM TrustZone and AMD Secure Encrypted Virtualization (SEV), that offer similar secure execution environments on different hardware architectures.

[0056] The cloud computing platform 116 refers to a centralized infrastructure service that provides on-demand access to computing resources over the internet. Examples of cloud computing platforms may include Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), and IBM Cloud. The cloud computing platform 116 offer a wide range of services, including infrastructure as a service (laaS), platform as a service (PaaS), and software as a service (SaaS), to support various computing workloads and applications.

[0057] The system 100 further comprises a hardware processor. The hardware processor refers to the primary component of the system 100 responsible for receiving the container image 104, converting the container image 104 into the Unikemel image 108, and coordinating the overall operation of the system 100 by processing data and executing software programs. Examples of the hardware processor may include, but are not limited to an integrated circuit, a co-processor, a microprocessor, a microcontroller, a complex instruction set computing (CISC) processor, an application-specific integrated circuit (ASIC) processor, a reduced instruction set (RISC) processor, a very long instruction word (VLIW) processor, a central processing unit (CPU), a state machine, a data processing unit, and other processors or circuits. Moreover, the hardware processor may refer to one or more individual processors, graphics processing devices, a processing unit that is part of a machine.

[0058] In operation, the hardware processor of the system 100 is configured to receive the container image 104 from the user 106. The container image 104 contains the user application 102 and its dependencies packed within the container image 104. The container image 104 is created by the user 106 using a container app launcher, such as Docker ch, and the like. A container runtime interacts with the container app launcher to create the container image 104 for the user application 102. The container runtime then fetches the user application 102 and its dependencies from a remote or local repository and stores the user application 102 and its dependencies in a local storage of the system 100 as a layered file system. Additionally, the container runtime fetches a toolchain to build a Unikemel for the container image 104. The toolchain is also stored in the local storage as a layered file system.

[0059] By packing the user application 102 and its dependencies into the container image 104, the system 100 becomes easier to manage and deploy the user application 102 within the cloud computing platform 116. The packing of user application 102 into the container image 104 allows for efficient and consistent deployment of the user application 102 across different cloud platforms, ensuring that the user application 102 runs smoothly without compatibility issues. Further, the use of layered file systems allows for efficient storage and retrieval of container image 104, and the inclusion of the toolchain enables the building of Unikemel specifically tailored for the user application 102 container image 104.

[0060] The hardware processor of the system 100 is further configured to convert the received container image 104 into the confidential Unikemel image 108. The Unikemel image 108 is deployable within the trusted execution environment 114 enclave of the cloud computing platform 116. The Unikemel image 108 includes the user application 102 and its dependencies, and the Unikemel operating system 110. The Unikemel operating system 110 is customised to the user application 102.

[0061] The system 100 uses the toolchain to convert the user’s 106 container image 104 into the confidential Unikemel image 108 that can be deployed within the trusted execution environment 114 enclave of the cloud computing platform 116.

[0062] The conversion of the user’s 106 container image 104 into the confidential Unikemel image 108 begins with the user 106 requesting and building the container image 104 using an unmodified container app launcher, such as Docker CLI, and the like. The container runtime then builds the container image 104 for the user application 102 and fetches the container image 104 from a remote or local repository. The fetched container image 104 is stored as the layered file system in the local repository. Additionally, the container runtime fetches the necessary toolchain for building a Unikemel specific to the user application 102 container image 104, which is also stored as the layered file system in the local repository.

[0063] The purpose of converting the user’s 106 container image 104 into the confidential Unikemel image 108 is to address engineering overhead faced by cloud users when using specialized kernels, like Unikemel, to run the user applications 102. By converting the user's application 102 container image 104 into the confidential Unikemel image 108 with a specialized kernel, the system 100 enables improved performance, reduced attack surface, and efficient resource utilization. Unikemel are lightweight, single-purpose operating systems that discard unnecessary features, resulting in a smaller trusted computing base (TCB) size and enhanced security. Additionally, using Unikemel allows for faster booting time compared to using a general- purpose guest OS. The technical effect of converting the user’s 106 container image 104 into the confidential Unikemel image 108 is the seamless integration of a user application 102 container image 104 into the cloud computing platform 116 by converting it into a confidential Unikemel image 108. The Unikemel image 108 is deployed within the trusted execution environment 104 enclave, ensuring the confidentiality and security of the user application 102. The Unikemel image 108 includes the user application 102 and the dependencies, as well as the customized Unikemel operating system 110 tailored specifically to the user application 102. By leveraging the toolchain and extending the container tooling ecosystem, the system 100 provides a transparent and efficient solution for cloud user 106 to utilize Unikemel without significant engineering overhead.

[0064] In an implementation, the hardware processor of the system 100 is further configured to create a security policy. The security policy protects the user application 102 from untrusted components of the cloud computing platform 116. The conversion of the user’s 106 container image 104 into the confidential Unikemel image 108 includes generating measurements for components of a software stack in the confidential Unikemel image 108. The security policy is created based on the generated measurements.

[0065] In such an implementation, “security policy” refers to a set of mles and guidelines that govern the protection of information and resources within the system 100. Further, "untrusted components" refers to software or hardware elements that are not considered reliable and secure and may pose a risk to overall integrity of the system 100. The term "generating measurements" refers to the act of collecting and producing quantitative or qualitative data points or metrics for analysis and evaluation purposes of components of the software stack in the confidential Unikemel image 108. The term "software stack" refers to a collection of software components, libraries, frameworks, and tools that work together to provide a specific functionality or support the execution of user application 102.

[0066] The user application 102 is protected from the untrusted components of the cloud computing platform 116 by creating security policy that ensure the user application 102 remains isolated from the rest of untrusted ecosystem. The purpose of creating the security policy is to safeguard the user application 102 and the confidential data from potential threats posed by the untrusted components within the cloud computing platform 116. By implementing the security policy, the system 100 aims to establish the trusted execution environment 114 for the user application 102 to operate securely. The technical effect of generating measurements for components of the software stack in the confidential Unikemel image 108 is to assess the integrity and trustworthiness of the components of the software stack. The measurements serve as a basis for creating the security policy, ensuring that only trusted components are allowed to interact with the user application 102. By doing so, the system 100 enhances the overall security of the user application 102 and protects the user application 102 from potential vulnerabilities or malicious activities within the cloud computing platform 116.

[0067] In an implementation, the receiving of the container image 104, the conversion of the container image 104 into the Unikemel image 108 and creating the security policy is performed by a confidential application image generator toolchain. The purpose of using the confidential application image generator toolchain is to minimize the efforts required by an application developer to run services in a trusted execution environment (TEE) 114. By converting the container image 104 into a confidential Unikemel image 108, the confidential application image generator toolchain enables the combination of confidential computing using TEEs 114 with Unikemel, thereby achieving high-security guarantees and high performance simultaneously. The technical effect of employing the confidential application image generator toolchain is the generation of measurements for all components of the software stack within the confidential Unikemel image 108. Moreover, the confidential application image generator toolchain streamlines the process of converting the container image 104 into the confidential Unikemel image 108, reducing the complexity and effort required by the application developer.

[0068] In an implementation, the confidential Unikemel image 108 is deployed within the enclave of the trusted execution environment 114. The confidential Unikemel image 108 is deployed within the enclave of the trusted execution environment 114 to ensure the confidentiality and security of the user application 102 container image 104. By deploying the confidential Unikemel image 108 inside the trusted execution environment 114 enclave, the user application 102 is protected from unauthorized access and tampering. The trusted execution environment 114 enclave provides a secure and isolated environment for running the user application 102, safeguarding sensitive data and preventing potential attacks. The trusted execution environment 114 enclave provides strong isolation, ensuring that the user application 102 and the dependencies are protected from external threats.

[0069] In an implementation, remote attestation is performed to the deployed confidential Unikemel image 108 in the cloud computing platform 116. The "remote attestation" refers to a process of verifying the integrity and authenticity of user application 102 and the dependencies, the loader 112, a linker and the Unikemel by securely measuring and reporting the software and hardware configurations in the cloud computing platform 116. The confidential Unikemel image 108 is remotely attested by utilizing the loader 112 and the linker provided in the TEE 114 during the building phase. The loader 112 is responsible for loading the Unikemel when the Unikemel is deployed in an untrusted cloud environment, while the linker reduces the number of isolated domains to 2. One of the domains contains remote attestation and management module for performing the boot or integrity measurement of the confidential Unikemel image 108. Performing remote attestation is performed to ensure the integrity and security of the deployed confidential Unikemel image 108 in the untrusted cloud environment. By verifying the authenticity and integrity of the confidential Unikemel image 108, the system 100 can detect any unauthorized modifications or tampering attempts. Thus, the system 100 helps in maintaining the high-security guarantees provided by combining confidential computing using TEEs 114 with Unikemel. The technical effect of performing remote attestation is that it provides assurance that the deployed confidential Unikemel image 108 has not been tampered with, ensuring the integrity of the user application 102 and the dependencies. Further, performing remote attestation enables the detection of competitors who may be using the system 100 without authorization by analysing public design / API documents that mention the combination of confidential computing using TEEs 114 with Unikemel for achieving high-security guarantees and high performance simultaneously.

[0070] In an implementation, the confidential Unikemel image 108 also includes the loader 112 for securely initialising the Unikemel operating system 110 which in turn securely loads a runtime environment. In other words, the loader 112 is responsible for securely initializing the Unikemel operating system 110 into the Unikemel image 108. The Unikemel operating system 110 further loads the runtime environment to the Unikemel image 108. The inclusion of the loader 112 for securely initializing the Unikemel operating system 110 is necessary to ensure the confidentiality and integrity of the Unikemel image 108. By securely initializing the Unikemel operating system 110, potential vulnerabilities or unauthorized access can be mitigated, enhancing the security of the system 100. The loader 112 ensures that the Unikemel image 108 is protected from unauthorized access and maintains the confidentiality of the user application 102. By securely loading the runtime environment, the system 100 enhances the overall security and trustworthiness of the Unikemel image 108, resulting in improved user application 102 performance and memory efficiency.

[0071] In an implementation, the measurements include measurements for a loader module, a linker module, the Unikemel operating system 110, and the user application 110. The hardware processor of the system 100 performs integrity measurements of the loader module, the linker module, the Unikemel operating system 110, and the user application 102 and the dependencies using the remote attestation and management module. Accordingly, a chain-of-trust is created where the hardware measures the integrity of the firmware (e.g., the TEE module), the firmware then measures the integrity of the loader, the loader measures the Unikemel operating system together with the linker, and the linker measures the integrity of the application.

[0072] By including measurements for the loader module, the linker module, the Unikemel operating system 110, and the user application 110, the system 100 ensures that the loader 112, the linker module, the Unikemel operating system 110, and the user application 110 are authentic and has not been tampered with, thereby enhancing the security of the remote attestation process. Further, the system 100 prevents unauthorized or malicious software from being executed, thereby enhancing the overall security and trustworthiness of the system 100. In an implementation, the system 100 comprises the linker module. The linker module is configured to reduce the number of isolated domains to two, including the remote attestation and management module. Additionally, by reducing the number of isolated domains to two and running the user application 102 with the same privilege as the Unikemel, the challenge of isolated domain switches is also addressed. By utilizing the linker module, the system 100 enables the remote attestation and management module to accurately measure the integrity of the loader, linker, and the user application and the libraries. Further, the linker module ensures the security and trustworthiness of the system 100, allowing for remote attestation and verification of the software components involved.

[0073] In an implementation, the system 100 transparently adopts the Unikemel operating system 110 within the Trusted Execution Environment (TEE) 114 for providing operating system services. The technical effect of using the Unikemel operating system 110 within the TEE 114 is the ability to fully specialize the execution environment of the user application 102 container image 104. The use of the container image 104 format allows the Unikemel-based images to be standalone and rely on the host for a para- virtualized device driver.

[0074] In an implementation, the measurements are used as a reference for attestation. In other words, the system 100 uses measurements to generate attestation reports for a virtual machine (VM). The measurements are performed on the loader module, the linker module, the Unikemel operating system 110, and the user application 110. of the components. The purpose of using measurements as the reference for attestation is to ensure the integrity and security of the VM. By measuring the loader module, the linker module, the Unikemel operating system 110, and the user application 110, any potential tampering or unauthorized modifications are detected, that further helps in establishing trust and verifying the authenticity of the VM. By generating attestation reports based on the measurements, the system 100 becomes possible to remotely verify the integrity of the VM. The system 100 ensures that the VM has not been compromised and provides assurance to the users or entities relying on the VMs security.

[0075] In an implementation, a remote attestation and management module performs remote attestation to verify an integrity of the components. The remote attestation is performed by the remote attestation and management module within the TEE 114 interacting with an attestation component during the creation of the confidential Unikemel image 108. The remote attestation and management module then proceeds to perform integrity measurements of the loader module, the linker module, the Unikemel operating system 110, and the user application 110, that are necessary for later remote attestation. The remote attestation is performed by the remote attestation and management module to provide a means to verify the integrity of the components involved in the system 100. By detecting any potential integrity violations, the system 100 takes appropriate actions to mitigate security risks and maintain the overall integrity of the system 100.

[0076] In an implementation, the security policy is uploaded to the remote attestation and management module which performs remote attestation to verify an integrity of the components, using the security policy. In another implementation, the security policy is created to protect the user application 102 from rest of the untrusted ecosystem. The security policy is created using measurements generated during the toolchain process. The user application 102 is protected by configuring and implementing security measures within the confidential Unikemel image 108. By implementing the security policy, the user application 102 can operate securely and maintain the confidentiality, integrity, and availability of data. Furthermore, the security policy is uploaded to the remote attestation and management module, that utilizes the security policy to perform remote attestation and verify the integrity of the components. The purpose of uploading the security policy to the remote attestation and management module is to enable remote attestation and verify the integrity of the components. The uploading of the security policy further helps in enhancing the security of the system 100 by verifying the integrity of the components.

[0077] FIG. 2 is a diagram that depicts an apparatus for integrating a user application container image into a cloud computing platform, in accordance with an embodiment of the present disclosure. With reference to FIG. 1 , there is shown a diagram 200 including an apparatus 202 for integrating the user application 102 container image 104 into the cloud computing platform 116. The apparatus 202 comprises a receiving unit 204, a converting unit 206, and a creating unit 208.

[0078] The apparatus 202 refers to a combination of tools, mechanisms, and processes designed to enable the deployment and execution of confidential user application 102 within the TEE 114. Furthermore, the apparatus 202 includes components such as the confidential application image generator toolchain, remote attestation mechanisms, and the deployment process within TEE enclaves.

[0079] The receiving unit 204 refers to a component or device designed to accept input, data, signals, or information from external sources for further processing and utilization. Examples of the receiving unit 204 may include but not limited to input ports on electronic devices like computers and smartphones for connecting external peripherals, network interface cards (NICs) for receiving data packets in computer networking, and the like. The converting unit 206 refers to a component that transforms input from one form into another, typically to facilitate compatibility, processing, and transmission. The creating unit 208 refers to a component responsible for generating something new based on predefined criteria and inputs.

[0080] In operation, the receiving unit 204 is configured to receive from the user 106 the container image 104 where the user application 102 and its dependencies are packed into the container image 104. By the inclusion of the receiving unit 204, the apparatus 202 serves the purpose of enabling user 106 to transmit container images 104 containing the user application 102 and its dependencies to the system 100. Furthermore, the inclusion facilitates the seamless transfer of user application 102 into the system 100 for processing and deployment within the cloud computing platform 116.

[0081] Further, the converting unit 206 is configured to convert the received container image 104 into the confidential Unikemel image 108 that is deployable inside of the trusted execution environment 114 enclave of the cloud computing platform 116. The Unikemel image 108 includes the user application 102 and its dependencies and the Unikemel operating system 110 customised to the user application 102. By the inclusion of the converting unit 206 within the apparatus 202, addresses the need to transform the received container image 104 into a format suitable for deployment within the trusted execution environment (TEE) 114 enclave of the cloud computing platform 116. Furthermore, the conversion of the received container image 104 into the confidential Unikemel image 108 is necessary to ensure the security and integrity of the user application 102 and its dependencies while running in the TEE 114, thereby mitigating potential security risks associated with deploying applications in cloud environments. By converting the container images 104 into the confidential Unikemel images 108 tailored to the user application 102, the apparatus 202 ensures that sensitive data and operations are protected within the TEE 114 enclave, shielding the user application 102 from potential threats and unauthorized access. Additionally, the use of Unikemel technology enables lightweight and efficient execution of user application 102, leading to improved performance and resource utilization within the cloud environment.

[0082] In an implementation, the creating unit 208 is configured to create a security policy, wherein the security policy protects the user application 102 from untrusted components of the cloud computing platform 116. The conversion includes generating measurements for components of a software stack in the confidential Unikemel image 108. The security policy is created based on the generated measurements. By inclusion of the creating unit within the apparatus 202, the apparatus 202 serves the purpose of generating the security policy to safeguard the user application 102 from untrusted components within the cloud computing platform 116. The security policy is essential to ensure the integrity and confidentiality of the user application 102 while it operates within the cloud computing platform 116, mitigating potential security risks and unauthorized access to sensitive data. Furthermore, the creating unit 206, configured within the apparatus 202, performs the task of generating the security policy by analysing the measurements generated for components of the software stack in the confidential Unikemel image 108. In another implementation, the measurements include measurements for the loader module, the linker module, the Unikemel operating system 108, and the user application 102. The measurements for each component are generated by the apparatus 202 as part of the conversion process from the received container image 104 to the confidential Unikemel image 108. The generation of the measurements involves analysing code and configurations of the loader module, the linker module, the Unikemel operating system 110, and the user application 102 to derive unique cryptographic hashes or signatures that represent their states at a particular point in time.

[0083] FIG. 3 is a diagram that depicts building and deploying a confidential Unikemel image in the cloud computing platform, in accordance with an embodiment of the present disclosure. FIG. 3 is described in conjunction with elements from FIG. 1 and FIG. 2. With reference to FIG. 3, there is shown a diagram 300 that depicts a high-level workflow of building and deploying Unikemel image 108 in the cloud computing platform 116. The diagram 300 depicts two main phases (i.e., confidential application building 302 and confidential application deployment 304).

[0084] In the confidential application building 302 phase, tools are designed to convert the container image 104, which includes the user application 102 and its dependencies, into the Unikemel image 108. The conversion happens in a tnisted executed environment 114. The app developer prepares the confidential application image generator toolchain 306 required to build the Unikemel specifically for the user application 102 container image 104. The confidential application image generator toolchain 306 includes a customized container runtime 308, a Unikemel builder 310, and a software integrity' generator 312. The Unikernel image 108 includes the user application 102, the Unikemel operating system 110 specialized for the user application 102, the loader 112, and the linker. The loader automatically 112 loads the Unikemel operating system 110 when the Unikemel image 108 is deployed in an untrusted cloud environment. The linker reduces the number of isolated domains to two, including a remote attestation and management module for performing the boot measurement of the Unikemel image 108.

[0085] In the confidential application deployment 304 phase, the Unikemel image 108 is deployed using a cloud provider’s usual tool in the TEE 114 enclave. The Unikemel image 108 within the TEE 114 enclave can be deployed on untrusted cloud entity' 314 including cloud container service 316, cloud network service 318, and cloud storage service 320. The remote attestation and management module within the Unikemel image 108 interacts with the attestation component when the Unikemel image 108 is created.

[0086] FIG. 4 is a diagram that depicts conversion of a container image into a confidential Unikemel image, in accordance with another embodiment of the present disclosure. FIG. 4 is described in conjunction with elements from FIG. 1 and FIG. 2. With reference to FIG. 4, there is shown a diagram 400 depicting an illustration of a system 100 that performs operations 402-414 for converting the container image 104 into the confidential Unikemel image 108.

[0087] At operation 402, the user 106 starts the system 100 by building the container image 104 for the user application 102 using an unmodified container app launcher 416 (for e.g., Docker cli). The unmodified container app launcher 414 interacts with a container runtime 416 to create the container image 104.

[0088] At operation 404, the container runtime 416 retrieves the container image 104 the user 106 wants to convert from a remote or local repository'.

[0089] At operation 406, the container image 104 is then stored on a secure local storage 418 as a layered file system.

[0090] At operation 408, the container runtime 416 also fetches the confidential application image generator toolchain 420 required to build the Unikemel specifically for the user application 102 container image 104. The confidential application image generator toolchain 420 image is also stored on the secure local storage 418 using the layered file system. At operation 410, the container runtime interacts with the fetched toolchain to build the Unikemel image 108 for the user's application 102. The Unikemel image 108 also includes Unikemel operating system, the remote attestation and management module, the linker module, and the loader module (112).

[0091] At operation 412, the toolchain 420 performs an integrity7measurement of the confidential Unikemel image 108. The measurement is then added to the security policy. The user 106 can upload the security policy to the remote attestation and management module. The security7policy contains measurements of each individual component (the loader module, the linker module, the user application 102 & dependencies) as well as the Unikemel image 108. The container image 104 is then converted to the Unikemel image 108.

[0092] FIG. 5 is a diagram that depicts a deployment of the confidential Unikemel image in the cloud computing platform, in accordance with another embodiment of the present disclosure. With reference to FIG. 5, there is shown a diagram 500 that depicts the deployment of a confidential Unikemel image 108 in the cloud computing platform 116.

[0093] The user 106 launches the confidential Unikemel image 108 using Docker or Kubemetes commands 502 through the container runtime 416. Further, before tire Unikemel image 108 starts running, the remote attestation process is initiated. The remote attestation process verifies the integrity and trustworthiness of the Unikemel image 108. Further, the remote attestation process generates a report that includes measurements on the software stack running inside the Unikemel image 108. For the generation of the report, firstly, TEE 114 hardware measures a firmware. Secondly, the firmware measures all components loaded and encrypted into the local memory of the Unikemel image 108. Lastly, the measurements are used to generate attestation reports for the Unikemel image 108. Further, to ensure the trustworthiness of the software stack components, secure and measured boot are employed. Further, when the Unikernel operating system 110 is loaded in a VM 508, the attestation module interacts with a remote attestation and key management service 504. Furthermore, the remote attestation and management module requests an attestation report from the VM 508. Further, the remote attestation and key management service 504 verifies the report before transferring configuration and secrets, including keys to decrypt the input data for the user application 102 deployed inside the Unikemel image 108. Furthermore, the remote attestation and key management service 504 itself runs inside a hardware TEE enclave 506, so it can be attested by the user 106 beforehand using tools provided by TEE providers (e.g., Intel Attestation Service (IAS)) to ensure it hasn’t been tampered with. Furthermore, the remote attestation and key management service 504 acts as the root of trust for the deployment. It handles Unikernel image 108 attestation for the user 106. The remote attestation and key management service 504 also supports elastic computing for distributed confidential applications because it can automatically attest Unikemel image 108 whenever they are spawned.

[0094] FIG. 6 is a flow chart that depicts a method for integrating a user application container image into a cloud computing platform, in accordance with an embodiment of the present disclosure. With reference to FIG. 6, there is shown a flowchart of a method 600 that includes the steps 602 to 604.

[0095] At step 602, the method 600 includes receiving from user 106 container image 104 where the user application 102 and its dependencies are packed into container image 104. The container image 104 is created by the user 106 using the container app launcher, such as Docker cli, and the like. The container runtime interacts with the container app launcher to create the container image 104 for the user application 102. The container runtime then fetches the user application 102 and its dependencies from the remote or local repository and stores the user application 102 and its dependencies in the local storage of the system 100 as the layered file system. Additionally, the container runtime fetches the toolchain to build a Unikemel for the container image 104. The toolchain is also stored in the local storage as a layered file system.

[0096] At step 604, the method 600 includes converting the received container image 104 into the confidential Unikemel image 108 that is deploy able inside of the trusted execution environment 114 enclave of the cloud computing platform 116. The Unikemel image 108 includes user application 102 and its dependencies and the Unikemel operating system 110 customised to the user application 102. By converting the user's application 102 container image 104 into the confidential Unikemel image 108 with a specialized kernel, the method 600 enables improved performance, reduced attack surface, and efficient resource utilization. Unikemel are lightweight, single-purpose operating systems that discard unnecessary features, resulting in a smaller trusted computing base (TCB) size and enhanced security. Additionally, using Unikemel allows for faster booting time compared to using a general-purpose guest OS. The technical effect of converting the user’s 106 container image 104 into the confidential Unikemel image 108 is the seamless integration of the user application 102 container image 104 into the cloud computing platform 116 by converting it into the confidential Unikemel image 108. The Unikemel image 108 is deployed within the trusted execution environment 1104 enclave, ensuring the confidentiality and security of the user application 102. The Unikemel image 108 includes the user application 102 and its dependencies, as well as the customized Unikemel operating system 110 tailored specifically to the user application 102. By leveraging the toolchain and extending the container tooling ecosystem, the method 600 provides a transparent and efficient solution for cloud user 106 to utilize Unikemel without significant engineering overhead.

[0097] There is provided a computer program comprising instructions that, when executed by the system 100, cause the system 100 to implement the method 500. In an example, the instructions are implemented on the computer-readable media, which include, but are not limited to, Electrically Erasable Programmable Read-Only Memory (EEPROM), Random Access Memory (RAM), Read-Only Memory (ROM), Hard Disk Drive (HDD), Flash memory, a Secure Digital (SD) card, Solid-State Drive (SSD), a computer-readable storage medium, and / or CPU cache memory. In an example, the instructions are generated by a computer program, which is implemented in view of the method 600 of integrating the user application 102 container image 104 into the cloud computing platform 116.

[0098] Modifications to embodiments of the present disclosure described in the foregoing are possible without departing from the scope of the present disclosure as defined by the accompanying claims. Expressions such as “including”, “comprising”, “incorporating”, “have”, “is” used to describe, and claim the present disclosure are intended to be construed in a non-exclusive manner, namely allowing for items, components or elements not explicitly described also to be present. Reference to the singular is also to be construed to relate to the plural. The word “exemplary” is used herein to mean “serving as an example, instance, or illustration”. Any embodiment described as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments or to exclude the incorporation of features from other embodiments. The word “optionally” is used herein to mean “is provided in some embodiments and not provided in other embodiments”. It is appreciated that certain features of the present disclosure, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the present disclosure, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable combination or as suitable in any other described embodiment of the disclosure.

Claims

CLAIMS1. A method (600) of integrating a user application (102) container image (104) into a cloud computing platform (116), comprising steps of: receiving from a user (106) a container image (104) where a user application (102) and its dependencies are packed into the container image (104) ; and converting the received container image (104) into a confidential Unikemel image (108) that is deployable inside of a trusted execution environment enclave (114) of the cloud computing platform (116), where the Unikemel image (108) includes the user application (102) and its dependencies and a Unikemel operating system (110) customised to the user application.

2. The method (600) of claim 1, further comprising a step of: creating a security policy, wherein the security policy protects the user application (102) from untrusted components of the cloud computing platform (116), wherein the conversion includes generating measurements for components of a software stack in the confidential Unikemel image (108), and wherein the security policy is created based on the generated measurements.

3. The method (600) of claim 1, wherein the method (600) is performed by a confidential application image generator toolchain.

4. The method (600) of claim 1, further including the step of deploying the confidential Unikemel image (108) inside of the trusted execution environment enclave (114).

5. The method (600) of claim 4, further including the step of performing remote attestation to the deployed confidential Unikemel image (108) in the cloud computing platform (116).

6. The method (600) of claim 1, wherein the confidential Unikemel image (108) also includes a loader (112) for securely initialising the Unikemel operating system (110) which in turn securely loads a runtime environment.

7. The method (600) of claim 2, wherein the measurements include measurements for a loader module, a linker module, the Unikemel operating system (110), and the user application (102).

8. The method (600) of claim 2, wherein the measurements are used as a reference for attestation.

9. The method (600) of claim 2, where a remote attestation and management module performs remote attestation to verify an integrity of the components.

10. The method (600) of claim 2, wherein the security policy is uploaded to a remote attestation and management module which performs remote attestation to verify an integrity of the components, using the security policy.

11. A system (100) comprising means adapted for carrying out all the steps of the method according to any preceding method claim.

12. A computer program comprising instructions for carrying out all the steps of the method according to any preceding method claim, when said computer program is executed on a computer system.

13. An apparatus (202) for integrating a user application (102) container image (104) into a cloud computing platform (116), comprising: a receiving unit (204), configured to receive from a user (106) a container image (104) where a user application (102) and its dependencies are packed into the container image (104); and a converting unit (206), configured to convert the received container image (104) into a confidential Unikemel image (108) that is deployable inside of a trusted execution environment enclave (114) of the cloud computing platform (116), where the Unikemel image (108) includes the user application (102) and its dependencies and a Unikemel operating system (110) customised to the user application (102).

14. The apparatus (202) of claim 13, further comprises a creating unit (208), configured to create a security policy, wherein the security policy protects the user application (102) from untrusted components of the cloud computing platform (116), wherein the conversion includes generating measurements for components of a software stack in the confidential Unikemel image (108), and wherein the security policy is created based on the generated measurements.

15. The apparatus (202) of claim 14, wherein the measurements include measurements for a loader module, a linker module, the Unikemel operating system (110), and the user application (102).

Images