Abstract: The disclosure herein describes deploying a Virtual Secure Enclave (VSE) using a universal enclave binary and a Trusted Runtime (TR). A universal enclave binary is generated that includes a set of binaries of Instruction Set Architectures (ISAs) associated with Trusted Execution Environment (TEE) hardware backends. A TEE hardware backend is identified in association with a VSE-compatible device. A VSE that is compatible with the identified TEE hardware backend is generated on the VSE-compatible device and an ISA binary that matches the TEE hardware backend is selected from the universal enclave binary. The selected binary is linked to a runtime library of the TR and loads the linked binary into memory of the generated VSE. The execution of a trusted application is initiated in the generated VSE using a set of interfaces of the TR. The trusted application depends on the TR interfaces rather than the selected ISA binary.

Abstract: System and method for managing migration of trusted execution environments (TEEs) based on migration policies utilizes a source migration agent in the source host computer and a destination migration agent in a destination host computer to migrate a source TEE in the source host computer to the destination host computer. A migration policy data of the source TEE is first transmitted to the destination migration agent from the source migration agent to determine whether the destination host computer satisfies migration policies specified in the migration policy data. In response to a determination that the destination host computer satisfies the migration policies specified in the migration policy data, a destination TEE is created in the destination host computer and memory pages of the source TEE are transmitted to the destination TEE. The memory pages are then restored at the destination TEE for execution.

Abstract: System and method for managing migration of trusted execution environments (TEEs) based on migration policies utilizes a source migration agent in the source host computer and a destination migration agent in a destination host computer to migrate a source TEE in the source host computer to the destination host computer. A migration policy data of the source TEE is first transmitted to the destination migration agent from the source migration agent to determine whether the destination host computer satisfies migration policies specified in the migration policy data. In response to a determination that the destination host computer satisfies the migration policies specified in the migration policy data, a destination TEE is created in the destination host computer and memory pages of the source TEE are transmitted to the destination TEE. The memory pages are then restored at the destination TEE for execution.

Abstract: System and method for creating linked clones of storage objects stored in a storage uses a target storage structure that includes a linked clone being created from a selected snapshot of a storage object and surface snapshots. The linked clone is created in the target storage structure with references to the selected snapshot of the storage object in a source storage structure without completely copying the selected snapshot to the target storage structure. The surface snapshots, which correspond to other snapshots of the storage object in the source storage structure, are created in the target storage structure with references to the other snapshots without completely copying the other snapshots to the target storage structure to produce the linked clone with similar snapshots as the storage object at a point in time when the selected snapshot was captured.

Abstract: System and method for managing different types of snapshots of storage objects stored in a storage system uses a storage structure that includes both a storage object and any snapshots of the storage object. When a request to delete a snapshot of the storage object is received, a determination is made whether the snapshot is a first snapshot type. After determining that the snapshot is not the first snapshot type, the snapshot is deleted from the storage structure. After determining that the snapshot is the first snapshot type, the snapshot is marked as delete designated, and a deletion of the snapshot from the storage structure is prevented when there is a second snapshot type snapshot remaining in the storage structure that was created after the snapshot had been created so that the snapshot is available when the second snapshot type snapshot is subsequently used.

Abstract: System and method for managing different types of snapshots of storage objects stored in a storage system uses a storage structure that includes both a storage object and any snapshots of the storage object. When a request to delete a snapshot of the storage object is received, a determination is made whether the snapshot is a first snapshot type. After determining that the snapshot is not the first snapshot type, the snapshot is deleted from the storage structure. After determining that the snapshot is the first snapshot type, the snapshot is marked as delete designated, and a deletion of the snapshot from the storage structure is prevented when there is a second snapshot type snapshot remaining in the storage structure that was created after the snapshot had been created so that the snapshot is available when the second snapshot type snapshot is subsequently used.

Abstract: System and method for creating linked clones of storage objects stored in a storage uses a target storage structure that includes a linked clone being created from a selected snapshot of a storage object and surface snapshots. The linked clone is created in the target storage structure with references to the selected snapshot of the storage object in a source storage structure without completely copying the selected snapshot to the target storage structure. The surface snapshots, which correspond to other snapshots of the storage object in the source storage structure, are created in the target storage structure with references to the other snapshots without completely copying the other snapshots to the target storage structure to produce the linked clone with similar snapshots as the storage object at a point in time when the selected snapshot was captured.