Abstract: Aspects of the invention include loading an image of a virtual server onto a boot partition of a trusted execution environment (TEE), wherein a first key is embedded in the image. A second key is received from an end customer of an application. Data is received from an independent software vendor (ISV) of the application, wherein the data includes a third key. The second key and the third key are combined inside the TEE to create a fourth key. An available memory space in an independent memory device is encrypted using the fourth key to create a secure data volume. Encrypted data is stored in the secure data volume.

Abstract: The present disclosure relates to a computer implemented method for executing an application. The method comprises: executing a bootloader in a trusted execution environment, wherein the executing comprises: decrypting received encrypted secrets using decryption keys of the boot loader, storing the decrypted secrets in a storage accessible by the application, creating a proof record indicating the application, the secrets and the trusted execution environment, storing the proof record in the storage, and deleting the decryption keys. The application may be executed in the trusted execution environment using the decrypted secrets. The proof record may be provided by the application for proving authenticity.

Abstract: Aspects of the invention include loading an image of a virtual server onto a boot partition of a trusted execution environment (TEE), wherein a first key is embedded in the image. A second key is received from an end customer of an application. Data is received from an independent software vendor (ISV) of the application, wherein the data includes a third key. The second key and the third key are combined inside the TEE to create a fourth key. An available memory space in an independent memory device is encrypted using the fourth key to create a secure data volume. Encrypted data is stored in the secure data volume.

Abstract: The present disclosure relates to a method for deploying an application in an execution environment using a first and second sets of key pairs. The method comprises: creating a sequence of tasks comprising build tasks followed by a deploy task. The tasks are configured to receive a task input for performing the tasks. The task input comprises a contribution input and an output of a task preceding at least one of the build tasks. The contribution input comprises secrets. The output of the build tasks is encrypted with a respective encryption key of the first set of key pairs, wherein the contribution input of a task subsequent to the first task is encrypted with a respective encryption key of the second set of keys. The tasks may be executed in the execution environment using unencrypted content of the task inputs.

Abstract: The present disclosure relates to a computer implemented method for executing an application. The method comprises: executing a bootloader in a trusted execution environment, wherein the executing comprises: decrypting received encrypted secrets using decryption keys of the boot loader, storing the decrypted secrets in a storage accessible by the application, creating a proof record indicating the application, the secrets and the trusted execution environment, storing the proof record in the storage, and deleting the decryption keys. The application may be executed in the trusted execution environment using the decrypted secrets. The proof record may be provided by the application for proving authenticity.

Abstract: The present disclosure relates to a method for deploying an application in an execution environment using a first and second sets of key pairs. The method comprises: creating a sequence of tasks comprising build tasks followed by a deploy task. The tasks are configured to receive a task input for performing the tasks. The task input comprises a contribution input and an output of a task preceding at least one of the build tasks. The contribution input comprises secrets. The output of the build tasks is encrypted with a respective encryption key of the first set of key pairs, wherein the contribution input of a task subsequent to the first task is encrypted with a respective encryption key of the second set of keys. The tasks may be executed in the execution environment using unencrypted content of the task inputs.

Abstract: Aspects of the invention include obtaining, via a processor, an original docker image from a customer, encrypting a disk image using content from the original docker image and encrypting a bootloader. A re-packaged image is created using the encrypted disk image and the secure encrypted bootloader. The re-packaged image is deployed by inserting the re-package image into a pod container and by means of using a mutating webhook, granting elevated privileges to said container and creating a secured Kubernetes pod for protecting workloads, wherein the secured Kubernetes pod has at least one virtual machine containing the pod container.

Abstract: Aspects of the invention include obtaining, via a processor, an original docker image from a customer, encrypting a disk image using content from the original docker image and encrypting a bootloader. A re-packaged image is created using the encrypted disk image and the secure encrypted bootloader. The re-packaged image is deployed by inserting the re-package image into a pod container and by means of using a mutating webhook, granting elevated privileges to said container and creating a secured Kubernetes pod for protecting workloads, wherein the secured Kubernetes pod has at least one virtual machine containing the pod container.

Abstract: A method includes loading a virtual machine snapshot of a virtual machine from a first computing device to a mobile device. The virtual machine runs on the first computing device and the virtual machine snapshot includes a COW file and an image file with files from the virtual machine. The method includes launching the virtual machine on a second computing device, where the second computing device reads the virtual machine snapshot from the mobile device and the second computing device records changes to a copy of the COW file stored on the second computing device while the second computing device runs the virtual machine. The method includes terminating a virtual machine session running on the second computing device and copying the COW file to the mobile device. The COW file includes changes to the virtual machine snapshot from execution of the virtual machine on the second computing device.

Abstract: A VM loading module loads a virtual machine snapshot of a virtual machine from a first computing device to a mobile device. The virtual machine runs on the first computing device and the virtual machine snapshot includes a copy-on-write (“COW”) file and an image file of files from the virtual machine. A VM launch module launches the virtual machine on a second computing device, which reads the virtual machine snapshot from the mobile device and the second computing device records changes to the COW file stored on the second computing device while running the virtual machine. A session termination module terminates a session of execution of the virtual machine running on the second computing device and copies the COW file from the second computing device to the mobile device. The COW file includes changes to the virtual machine snapshot from the virtual machine on the second computing device.

Abstract: A method includes loading a virtual machine snapshot of a virtual machine from a first computing device to a mobile device. The virtual machine runs on the first computing device and the virtual machine snapshot includes a COW file and an image file with files from the virtual machine. The method includes launching the virtual machine on a second computing device, where the second computing device reads the virtual machine snapshot from the mobile device and the second computing device records changes to a copy of the COW file stored on the second computing device while the second computing device runs the virtual machine. The method includes terminating a virtual machine session running on the second computing device and copying the COW file to the mobile device. The COW file includes changes to the virtual machine snapshot from execution of the virtual machine on the second computing device.

Abstract: A VM loading module loads a virtual machine snapshot of a virtual machine from a first computing device to a mobile device. The virtual machine runs on the first computing device and the virtual machine snapshot includes a copy-on-write (“COW”) file and an image file of files from the virtual machine. A VM launch module launches the virtual machine on a second computing device, which reads the virtual machine snapshot from the mobile device and the second computing device records changes to the COW file stored on the second computing device while running the virtual machine. A session termination module terminates a session of execution of the virtual machine running on the second computing device and copies the COW file from the second computing device to the mobile device. The COW file includes changes to the virtual machine snapshot from the virtual machine on the second computing device.

Abstract: The present invention relates to a client-server system having a security system for controlling access to application functions. The security system separated from the clients and the application functions routes all incoming requests created by various PVC-devices to a centralized security system providing an authentication component and a security component. The authentication component provides several authentication mechanisms which may be selected by information contained in the client's request. The authentication mechanism may be changed or extended without changing conditions on the client as well on the server or application side. The security component provides a security policy describing security requirements for accessing application functions which may be invoked by the security component. If the selected authentication mechanism succeeds and fulfills the security policy associated to that application function then the application function will be invoked by the security component.

Abstract: The present invention relates to a client-server system having a security system for controlling access to application functions. The security system separated from the clients and the application functions routes all incoming requests created by various PVC-devices to a centralized security system providing an authentication component and a security component. The authentication component provides several authentication mechanisms which may be selected by information contained in the client's request. The authentication mechanism may be changed or extended without changing conditions on the client as well on the server or application side. The security component provides a security policy describing security requirements for accessing application functions which may be invoked by the security component. If the selected authentication mechanism succeeds and fulfills the security policy associated to that application function then the application function will be invoked by the security component (FIG. 3).

Abstract: An Extended SmartCard file system is proposed which resides in one flat file within the ISO file system of a SmartCard. A second file containing user information like size of the file system, owner information, and key fields is used to configure the file system driver dynamically. However, this file may be omitted if the file system driver is statically initialized. The nested file system of the present invention has the advantage that files can be fully dynamically accessed and edited without affecting the underlying ISO file layout, i.e. the outer fixed structure of the outer file system. Further, data integrity and consistency are achieved by a transaction oriented commit concept. Additionally, all security mechanisms of the underlying SmartCards in terms of data protection are fully maintained and are enhanced in cases of power loss or unexpected card removal as two distinct directories are provided for data management.

Abstract: A system and method for processing information contained in a smart card (130) uses a local computer (100) on which a proxy server (120) is installed. The local computer is connected to a data communication network (110), such as the Internet, and comprises a network browser which is used to generate access requests to data stored on a smart card and in a local storage (122). The requests are received by an HTTP server (210) and passed to request brokers (214, 215, 216). In response to a request parsing operation access functions (226, 228, 340, 440, 350, 460) are activated for accessing the local storage and a smart card (130). Data read from a smart card may be inserted into a HTML document accessed in the local storage, and data from the local storage or from remote sources may be uploaded to a smart card.

Abstract: Java methods contained in a Java class and method database are accessed by a non-Java application running on a local machine or a remote machine. The non-Java application generates a standard TCP/IP communication call for a method of a Java class in the database. A Java service server running on a Java VM on the local machine receives the method call and related parameter data and performs their processing including a conversion of the call and of related parameter data from a transport format into Java native data types. The converted data is used for invoking a Java method for execution by applying the method to the converted parameter data. The result data of the method execution is converted from the Java format into the transport format in which they are transmitted to the non-Java application.