A single input/output (I/O) controller for both secure partitionable endpoints (PEs) and non-secure PEs is enabled in a trusted execution environment (TEE) where secure memory portions are isolated from non-secure PEs. Security attributes for certain endpoints indicate secure memory access privilege of owning entities of the certain endpoints. A security monitor has exclusive access to the address translation control tables (TCE) stored in secure memory associated with a secure endpoint. When owning entity reassignment occurs, the endpoints are reinitialized to support a change in ownership from an outgoing owning entity having secure memory access and an incoming owning entity not having secure memory access.

A secure guest of a computing environment requests confidential data. The confidential data is included in metadata of the secure guest, which is stored in a trusted execution environment of the computing environment. Based on the request, the confidential data is obtained from the metadata of the secure guest that is stored in the trusted execution environment.

A trusted execution environment obtains a secure guest image and metadata to be used to start a secure guest. The metadata includes multiple parts and a plurality of integrity measures. A first part of the metadata includes one or more integrity measures of the plurality of integrity measures, and a second part of the metadata includes customized confidential data of the secure guest and one or more other integrity measures of the plurality of integrity measures. The trusted execution environment is used to verify at least one select part of the metadata using at least one integrity measure of the plurality of integrity measures of the metadata. Based on successful verification of the at least one select part of the metadata, the trusted execution environment starts the secure guest using the secure guest image and at least a portion of the metadata.

A trusted execution environment obtains an attestation request. The attestation request includes at least an attestation key. Based on obtaining the attestation request, one or more integrity measurements are computed, and the computing uses at least the attestation key. The one or more integrity measurements are provided to an entity, and the one or more integrity measurements are to be used to verify that a secure guest has been started using a selected secure guest image and selected secure guest metadata.

The present disclosure is related to Virtual Desktop Infrastructure (VDI) that discloses a method and system for performing dynamic patch management in VDI platform. A patch managing system retrieves operational data and vulnerability remediation data related to IT services and infrastructures of the VDI platform from first and second data sources. Thereafter, the patch managing system detects gap in patching level based on operational data, vulnerability remediation data and corresponding industrial standard, and rolls out patches based on detected gap in patching level. Further, a patch prediction score that facilitates in identifying a probability of rolling back the patches rolled out for patching IT services and infrastructures of VDI platform is determined based on prediction parameters. A plan is generated based on the patch prediction score and executed to optimally patch the patches to IT services and infrastructures of the VDI platform, based on patching rules.

A guest operating system executing on a virtual machine hosted by a host operating system may forward information about the state of the guest operating system to the host operating system for analysis regarding security threats. The host operating system may also forward information about the state of the host operating system to the guest operating system for analysis regarding security threats. One or both of the guest operating system and the host operating system may also forward the information about their state(s) to a remote server for analysis regarding security threats to the machine running the host operating system and hosting the virtual machine running the guest operating system. Security threats may be identified based on a detection of abnormal behavior. Abnormal behavior may be detected using machine-learning models. The machine-learning models may be trained/refined over time based on collected state information.

A container login method, a container login apparatus, and a storage medium are provided. In an example embodiment, a target container login request from a browser is received; a first connection between a server and the browser is established based on the target container login request; an address of a control node corresponding to a container cluster in which a target container is located is obtained based on an identifier of the container cluster; and a second connection between the server and the target container is established based on the address of the control node and an identifier of the target container, to log in to the target container.

Method and apparatus for virtualized environment where virtual computing instances interface a service platform operated on a physical computing apparatus are disclosed. A new virtual computing instance interfacing the service platform can be created, the created new virtual computing instance belonging to a class of virtual computing instances. At least one security credential is obtained from a storage of security credentials associated with the class of the new virtual computing instance. Data communicated with at least one further computing instance is secured based on the obtained at least one security credential.

A method for managing memory within a computing system. The method includes one or more computer processors identifying a range of physical memory addresses that store a first data. The method further includes determining whether a second data is stored within the range of physical memory addresses that stores the first data. The method further includes responding to determining that the second data is stored within the range of physical memory addresses that store the first data, by determining whether a process accessing the second data is identified as associated with a side-channel attack. The method further includes responding to determining that the process accessing the second data is associated with the side-channel attack, by initiating a response associated with the process accessing the second data.

Methods, systems, and devices for enabling public key infrastructure (PKI) in the generic could environment and the network function virtualization (NFV) environment. A host device may receive, from an orchestrator of a computer network environment, an indication of a workload to be executed by a virtual machine (VM) hosted on the host device, where the indication includes an identifier of the workload. The VM may transmit a request for a certificate to a hardware security module associated with the host device including the identifier of the workload. After transmitting the request for the certificate, the VM may receive the requested certificate from the HSM. In some cases, the VM may determine a private key associated with the workload and include the private key within the request for the certificate. Additionally or alternatively, the HSM may determine the private key. Here, the HSM may include the private key within the certificate.