# US 10,503,922 B2 · Systems and methods for hardware-based security for inter-container communication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,922 B2 - Document ID: US10503922B2 - Status: Granted - Kind: B2 - Application number: 15/587,166 - Filed: 2017-05-04 - Published: 2018-11-08 - Granted: 2019-12-10 - Earliest claimed: 2017-05-04 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: Shyam T. Iyer - Web page: https://patentgrep.com/patent/US10503922B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/606: {by securing the transmission between two devices or processes} - G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices - G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In accordance with embodiments of the present disclosure, an information handling system may include a processor subsystem having access to a memory subsystem and a device communicatively coupled to the processor subsystem, the device having an endpoint assigned for access by a container executing on the processor subsystem such that the endpoint appears to the container as a logical hardware adapter. The device may be configured to receive an inter-process communication from the container via the endpoint, the inter-process communication intended for a target container, analyze the inter-process communication to determine if the container has permissions for communicating the inter-process communication to the target container, and communicate the inter-process communication to the target container responsive to determining that the container has permissions for communicating the inter-process communication to the target container. ## Claims ### Claim 1 An information handling system, comprising: a processor subsystem having access to a memory subsystem, wherein the processor subsystem is configured to execute a container as a first process within an operating system kernel and a target container as a second process within the operating system kernel; and a device communicatively coupled to the processor subsystem, the device having an endpoint assigned for exclusive access by the container executing on the processor subsystem, the device further having a second endpoint assigned for exclusive access by the target container, such that the endpoint appears to the container as a logical hardware adapter, wherein the device is configured to: receive an inter-process communication from the container via the endpoint, the inter-process communication intended for the target container; analyze the inter-process communication to determine if the container has permissions for communicating the inter-process communication to the target container; and communicate the inter-process communication to the target container responsive to determining that the container has permissions for communicating the inter-process communication to the target container. ### Claim 2 (depends on 1) The information handling system of claim 1, wherein the device comprises a Peripheral Component Interconnect device. ### Claim 3 (depends on 1) The information handling system of claim 1, the device further configured to: receive a second inter-process communication from a second device communicatively coupled to a second processor subsystem of a second information handling system, the second device having an other endpoint assigned for access by a source container such that the other endpoint appears to the target container as a logical hardware adapter, and wherein the second device received the second inter-process communication from the source container via the other endpoint; analyze the second inter-process communication to determine if the second information handling system has permissions for communicating the second inter-process communication to the container; and communicate the inter-process communication to the container responsive to determining that the second information handling system has permissions for communicating the second inter-process communication to the container. ### Claim 4 A method, comprising: receiving, at a device communicatively coupled to a processor subsystem that is executing a container as a first process within an operating system kernel and a target container as a second process within the operating system kernel, an inter-process communication from the container via an endpoint of the device, wherein the endpoint is assigned for exclusive access by the container executing on the processor subsystem; the device further having a second endpoint assigned for exclusive access by the target container, such that the endpoint appears to the container as a logical hardware adapter, and wherein the inter-process communication is intended for the target container; analyzing the inter-process communication to determine if the container has permissions for communicating the inter-process communication to the target container; and communicating the inter-process communication to the target container responsive to determining that the container has permissions for communicating the inter-process communication to the target container. ### Claim 5 (depends on 4) The method of claim 4, wherein the device comprises a Peripheral Component Interconnect device. ### Claim 6 (depends on 4) The method of claim 4, further comprising: receiving a second inter-process communication from a second device communicatively coupled to a second processor subsystem of a second information handling system, the second device having an other endpoint assigned for access by a source container such that the other endpoint appears to the target container as a logical hardware adapter, and wherein the second device received the second inter-process communication from the source container via the other endpoint; analyzing the second inter-process communication to determine if the second information handling system has permissions for communicating the second inter-process communication to the container; and communicating the inter-process communication to the container responsive to determining that the second information handling system has permissions for communicating the second inter-process communication to the container. ### Claim 7 An article of manufacture comprising: a non-transitory computer-readable medium; and computer-executable instructions carried on the computer-readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to: execute a container as a first process within an operating system kernel and a target container as a second process within the operating system kernel; receive, at a device communicatively coupled to a processor subsystem, an inter-process communication from the container via an endpoint of the device, wherein the endpoint is assigned for exclusive access by the container executing on the processor subsystem, the device further having a second endpoint assigned for exclusive access by the target container, such that the endpoint appears to the container as a logical hardware adapter, and wherein the inter-process communication is intended for the target container; analyze the inter-process communication to determine if the container has permissions for communicating the inter-process communication to the target container; and communicate the inter-process communication to the target container responsive to determining that the container has permissions for communicating the inter-process communication to the target container. ### Claim 8 (depends on 7) The article of claim 7, wherein the device comprises a Peripheral Component Interconnect device. ### Claim 9 (depends on 7) The article of claim 7, the instructions for further causing the processor to: receive a second inter-process communication from a second device communicatively coupled to a second processor subsystem of a second information handling system, the second device having an other endpoint assigned for access by a source container such that the other endpoint appears to the target container as a logical hardware adapter, and wherein the second device received the second inter-process communication from the source container via the other endpoint; analyze the second inter-process communication to determine if the second information handling system has permissions for communicating the second inter-process communication to the container; and communicate the inter-process communication to the container responsive to determining that the second information handling system has permissions for communicating the second inter-process communication to the container.