# US 10,872,145 B2 · Secure processor-based control plane function virtualization in cloud systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,872,145 B2 - Document ID: US10872145B2 - Status: Granted - Kind: B2 - Application number: 15/793,432 - Filed: 2017-10-25 - Published: 2019-04-25 - Granted: 2020-12-22 - Earliest claimed: 2017-10-25 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Victor Brown; Jeb R. Linton - Web page: https://patentgrep.com/patent/US10872145B2 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - H04L 41/0897: by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities - H04L 45/64: using an overlay routing layer - H04W 28/12: using signalling between network elements - G06F 2009/45587: {Isolation or security of virtual machine instances} - H04L 41/0894: Policy-based network configuration management - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 41/5096: {wherein the managed service relates to distributed or central networked applications} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A secure processor-based enclave is used to protect to one or more software defined control functions or elements in a cloud environment, such as a hyperconverged cloud that includes compute nodes. One or more secure enclave(s) are instantiated within the environment. A control plane, such as an NFV-based control plane element, is hosted within the secure enclave, which itself is instantiated within may be virtualized or containerized. The control plane has an associated data plane, whose elements are across one or more of the compute nodes. One or more APIs provide connectivity between the control plane, and the various data plane elements that are located external to the secure enclave. The NFV-based control plane provides configuration information (e.g., a routing table) to the distributed data plane through the APIs. By hosting the control plane securely using in-memory workload protection, the approach insures integrity at load time, and it protects against compromise in real-time, e.g., by privileged attackers or other system processes. ## Claims ### Claim 1 A method to protect information in a secure processor-based cloud computing environment, comprising instantiating a secure enclave within the secure processor-based cloud computing environment; isolating a control plane of a software defined function within the secure enclave such that the control plane is protected from one or more processes running at a high privilege level within the cloud computing environment, the control plane having associated therewith a data plane located external to the secure enclave, the control plane including a routing table, and the data plane including one or more elements that forward traffic according to information in the routing table; providing connectivity between the control plane isolated within the secure enclave, and the data plane located external to the secure enclave; and executing the control plane of the software defined function from within the secure enclave to provide the information, thereby controlling the data plane elements to route traffic according to the routing table. ### Claim 2 (depends on 1) The method as described in claim 1 wherein the secure enclave is instantiated within one of: a virtual machine, and a container. ### Claim 3 (depends on 1) The method as described in claim 1 wherein the software defined function is instantiated as a virtual machine or container inside the secure enclave. ### Claim 4 (depends on 1) The method as described in claim 1 wherein the software defined function is a virtual function that is one of: a network function, a storage function, a power function, and a virtual machine and container orchestration function. ### Claim 5 (depends on 4) The method as described in claim 4 wherein the network function is one of: a router, a switch, a firewall, and a load balancer. ### Claim 6 (depends on 1) The method as described in claim 1 further including verifying integrity of the secure enclave at a load time of the control plane of the software defined function. ### Claim 7 (depends on 1) The method as described in claim 1 wherein the connectivity is provided via an externalized application programming interface (API) that is inaccessible by the one or more processes. ### Claim 8 (depends on 7) The method as described in claim 7 wherein control data generated by the control plane of the software defined function includes the routing table that is passed via the API to the data plane to facilitate secure network function virtualization (NFV) in a software defined network (SDN). ### Claim 9 Apparatus to protect information in a secure processor-based cloud computing environment, comprising: one or more hardware processors; computer memory holding computer program instructions executed by the hardware processors and configured to: instantiate a secure enclave within the secure processor-based cloud computing environment; isolate a control plane of a software defined function within the secure enclave such that the control plane is protected from processes running at a high privilege level within the cloud computing environment, the control plane having associated therewith a data plane located external to the secure enclave, the control plane including a routing table, and the data plane including one or more elements that forward traffic according to information in the routing table; provide connectivity between the control plane isolated within the secure enclave, and the data plane that is located external to the secure enclave; and execute the control plane of the software defined function from within the secure enclave to provide the information, thereby controlling the data plane elements to route traffic according to the routing table. ### Claim 10 (depends on 9) The apparatus as described in claim 9 wherein the secure enclave is instantiated within one of: a virtual machine, and a container. ### Claim 11 (depends on 9) The apparatus as described in claim 9 wherein the software defined function is instantiated as a virtual machine or container inside the secure enclave. ### Claim 12 (depends on 9) The apparatus as described in claim 9 wherein the software defined function is a virtual function that is one of: a network function, a storage function, a power function, and a virtual machine and container orchestration function. ### Claim 13 (depends on 12) The apparatus as described in claim 12 wherein the network function is one of: a router, a switch, a firewall, and a load balancer. ### Claim 14 (depends on 9) The apparatus as described in claim 9 wherein the computer program instructions are further configured to verify integrity of the secure enclave at a load time of the control plane of the software defined function. ### Claim 15 (depends on 9) The apparatus as described in claim 9 wherein the computer program instructions configured to provide connectivity are one or more externalized application programming interfaces (APIs) that is inaccessible by the one or more processes. ### Claim 16 (depends on 15) The apparatus as described in claim 15 wherein control data generated by the control plane of the software defined function includes the routing table that is passed via an API to the data plane to facilitate secure network function virtualization (NFV) in a software defined network (SDN). ### Claim 17 A computer program product in a non-transitory computer readable medium for use in a data processing system to protect information in a secure processor-based cloud computing environment, the computer program product holding computer program instructions executed in the data processing system and configured to: instantiate a secure enclave within the secure processor-based cloud computing environment; isolate a control plane of a software defined function within the secure enclave such that the control plane is protected from processes running at a high privilege level within the cloud computing environment, the control plane having associated therewith a data plane located external to the secure enclave, the control plane including a routing table, and the data plane including one or more elements that forward traffic according to information in the routing table; provide connectivity between the control plane isolated within the secure enclave, and the data plane that is located external to the secure enclave; and execute the control plane of the software defined function from within the secure enclave to provide the information, thereby controlling the data plane elements to route traffic according to the routing table. ### Claim 18 (depends on 17) The computer program product as described in claim 17 wherein the secure enclave is instantiated within one of: a virtual machine, and a container. ### Claim 19 (depends on 17) The computer program product as described in claim 17 wherein the software defined function is instantiated as a virtual machine or container inside the secure enclave. ### Claim 20 (depends on 17) The computer program product as described in claim 17 wherein the software defined function is a virtual function that is one of: a network function, a storage function, a power function, and a virtual machine and container orchestration function. ### Claim 21 (depends on 20) The computer program product as described in claim 20 wherein the network function is one of: a router, a switch, a firewall, and a load balancer. ### Claim 22 (depends on 17) The computer program product as described in claim 17 wherein the computer program instructions are further configured to verify integrity of the secure enclave at a load time of the control plane of the software defined function. ### Claim 23 (depends on 17) The computer program product as described in claim 17 wherein the computer program instructions configured to provide connectivity are one or more externalized application programming interfaces (APIs) that is inaccessible by the one or more processes. ### Claim 24 (depends on 23) The computer program product as described in claim 23 wherein control data generated by the control plane of the software defined function includes the routing table that is passed via an API to the data plane to facilitate secure network function virtualization (NFV) in a software defined network (SDN).