Method of secure communication among protected containers and system thereof

A processing and memory circuitry (PMC) configured to execute a first process and one or more peer processes, wherein the PMC is configured to execute:

• each of the first process and the processes in a respective secure enclave in a first secure enclave group of a secure enclave infrastructure, and wherein the first process is configured to:
• a) generate a nonce;
• b) obtain respective encrypted nonces from each of the one, two, or more peer processes;
• c) apply a platform-provided revealing function to each of the obtained encrypted nonces, thereby resulting in retrieved respective nonces,
• wherein the platform-provided revealing function decrypts the respective encrypted nonce in accordance with a PMC-maintained decryption key,
• wherein the PMC is configured to permit utilization of the PMC-maintained decryption key only in service of a process executing within a secure enclave signed by a key of a first signing authority, and
• wherein the first process requests utilization of the PMC-maintained decryption key, and executes in a secure enclave signed by a provider key;
• d) utilize a key generation function to derive a group key from, at least, the generated nonce and the retrieved nonces;
• and
• e) successfully decrypt, using the derived group key, an encrypted data unit written by a process of the one or more peer processes to a shared access memory (SAM), the first process thereby ensuring that each peer is:
• executing on the PMC, executing in a secure enclave that is authorized by secure enclave infrastructure, and executing authentic software.

A computer program product comprising a non-transitory computer readable storage medium containing program instructions, which programs instructions when read by processing and memory circuitry (PMC), causes the PMC to perform a method of securely sharing data, by a first process, with one or more peer processes, wherein each of the first process and the peer processes execute in a respective secure enclave comprised in a first secure enclave group of a secure enclave infrastructure executing on a processing and memory circuitry (PMC), the method comprising:

• a) generating a nonce;
• b) obtaining respective encrypted nonces from each of the one, two, or more peer processes;
• c) applying a platform-provided revealing function to each of the obtained encrypted nonces, thereby resulting in retrieved respective nonces,
• wherein the platform-provided revealing function decrypts the respective encrypted nonce in accordance with a PMC-maintained decryption key,
• wherein the PMC is configured to permit utilization of the PMC-maintained decryption key only in service of a process executing within a secure enclave signed by a key of a first signing authority, and
• wherein the first process requests utilization of the PMC-maintained decryption key, and executes in a secure enclave signed by a provider key;
• d) utilizing a key generation function to derive a group key from, at least, the generated nonce and the retrieved nonces;
• and
• e) successfully decrypting, using the derived group key, an encrypted data unit written by a process of the one or more peer processes to a shared access memory (SAM), the first process ensuring that each peer process is executing on the PMC, executing in a secure enclave that is authorized by secure enclave infrastructure, and executing authentic software.