System and method for supporting secure objects using a memory access control monitor

A method, comprising:

• using Secure Objects on a computer system to protect code and data that runs in a software container from other software on the computer system including the other software that runs on the same operating system as the container by assigning an ID to each of the Secure Objects,
• wherein the protecting of the code and the data includes protecting memory pages owned by one of the Secure Objects,
• wherein a page is decrypted after it is brought into memory;
• constructing the secure object from a Virtual Machine image,
• wherein the labeling of the memory pages owned by the secure object from among the plurality of secure objects with the ID of the secure object that is different from other identifications of the plurality of secure objects;
• after decryption of a page, measuring the page to ensure the page has not been modified,
• wherein measuring comprises at least one of computation of a checksum of the page or computation of a hash value for the page;
• constructing a Secure Object from the Virtual Machine image;
• and
• executing the Secure Object on a system that supports the execution of Secure Objects.

A method comprising:

• assigning a secure object an ID (identity);
• labeling memory pages owned by a secure object with the ID of the secure object;
• maintaining an Access Control Monitor (ACM) table for the memory pages on the system;
• controlling access to memory pages by monitoring load and store instructions and comparing information in the ACM table with the ID of the software that is executing these instructions;
• using Secure Objects on a computer system to protect Virtual Machines in a system that supports the concurrent execution of multiple Virtual Machines so that the information in a Virtual Machine is protected so that other software on the computer system cannot access or undetectably tamper with said information, thereby protecting both a confidentiality and an integrity of the Virtual Machine while making the information in the Virtual Machine available to the Virtual Machine itself during execution of the Virtual Machine;
• constructing a Secure Object from a Virtual Machine image;
• and
• executing the Secure Object on a system that supports the execution of Secure Objects.