# US 12,015,689 B2 · Container management for cryptanalysis attack protection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,689 B2 - Document ID: US12015689B2 - Status: Granted - Kind: B2 - Application number: 18/058,358 - Filed: 2022-11-23 - Published: 2023-03-16 - Granted: 2024-06-18 - Earliest claimed: 2021-03-03 - Assignees: Red Hat, Inc. - Applicants: Red Hat, Inc. - Inventors: Gabriel Zvi BenHanokh; Orit Wasserman - Web page: https://patentgrep.com/patent/US12015689B2 ## CPC - H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Containers can be managed for cryptanalysis attack protection. For example, a computing system can receive, from a container, a description specifying a first hardware requirement for the container. The computing system can restrict access to hardware based on the first hardware requirement for the container. The computing system can perform, for a data object requested by the container, an encryption operation and a decryption operation using the hardware. A result of the encryption operation can be inaccessible to the container prior to the decryption operation. ## Claims ### Claim 1 A system comprising: a processor; and a memory including instructions that are executable by the processor for causing the processor to: receive, from a virtual machine, a description specifying a first hardware requirement for the virtual machine; restrict access to hardware based on the first hardware requirement for the virtual machine; and perform, for a data object requested by the virtual machine, an encryption operation and a decryption operation using the hardware, wherein a result of the encryption operation is inaccessible to the virtual machine prior to the decryption operation. ### Claim 2 (depends on 1) The system of claim 1, wherein the memory further includes instructions that are executable by the processor for causing the processor to: determine the virtual machine is safe based on the description specifying the first hardware requirement for the virtual machine; and in response to determining the virtual machine is safe, assign the virtual machine to a first virtual machine group, wherein each virtual machine of the first virtual machine group is safe. ### Claim 3 (depends on 1) The system of claim 1, wherein the virtual machine is a first virtual machine and the description is a first description and the memory further includes instructions that are executable by the processor for causing the processor to: receive, from a second virtual machine, a second description specifying a second hardware requirement for the second virtual machine; and determine the second virtual machine is unsafe based on the second description specifying the second hardware requirement. ### Claim 4 (depends on 3) The system of claim 3, wherein the memory further includes instructions that are executable by the processor for causing the processor to: assign the second virtual machine to a second virtual machine group, wherein each virtual machine of the second virtual machine group is unsafe; and monitor the second virtual machine for a cryptanalysis attack by the second virtual machine. ### Claim 5 (depends on 4) The system of claim 4, wherein the memory includes instructions that are executable by the processor for causing the processor to identify the cryptanalysis attack by determining a number of unsuccessful attempts made by the second virtual machine to access a data object exceeds a predefined number of unsuccessful attempts. ### Claim 6 (depends on 4) The system of claim 4, the memory further includes instructions that are executable by the processor for causing the processor to: determine the second virtual machine satisfies one or more predefined conditions; and in response to determining the second virtual machine satisfies the one or more predefined conditions, assign the second virtual machine to the second virtual machine group. ### Claim 7 (depends on 6) The system of claim 6, wherein the one or more predefined conditions comprise a geographic location associated with the second virtual machine. ### Claim 8 (depends on 3) The system of claim 3, wherein the memory further includes instructions that are executable by the processor for causing the processor to, in response to determining the second virtual machine is unsafe, restrict the second virtual machine from performing execution operations. ### Claim 9 A computer-implemented method comprising: receiving, from a virtual machine, a description specifying a first hardware requirement for the virtual machine; restricting access to hardware based on the first hardware requirement for the virtual machine; and performing, for a data object requested by the virtual machine, an encryption operation and a decryption operation using the hardware, wherein a result of the encryption operation is inaccessible to the virtual machine prior to the decryption operation. ### Claim 10 (depends on 9) The method of claim 9, further comprising: determining the virtual machine is safe based on the description specifying the first hardware requirement for the virtual machine; and in response to determining the virtual machine is safe, assigning the virtual machine to a first virtual machine group, wherein each virtual machine of the first virtual machine group is safe. ### Claim 11 (depends on 9) The method of claim 9, wherein the virtual machine is a first virtual machine and the description is a first description and the method further comprises: receiving, from a second virtual machine, a second description specifying a second hardware requirement for the second virtual machine; and determining the second virtual machine is unsafe based on the second description specifying the second hardware requirement. ### Claim 12 (depends on 11) The method of claim 11, further comprising: assigning the second virtual machine to a second virtual machine group, wherein each virtual machine of the second virtual machine group is unsafe; and monitoring the second virtual machine for a cryptanalysis attack by the second virtual machine. ### Claim 13 (depends on 12) The method of claim 12, further comprising identifying the cryptanalysis attack by determining a number of unsuccessful attempts made by the second virtual machine to access a data object exceeds a predefined number of unsuccessful attempts. ### Claim 14 (depends on 12) The method of claim 12, further comprising: determining the second virtual machine satisfies one or more predefined conditions; and in response to determining the second virtual machine satisfies the one or more predefined conditions, assigning the second virtual machine to the second virtual machine group. ### Claim 15 (depends on 14) The method of claim 14, wherein the one or more predefined conditions comprise a geographic location associated with the second virtual machine. ### Claim 16 (depends on 11) The method of claim 11, wherein the further comprising, in response to determining the second virtual machine is unsafe, restricting the second virtual machine from performing execution operations. ### Claim 17 A non-transitory computer-readable medium comprising program code that is executable by a processor for causing the processor to: receive, from a virtual machine, a description specifying a first hardware requirement for the virtual machine; restrict access to hardware based on the first hardware requirement for the virtual machine; and perform, for a data object requested by the virtual machine, an encryption operation and a decryption operation using the hardware, wherein a result of the encryption operation is inaccessible to the virtual machine prior to the decryption operation. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, further comprising program code that is executable by a processor for causing the processor to: determine the virtual machine is safe based on the description specifying the first hardware requirement for the virtual machine; and in response to determining the virtual machine is safe, assign the virtual machine to a first virtual machine group, wherein each virtual machine of the first virtual machine group is safe. ### Claim 19 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the virtual machine is a first virtual machine and the description is a first description further comprising program code that is executable by a processor for causing the processor to: receive, from a second virtual machine, a second description specifying a second hardware requirement for the second virtual machine; and determine the second virtual machine is unsafe based on the second description specifying the second hardware requirement. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, further comprising program code that is executable by a processor for causing the processor to: assign the second virtual machine to a second virtual machine group, wherein each virtual machine of the second virtual machine group is unsafe; and monitor the second virtual machine for a cryptanalysis attack by the second virtual machine.