# US 2018/0025152 A1 · Securing multi-tenancy in a datacenter using nanoservices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0025152 A1 - Document ID: US20180025152A1 - Status: Published application - Kind: A1 - Application number: 15/214,321 - Filed: 2016-07-19 - Published: 2018-01-25 - Earliest claimed: 2016-07-19 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget LM Ericsson (publ) - Inventors: Racha BEN ALI; Wassim HADDAD; Heikki MAHKONEN; Ravi MANGHIRMALANI; Meral SHIRAZIPOUR - Web page: https://patentgrep.com/patent/US20180025152A1 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 9/445: Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 21/6281: {at program execution time, where the protection is within the operating system} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A datacenter is configured to execute a method to improve multi-tenant security by isolating container applications or nano-service applications by implementing a set of system call separation functions (SCSFs) in a set of corresponding nano-services for each container application or nano-service application. The method includes receiving a request to initiate a container application or a nano-service application, determining a set of nano-services and SCSFs to service the container application or the nano-service application, packaging the set of nano-services and SCSFs to service the container application or the nano-service application, and sending the set of nano-services and SCSFs to be instantiated by the datacenter. ## Claims ### Claim 1 A method implemented by a datacenter to improve multi-tenant security by isolating container applications or nano-service applications by implementing a set of system call separation functions (SCSFs) in a set of corresponding nano-services for each container application or nano-service application, the method comprising: receiving a request to initiate a container application or a nano-service application; determining a set of nano-services and SCSFs to service the container application or the nano-service application; packaging the set of nano-services and SCSFs to service the container application or the nano-service application; and sending the set of nano-services and SCSFs to be instantiated by the datacenter. ### Claim 2 (depends on 1) The method of claim 1, wherein the set of SCSFs are configured to intercept system calls from the container application or nano-service application. ### Claim 3 (depends on 1) The method of claim 1, wherein the set of nano-services and SCSFs are packaged with the container application or the nano-services application. ### Claim 4 (depends on 1) The method of claim 1, wherein the datacenter executes at least one SCSF, the method further comprising: receiving a system call from the container application or nano-services at the at least one SCSF; and determining whether the container application or nano-services application is enabled to execute the system call based on a preconfigured policy. ### Claim 5 (depends on 4) The method of claim 4, further comprising: returning an error message to the container application or the nano-service application in response to determining that the container application or the nano-service application is not enabled for the system call. ### Claim 6 (depends on 4) The method of claim 4, further comprising: forwarding the system call to a nano-service for a resource; receiving a response from the nano-service for the resource; and forwarding the response to the container application or the nano-service application. ### Claim 7 A datacenter to execute a method to improve multi-tenant security by isolating container applications or nano-service applications by implementing a set of system call separation functions (SCSFs) in a set of corresponding nano-services for each container application or nano-service application, the datacenter comprising: a non-transitory computer readable medium having stored therein a SCSF manager; and a processor configured to execute the SCSF manager, the SCSF manager to receive a request to initiate a container application or a nano-service application, to determine a set of nano-services and SCSFs to service the container application or the nano-service application, to package the set of nano-services and SCSFs to service the container application or the nano-service application, and to send the set of nano-services and SCSFs to be instantiated by the datacenter. ### Claim 8 (depends on 7) The datacenter of claim 7, wherein the set of SCSFs are configured to intercept system calls from the container application or nano-service application. ### Claim 9 (depends on 7) The datacenter of claim 7, wherein the set of nano-services and SCSFs are packaged with the container application or the nano-services application. ### Claim 10 (depends on 7) The datacenter of claim 7, wherein at least one SCSF is configured to receive a system call from the container application or the nano-services application at the at least one SCSF, and to determine whether the container application or nano-services application is enabled to execute the system call based on a preconfigured policy. ### Claim 11 (depends on 10) The datacenter of claim 10, wherein the at least one SCSF is further configured to return an error message to the container application or the nano-service application in response to determining that the container application or the nano-service application is not enabled for the system call. ### Claim 12 (depends on 10) The datacenter of claim 10, wherein the at least one SCSF is further configured to forward the system call to a nano-service for a resource, receiving a response from the nano-service for the resource, and to forward the response to the container application or the nano-service application. ### Claim 13 A non-transitory computer-readable medium having stored therein a set of instructions which when executed by a computing device cause the computing device to perform a method to improve multi-tenant security by isolating container applications or nano-service applications by implementing a set of system call separation functions (SCSFs) in a set of corresponding nano-services for each container application or nano-service application, the computing device when configured to execute the set of instructions is caused to perform the operations of: receiving a request to initiate a container application or a nano-service application; determine a set of nano-services and SCSFs to service the container application or the nano-service application; packaging the set of nano-services and SCSFs to service the container application or the nano-service application; and sending the set of nano-services and SCSFs to be instantiated by a datacenter. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the set of SCSFs are configured to intercept system calls from the container application or nano-service application. ### Claim 15 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the set of nano-services and SCSFs are packaged with the container application or the nano-services application. ### Claim 16 (depends on 13) The non-transitory computer-readable medium of claim 13, having further instructions stored therein to execute at least one SCSF, causing the computing device to: receiving a system call from the container application or the nano-services application at the at least one SCSF; and determining whether the container application or nano-services application is enabled to execute the system call based on a preconfigured policy. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, having further instructions stored therein to execute at least one SCSF, causing the computing device to: returning an error message to the container application or the nano-service application in response to determining that the container application or the nano-service application is not enabled for the system call. ### Claim 18 (depends on 16) The non-transitory computer-readable medium of claim 16, having further instructions stored therein to execute at least one SCSF, causing the computing device to: forwarding the system call to a nano-service for a resource; receiving a response from the nano-service for the resource; and forwarding the response to the container application or the nano-service application.