Software Containers with Security Policy Enforcement at a Data Storage Device Level

A system for deploying software containers in a processing environment, comprising:

• a plurality of data storage devices each having a storage device controller circuit and a non-volatile memory (NVM);
• a container manager circuit configured to deploy a software container in a virtual machine environment and to assign, to the deployed software container, a unique session key and a corresponding elapsed time period over which the session key remains valid;
• and
• a processor circuit adapted to issue access commands to the data storage devices to transfer data between a processor memory and an allocated portion of the NVM of each selected data storage device responsive to execution, by the processor circuit, of an application of the software container, each access command comprising a token derived using the session key, the storage device controller circuit of the selected data storage device authorizing servicing of each of the access commands received from the processor circuit having the token prior to expiration of the elapsed time period.

A method comprising;

• assigning a unique session key to a software container and an associated elapsed time interval;
• deploying the software container in a host device to commence execution of an application stored in a memory by a processor circuit of the host device at a beginning of the elapsed time interval;
• issuing a host access command to a data storage device to request a transfer of data between the memory of the processor circuit and an allocated portion of a non-volatile memory (NVM) of the data storage device, the host access command comprising a token derived from the session key;
• evaluating the token of the host access command using a controller circuit of the data storage device;
• and
• using the controller circuit of the data storage device to authorize the transfer of data associated with the host access command responsive to validation that the token was derived from the session key during the evaluating step.