# US 2021/0240857 A1 · Securing data integrity for an application > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240857 A1 - Document ID: US20210240857A1 - Status: Published application - Kind: A1 - Application number: 16/779,331 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Fortanix, Inc. - Applicants: Fortanix, Inc. - Inventors: Nehal Bandi; Andrew Leiserson - Web page: https://patentgrep.com/patent/US20210240857A1 ## CPC - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 9/3247: {involving digital signatures} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/3236: {using cryptographic hash functions} - G06F 2221/2149: Restricted operating environment - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A request to provide an application at a secure enclave of a server may be received. A hash value of the application may be generated. Application data that is to be used with the application at the secure enclave of the server may be identified. Another hash value of the application data that is to be used with the application at the secure enclave of the server may be generated. The hash value of the application and the other hash value of the application data may be signed where the signed hash value and other hash are being used to execute the application with the application data at the secure enclave of the server. ## Claims ### Claim 1 A method comprising: receiving a request to provide an application at a secure enclave of a server; generating a hash value of the application; identifying an application data that is to be used with the application at the secure enclave of the server; generating another hash value of the application data that is to be used with the application at the secure enclave of the server; and signing, by a processor, the hash value of the application and the another hash value of the application data, the signed hash value and another hash value being used to execute the application with the application data at the secure enclave of the server. ### Claim 2 (depends on 1) The method of claim 1, wherein the signing of the hash value of the application and the another hash value of the application data is based on a cryptographic key. ### Claim 3 (depends on 1) The method of claim 1, wherein the application data is a file system used by the application. ### Claim 4 (depends on 1) The method of claim 1, wherein the application data corresponds to configuration settings associated with the application. ### Claim 5 (depends on 1) The method of claim 1, wherein generating the hash value of the application comprises: identifying software code of the application; and generating the hash value of the application based on the software code of the application. ### Claim 6 (depends on 1) The method of claim 1, wherein generating the another hash value of the application data that is to be used with the application at the secure enclave of the server comprises: receiving an indication of a portion of the application data that is to be protected with the application; identifying content of the portion of the application data that is to be protected with the application; and generating the another hash value based on the content of the portion of the application data that is to be protected with the application. ### Claim 7 (depends on 1) The method of claim 1, wherein the application data corresponds to a file system, and wherein generating the another hash value of the application data that is to be used with the application at the secure enclave of the server comprises: receiving an indication that a directory of the file system is to be protected; identifying hash values of files included in the directory of the file system that is to be protected; and generating the another hash value based on names and metadata of the files included in the directory of the file system and the hash values of the files included in the directory of the file system. ### Claim 8 A system comprising: a memory; and a processor, operatively coupled with the memory, to: receive a request to provide an application at a secure enclave of a server; generate a hash value of the application; identify an application data that is to be used with the application at the secure enclave of the server; generate another hash value of the application data that is to be used with the application at the secure enclave of the server; and sign the hash value of the application and the another hash value of the application data, the signed hash value and another hash value being used to execute the application with the application data at the secure enclave of the server. ### Claim 9 (depends on 8) The system of claim 8, wherein the signing of the hash value of the application and the another hash value of the application data is based on a cryptographic key. ### Claim 10 (depends on 8) The system of claim 8, wherein the application data is a file system used by the application. ### Claim 11 (depends on 8) The system of claim 8, wherein the application data corresponds to configuration settings associated with the application. ### Claim 12 (depends on 8) The system of claim 8, wherein to generate the hash value of the application, the processor is further to: identify software code of the application; and generate the hash value of the application based on the software code of the application. ### Claim 13 (depends on 8) The system of claim 8, wherein to generate the another hash value of the application data that is to be used with the application at the secure enclave of the server, the processor is further to: receive an indication of a portion of the application data that is to be protected with the application; identify content of the portion of the application data that is to be protected with the application; and generate the another hash value based on the content of the portion of the application data that is to be protected with the application. ### Claim 14 (depends on 8) The system of claim 8, wherein the particular file system key is an internal cryptographic key of a processor that is providing the first secure enclave and is not accessible by the second secure enclave. ### Claim 15 A non-transitory computer readable medium comprising data that, when accessed by a processor, cause the processor to perform operations comprising: receiving a request to provide an application at a secure enclave of a server; generating a hash value of the application; identifying an application data that is to be used with the application at the secure enclave of the server; generating another hash value of the application data that is to be used with the application at the secure enclave of the server; and signing the hash value of the application and the another hash value of the application data, the signed hash value and another hash value being used to execute the application with the application data at the secure enclave of the server. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the signing of the hash value of the application and the another hash value of the application data is based on a cryptographic key. ### Claim 17 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the application data is a file system used by the application. ### Claim 18 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the application data corresponds to configuration settings associated with the application. ### Claim 19 (depends on 18) The non-transitory computer readable medium of claim 18, wherein generating the another hash value of the application data that is to be used with the application at the secure enclave of the server comprises: receiving an indication of a portion of the application data that is to be protected with the application; identifying content of the portion of the application data that is to be protected with the application; and generating the another hash value based on the content of the portion of the application data that is to be protected with the application. ### Claim 20 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the application data corresponds to a file system, and wherein generating the another hash value of the application data that is to be used with the application at the secure enclave of the server comprises: receiving an indication that a directory of the file system is to be protected; identifying hash values of files included in the directory of the file system that is to be protected; and generating the another hash value based on names and metadata of the files included in the directory of the file system and the hash values of the files included in the directory of the file system.