System of enclaves
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for instantiating and managing systems that utilize hierarchal enclaves in a cloud environment.
1. A method performed by data processing apparatus, the method comprising:
launching a first root enclave and first component enclaves according to a first manifest;
launching a second root enclave and second component enclaves according to a second manifest providing first data to the first component enclaves; and
providing second data that is different from the first data to the second component enclaves;
accessing a first enclave manifest by the first root enclave, the first enclave manifest specifies, for each of a plurality of the first component enclaves, a particular role for each first component enclave;
accessing a second enclave manifest by the second root enclave, the second enclave manifest specifying, for each of a plurality of second component enclaves, a particular role for each second component enclave.
2. The method of claim 1 , wherein the first root enclave and the first component enclaves are launched in a private cloud, and the second root enclave and the second component enclaves are launched in a public cloud.
3. The method of claim 1 , wherein the first root enclave and the first component enclaves are launched in a first private cloud, and the second root enclave and the second component enclaves are launched in a second private cloud.
4. The method of claim 3 , wherein the first root enclave, the first component enclaves, the second root enclave, and the second component enclaves are launched in a server.
5. The method of claim 1 , comprising instantiating each of the first component enclaves, each first component enclave configured to perform its respective role.
6. The method of claim 1 , wherein the first root enclave and first component enclaves form a first enclave pod.
7. The method of claim 1 , comprising instantiating each of the second component enclaves, each second component enclave configured to perform its respective role.
8. The method of claim 1 , wherein the second root enclave and second component enclaves form a second enclave pod.
9. A method performed by data processing apparatus, the method comprising:
establishing an enclave pod comprising a root enclave, a manifest and two or more component enclaves, each component enclave assigned to perform a particular process, the manifest identifying the two or more component enclaves and the particular process assigned to each component enclave;
providing first data to a first component enclave from among the two or more component enclaves; and
providing second data that is different from the first data to a second component enclave from among the two or more component enclaves, wherein the root enclave verifies the two or more component enclaves using the manifest.
10. The method of claim 9 , wherein the root enclave and the first component enclave are launched in a private cloud, and the second component enclave is launched in a public cloud.
11. The method of claim 9 , wherein the root enclave and the first component enclave are launched in a first private cloud, and the second component enclave is launched in a second private cloud.
12. The method of claim 9 , comprising communicating, by the two or more component enclaves, over an authenticated channel with the root enclave.
13. The method of claim 12 , comprising communicating, by the two or more component enclaves, over an encrypted channel with the root enclave.