Container builder for personalized network services

Abstract

Some embodiments relate to a container builder (110) for building a container image, wherein the container image is used to provide personalized network services based on sensitive data (122) in a database (121). The container builder (110) retrieves the sensitive data (122) from the database (121), builds the container image (140), and provides the container image for deployment to a cloud service provider (111). The container image (140) includes the sensitive data (122) and instructions, and when the container image is deployed as a container, the instructions cause the container to provide the personalized network service based on the sensitive data (122) included in the container image (140).

Description

Technical Field

[0001] The present invention relates to a container builder, a cloud service provider, a container builder method, a cloud service provider method and a computer-readable medium. Background Art

[0002] US 2011 / 314466 A1 discloses an example of creating a cloud computing environment.

[0003] EP 3267351 A1 discloses securely managing Docker images.

[0004] In various settings, it is beneficial to provide network services such as web applications based on sensitive information over a public network such as the Internet. For example, various services can be provided based on medical information about a patient, such as allowing the patient to review an electronic medical record or fill out an online assessment (e.g., a questionnaire). Services can also be provided based on other kinds of sensitive information, for example, commercially sensitive information about a company can be used for benchmarking, accounting, etc.

[0005] Providing services over a public network may present various security risks. In particular, attackers may attempt to compromise the confidentiality and / or integrity of sensitive information in various ways. For example, an attacker may attempt to break into a database server that stores sensitive information, which is related, for example, to the patient or company to which the service is provided. Alternatively, an attacker may attempt to break into a server that provides a network service, for example, a web application. In doing so, the attacker may use various known techniques, such as using vulnerabilities in various software used by the server and / or using bypasses. For example, the latest Spectre and Meltdown vulnerabilities of modern processors may allow an attacker who does not have specific permissions to access the server to illegally obtain data from processes running simultaneously on the server. The attacker may be an external attacker, but may also be an insider and / or a legitimate user of the network service, for example, a user who attempts to obtain or edit another user's information.

[0006] Therefore, various security risks associated with providing network services based on sensitive data may need to be addressed.

[0007] One known technique for addressing at least some of these risks is containerization. For example, in US 2017 / 0098092 A2, techniques for generating virtual private containers are disclosed. A virtual private container defines a self-contained software environment that includes one or more analysis components that are configured to perform specified analysis functions on data within the container. The analysis components are isolated to run within the container so as to prevent data sharing between containers. The virtual private container can access user data from external systems such as an HDFS store, and users of the service can provide authorization information (e.g., identity) for the user data. Summary of the invention

[0008] The disadvantage of existing systems (e.g., US2017 / 0098092A2) for providing network service systems based on sensitive data is that they are not sufficient to deal with various security risks related to providing network services based on sensitive data. For example, sensitive data can be stored in an external storage device such as a database. In existing systems, various devices may need to access the external storage device. For example, virtual private containers deployed on various hosts may each need to access the external storage device. Therefore, the external storage device may need to be publicly or at least widely accessible, thereby becoming an attractive target for attack. In addition, the existing system of US 2017 / 0098092 A2 does not allow updated data to be written back to the storage device. More generally, in existing systems, sensitive information about multiple users or potential users of the system can be stored in a central location that may not be secure enough.

[0009] In order to better address one or more of these concerns, a container builder and / or cloud service provider as defined in the independent claims is proposed. The container builder builds a container image for providing personalized network services (e.g., web applications) based on sensitive data in a database. The inventors recognize that if sensitive data is included in the container image, the exposure of the sensitive data may be limited. The database can be a private database of the container builder. The container builder retrieves the sensitive data from the database, builds a container image, and provides the container image for deployment to the cloud service provider. The container image contains sensitive data and instructions, and when the container image is deployed as a container, the instructions cause the container to provide personalized network services based on the sensitive data. The cloud service provider receives such a container image for deployment and deploys it as a container.

[0010] This arrangement improves security, for example, because exposure of the database is lower; for example, the cloud service provider and / or the container host in which the container is deployed does not need to directly access the database and therefore does not need to make the database available to them, such as being able to be deployed at or near the container builder. In addition, the exposure of the container builder is limited, for example, the container builder does need to accept incoming connections, may be behind a firewall, and / or may only connect to the network to provide container images. Although the container host has higher exposure, for example, the container host can accept incoming network connections to provide network services, the container host only stores a limited amount of data, so the impact of a breach is smaller. Moreover, because the container host does not need to access external sources to obtain sensitive data, the container host may require fewer network connections.

[0011] In one embodiment, the sensitive data includes personal information about users to whom personalized network services are provided. In one embodiment, the personal information includes electronic medical records. In such an embodiment, in view of the high sensitivity of the data, it is particularly beneficial to protect the sensitive information.

[0012] In one embodiment, the container image is terminated after a time limit and / or after use of the personalized network service is complete, thereby further reducing exposure.

[0013] In one embodiment, the container builder obtains updated data updated by the personalized network service and stores the updated data in the database. In this way, the network service can not only use sensitive data from the database, but also generate data for the database without exposing the database to the outside. To improve protection, the container can encrypt the updated data. The container builder can also provide authentication information (e.g., private address and / or token) to the intended user of the personalized network service, thereby reducing the risk of unauthorized access to the network service.

[0014] Further aspects of the present invention relate to container builder methods and cloud service provider methods. Embodiments of these methods may be implemented on a computer as a computer-implemented method, or implemented in dedicated hardware, or implemented in a combination of the two. Executable code for embodiments of the methods may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, and the like. Preferably, the computer program product includes non-transient program code stored on a computer-readable medium, and when the program product is executed on a computer, the non-transient program code executes an embodiment of the method.

[0015] In one embodiment, the computer program comprises computer program code, which is suitable for performing all steps of an embodiment of the container builder method or the cloud service provider method when the computer program is run on a computer. Preferably, the computer program is implemented on a computer readable medium.

[0016] Another aspect of the present invention relates to a computer-readable medium including data representing a container image for providing a personalized network service. The container image includes sensitive data and instructions for providing a personalized network service based on the sensitive data, thereby allowing limited data exposure to be provided to the service.

[0017] Another aspect of the invention provides a method of making a computer program available for download. This aspect will be used when the computer program is uploaded to, for example, Apple's Apple Store, Google's Play Store or Microsoft's Windows Store and when the computer program can be downloaded from such a store. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Further details, aspects and embodiments of the invention will be described by way of example only, with reference to the accompanying drawings. For simplicity and clarity, the elements in the drawings are illustrated and are not necessarily drawn to scale. In the drawings, elements corresponding to elements already described may have the same reference numerals. In the drawings,

[0019] Figure 1 schematically illustrates an example of an embodiment of a network service system,

[0020] Figure 2 schematically illustrates an example of an embodiment of a network service system,

[0021] Figure 3 schematically illustrates an example of an embodiment of a network service system,

[0022] Figure 4a schematically illustrates an example of an embodiment of a cloud server,

[0023] Figure 4b schematically illustrates an example of an embodiment of a personalized network service,

[0024] Figure 4c schematically illustrates an example of an embodiment of a container builder,

[0025] Figure 5 schematically illustrates an example of an embodiment of a network service system,

[0026] Figure 6 shows a hardware diagram for implementing a device according to an embodiment,

[0027] Figure 7a schematically illustrates an example of an embodiment of a container builder method,

[0028] Figure 7b schematically illustrates an example of an embodiment of a cloud service provider method,

[0029] Figure 7c schematically illustrates a computer-readable medium having a writable portion including a container image according to an embodiment,

[0030] Figure 7d A computer-readable medium having a writable portion comprising a computer program according to an embodiment is schematically shown.

[0031] List of reference numerals:

[0032] 100 Network Service System

[0033] 110 Container Builder

[0034] 111 Cloud Service Providers

[0035] 112 Container Host

[0036] 113 User Equipment

[0037] 120 Data interface

[0038] 121 Database

[0039] 122 Sensitive Data

[0040] 131 Data Processing Unit

[0041] 132 Image Processing Unit

[0042] 133 Cloud Processing Unit

[0043] 135 Builder Processing Unit

[0044] 136 Deployment Unit

[0045] 140 Container Image

[0046] 141 Instructions for providing personalized network services

[0047] 143 Termination Instructions

[0048] 150, 151 Communication interface

[0049] 160 Container Platform

[0050] 170, 171, 172 Container

[0051] 190 Computer Networks

[0052] 191 Firewall

[0053] 200 Network Service System

[0054] 210 Container Builder

[0055] 211 Cloud Service Providers

[0056] 212 Container Host

[0057] 213 User Devices

[0058] 220 Data interface

[0059] 221 Database

[0060] 223 Updated data

[0061] 231 Data Processing Unit

[0062] 232 Image Processing Unit

[0063] 233 Cloud Processing Unit

[0064] 235 Builder Processing Unit

[0065] 236 Deployment Unit

[0066] 240 Container Images

[0067] 244 Encryption Key

[0068] 245 Decryption Key

[0069] 246 Encryption Instructions

[0070] 250, 251 Communication interface

[0071] 260 Container Platform

[0072] 270 Containers

[0073] 280 Storage Devices

[0074] 290 Computer Networks

[0075] 300 Network Service System

[0076] 310 Container Builder

[0077] 311 Cloud Service Provider

[0078] 312 Container Host

[0079] 313 User Devices

[0080] 332 Image Processing Unit

[0081] 336 Deployment Unit

[0082] 340 container images

[0083] 347 Token

[0084] 348 Private Address

[0085] 349 Instructions for verifying token ownership

[0086] 350, 351 communication interface

[0087] 370 Containers

[0088] 390 Computer Networks

[0089] 400 Cloud Servers

[0090] 401 Authentication Database

[0091] 402 Record Database

[0092] 403 Application Database

[0093] 410 Management Console

[0094] 411 Application Software

[0095] 420 SSH interface

[0096] 421 HTTP interface

[0097] 422 Web API

[0098] 430 Personalized Network Services

[0099] 431 Authentication Database

[0100] 432 Record Database

[0101] 433 Application Database

[0102] 441 User-specific credentials

[0103] 442 Data specific to a particular user

[0104] 443 Data required for specific services

[0105] 450 Application Software

[0106] 451 Parts required for specific services

[0107] 460 Interfaces for specific services

[0108] 470 Container Builder

[0109] 471 Authentication Database

[0110] 472 Database

[0111] 473 Application Database

[0112] 474 Software Components

[0113] 480, 488, 489 container images

[0114] 481 Sensitive Data

[0115] 482 Software Component Subset

[0116] 500 Network Service System

[0117] 510 Container Builder

[0118] 512 container host

[0119] 513 User devices

[0120] 514 Cloud Server

[0121] 521 Database

[0122] 522 Sensitive Data

[0123] 534 Application Software

[0124] 560 Container Platform

[0125] 570 Containers

[0126] 580 Network Services

[0127] 581, 582 Redirection

[0128] 1100 Hardware diagram for implementing the device

[0129] 1110 System Bus

[0130] 1120 processor

[0131] 1130 Memory

[0132] 1140 User Interface

[0133] 1150 Communication Interface

[0134] 1160 Storage Devices

[0135] 1161 Basic Operating System

[0136] 1162-1164 Instructions for data processing unit / image processing unit / …

[0137] 1200 Container Builder Methods

[0138] 1210 Provide access to the database

[0139] 1220 Provide digital communications

[0140] 1230 Retrieve sensitive data

[0141] 1240 Build container image

[0142] 1250 Provide container images

[0143] 1300 Cloud Service Provider Method

[0144] 1310 Provide digital communications

[0145] 1320 Receive container image

[0146] 1330 Deploy container images

[0147] 1900 Computer readable medium

[0148] 1910 Writable part

[0149] 1920 container images

[0150] 1921 Sensitive Data

[0151] 1922 Instructions for providing personalized network services

[0152] 2000 Computer Readable Media

[0153] 2010 Writable Part

[0154] 2020 Computer Programs DETAILED DESCRIPTION

[0155] While the present invention is susceptible of embodiments in many different forms, one or more specific embodiments are shown in the drawings and will be described in detail herein, it being understood that this disclosure is considered as an example of the principles of the invention and is not intended to limit the invention to the specific embodiments shown and described.

[0156] In the following, for ease of understanding, the elements of the embodiments are described in operation. However, it is obvious that the various elements are arranged to perform the functions described by them.

[0157] Further, the invention is not limited to these embodiments, and the invention lies in each and every novel feature or combination of features described herein or recited in mutually different dependent claims.

[0158] In discussion Figure 1-Figure 3 Before going into the detailed embodiments, first refer to Figure 4a-4c to discuss various aspects of the invention.

[0159] As a motivating example to explain various aspects of the embodiments set forth below, consider a web-based portal for patient assessment. For example, a patient may use such a portal to provide information about his or her health status after receiving a certain treatment. Such systems are typically based on medical data, for example, the questions asked to the patient may depend on the specific treatment received, and / or the user may be able to review at least part of his or her electronic medical record. In addition, the system may also generate new data (e.g., information about the health status provided by the patient), which needs to be stored and further processed, such as provided to healthcare professionals involved in the treatment. The medical information used by the portal and the information generated by the portal are typically sensitive personal information about the patient. In addition, the software used (e.g., a clinical decision support algorithm that determines which questions to ask or which recommendations to give) may also be a sensitive asset. Therefore, security measures are needed to ensure that the data and / or software does not fall into the wrong hands.

[0160] Figure 4aAn embodiment of a system based on sensitive data on a cloud server 400 is shown, which cloud server 400 is, for example, a web-based portal for patient assessment discussed above, which does not utilize a private database or container image. A web application can run on such a cloud server 400 (e.g., a remote cloud server) and provide network services to clients, for example, using a request-response model. The cloud server 400 may include, for example, an application software 411 that provides network services and one or more databases. For example, the database may include: an authentication database 401 (which includes, for example, encryption keys, passwords, tokens, etc.); a record database 402 (which includes, for example, electronic medical records or other sensitive information) and / or an application database 403 (which includes, for example, application data). A user can use a web browser to access a web application provided by the application software 411 (e.g., via an HTTP interface 421). The application software 411 may also provide one or more web services (e.g., REST services) via a Web API 422. Before accessing the application, the user may need to identify himself to the application software 411, for example, where the application software 411 authenticates the credentials given by the user based on the information in the authentication database 401. Application software 411 may retrieve and / or store sensitive information in records database 402, for example, a user may be able to retrieve and / or update records in records database 402 as part of an application.

[0161] In e.g. Figure 4a In a system such as a cloud server 400, data of multiple users may be stored on the cloud server 400, for example, in databases 401 and / or 402. Encryption and / or other security measures may be used to improve data security, privacy and / or prevent data leakage, exploitation of vulnerabilities or other attempts to access user data. The cloud server 400 may be a security risk, and if a hacker is able to compromise the cloud server 400, the data of all users (possibly tens of thousands of users) may be stolen for use in other attacks and / or made public.

[0162] In order to minimize the risk of data leakage, access to application software 411 can be highly controlled, thereby potentially causing a degradation in user experience. Nevertheless, various security-related issues may still exist in systems arranged similarly to cloud server 400. For example, in addition to the invalidity of a single user account (e.g., due to a stolen password), programming errors or vulnerabilities in application software 411 may also allow an attacker to access a large number of accounts and / or a large amount of data from record database 402. The inventor believes that: user data (e.g., user data about multiple users included in record database 402) and application software 411 reside in the same location or at least the application software 411 may have access to user data about multiple users is the cause of the problem. In addition, cloud server 400 may also include, for example, a management console 410 accessible via SSH interface 420, and the presence of such additional access channels may constitute further security issues. The various embodiments described below can reduce the risk of data leakage and / or avoid the need for additional management channels.

[0163] Various embodiments are directed to providing personalized network services based on sensitive data. The inventors recognize that not all parts of system 400 may be needed to provide a specific service to a specific user, for example, system 400 may be personalized for a specific user and / or for a specific service. Figure 4b An example of an embodiment of a personalized network service 430 is shown. Personalization can refer to providing a specific service to one or more specific users (e.g., a specific person, system, or device) based on sensitive data specific to the one or more specific users (e.g., a subset of data from a database). For example, the data can include data specific to a specific service and / or a specific user or set of users. For example, the data can be data about one or more users and / or data that one or more users have special permissions to access. For example, a personalized network service can use sensitive data as input and / or provide updated data as output.

[0164] As an example, a personalized web service can be a web application that implements personalization to allow a specific patient or set of patients to fill out a dedicated questionnaire (e.g., the web-based patient assessment portal discussed above). As another example, a personalized web service can be a web service that implements personalization for a specific user (e.g., a REST web service). A personalized web service does not need to be based on HTTP, and in fact, a personalized web service can be any type of web service that implements personalization based on sensitive data (e.g., sensitive data provided using a known protocol (e.g., FTP, IMAP, POP, or a non-IP-based protocol (e.g., a NetBIOS-based protocol)).

[0165] According to various embodiments, providing a personalized web service to a user based on sensitive data specific to the user may have the advantage that data specific to other users may be effectively shielded from being affected by the personalized web service, thereby reducing the risk of the user's data being inadvertently accessed by other users or third parties for a specific user. In one embodiment, the sensitive data may include personal information about the user. A personalized web service may be provided to the user. In one embodiment, the personal information includes an electronic medical record. Personalization is particularly important in this case due to the special sensitivity of the data and / or special legal requirements, particularly in the processing of personal information and medical data.

[0166] As mentioned, personalized network service 430 may not require all data and / or components of cloud server 400 to operate. For example, authentication database 431 may only need to contain authentication information 441 of one or more specific users. Record database 432 may only need to contain data 442 specific to one or more users. Similarly, application database 433 may only need to contain data 443 required for a specific service, for example, images, UI elements, or other types of data used for a specific service but not for other services that may be provided to the same user or other users at another point in time. Application software may also only need to contain components 451 required for a specific service, such as software modules, libraries, etc. For a specific service, it may only be necessary to provide an interface 460 to the outside, for example, in this case, no Web API or SSH interface is required. Compared with cloud service 400, personalized network service 430 can be regarded as a simplified version, but in fact, a personalized network service can be built by removing components of a complete cloud server deployment or by building a personalized network service from scratch using only selected components, or by combining the two. The advantage of making such a personalized web service available is that, in the worst case, a potential data leak would reveal credentials and / or data specific to one or more users for whom the web service is personalized, as compared to the cloud server 400. In addition, fewer interfaces and / or less software reduces the risk of exploiting vulnerabilities and / or damaging valuable software assets.

[0167] In various embodiments, personalization of network services is provided by means of containerization technology. When containerization is used, applications are usually packaged into container images. For example, a container image may include a self-contained package for running an application on a container host (e.g., including one or more components, such as an application component and / or a runtime component for running an application). For example, a container image can be used to run an application on a container platform. In some embodiments, the runtime component does not include an operating system, thereby reducing the image size and improving performance. In other embodiments, the runtime component may include an operating system, making the image more self-contained. Components in a container image may include, for example, a web server, a database server, a data analysis toolbox, a simulator, and the like. In general, using container images may have the following advantages: they are lightweight but self-contained, for example, they contain one or more of application code, runtime, system tools, libraries, and / or settings for running applications. For example, this can eliminate the need to separately install and / or maintain libraries for applications running on container hosts.

[0168] Nowadays, various containerization technologies can be used based on various types of container images. For example, Docker technology allows to build a Docker container image based on a configuration file called "Dockerfile" and then deploy the Docker container image as a container on a system running Docker Engine or on various cloud providers available on the market (e.g., Heroku, Amazon Elastic Container Service, etc.). Other types of container images can be JAR files; WAR files; Heroku slug files; disk images (e.g., disk images for running on a hypervisor); compressed files (e.g., ZIP or TAR files) (e.g., compressed files running in a chroot environment), etc. Depending on the containerization technology used and the software available on the target platform, various software libraries can be included in the container image or used in a platform-provided manner. For example, a container image for a Ruby on Rails application can include the application itself, but can also include a Ruby on Rails platform, a web server, system libraries, and / or an operating system, for example, depending on which of these components is available on the deployment platform. Various cloud service providers are available that implement containerization technology by accepting container images for deployment and deploying them as containers on their infrastructure. For example, Heroku and Amazon Elastic Container Service are examples of cloud service providers that accept Docker container images as well as other types of container images.

[0169] In particular, various embodiments relate to a container builder. A container builder (also referred to as a container factory or container builder device) may be a device for building a container image, such as a container image that can be deployed using one of the containerization technologies discussed above. Figure 4c An example of an embodiment of such a container builder is schematically shown in . Figure 4c The container builder 470 in the embodiment of the present invention builds a container image for providing personalized network services based on sensitive data in the database. The container builder 470 can, for example, access a private database 472 (e.g., a record database as described above) including sensitive data through a data interface. The container builder 470 may also have access to various other data sources and / or software sources (e.g., an authentication database 471, an application database 473, and / or a subset 474 of software components for providing personalized network services). At a higher level, the container builder 470 builds a container image and, for example, uses a communication interface to provide a container image for deployment to a cloud service provider. The container image (e.g., container image 480, 488, or 489) can be based on one or more of databases 471, 472, and 473 and software components 474. For example, the container image 480 may include sensitive data 481 and instructions, based on the sensitive data 481, provide (e.g., obtain) personalized network services from a private database 472 and / or other databases, and when the container image 480 is deployed as a container, the instructions cause the container to provide personalized network services based on sensitive data. For example, the instructions may include a subset of software components 482 for providing personalized network services from the set of software components 474, and similarly for other container images. The personal information may be stored, for example, in a database within the container image. Various embodiments of the container builder are described below.

[0170] Interestingly, container builder 470 may have access to a relatively large amount of information (e.g., database 472 including information related to multiple users), but container builder 470 may have only limited network exposure, for example, container builder 470 does not need to provide services directly to users. On the other hand, containers deployed according to container images (e.g., container images 480, 488, and 489) built by container builder 470 may need to be more exposed than container builder 470 because they need to provide personalized network services to users. However, they only store and / or have access to a subset of the information that container builder 470 has access to (usually only a small portion). This arrangement provides an overall improvement in data protection due to reduced exposure of sensitive data.

[0171] Figure 1An example of an embodiment of a network service system 100 for providing personalized network services is schematically shown. The network service system 100 may include a container builder 110 (e.g., a container builder device). The network service system 100 may include a cloud service provider 111 (e.g., a cloud service provider device) for deploying container images as containers. The container may be deployed on the cloud service provider 111 itself and / or on a separate container host (e.g., a container host device) managed by the cloud service provider. One such container host 112 is shown in the accompanying drawings, but in one embodiment, the network service system 100 includes multiple container hosts managed by the cloud service provider 111, and in another embodiment, the network service system 100 does not include a container host other than the cloud service provider 111 itself.

[0172] As discussed further below, Figure 1 Functional units (e.g., units 131, 132, 133, 135, and / or 136) are shown, which may be functional units of a processor of a corresponding device (e.g., a processor of container builder 110 or cloud service provider 111). For example, Figure 1 The container builder 110 can be used as a blueprint for possible functional organization of the processor. The processor is not shown separately from the units in the figures. For example, the functional units of the container builder 110 can be implemented in whole or in part in computer instructions stored in the container builder 110 (e.g., implemented in an electronic memory of the container builder 110) and can be executed by a microprocessor of the container builder 110. In a hybrid embodiment, the functional units are partially implemented in hardware (e.g., implemented as a coprocessor (e.g., an encryption coprocessor)) and partially implemented in software stored and executed on the container builder 110, and similar situations are also true for other devices in the various figures.

[0173] The various devices of the network service system 100 can collaborate to provide personalized network services to the user device 113 based on the sensitive data 122 in the database 121. In one embodiment, the sensitive data includes personal information about the user; for example, the network service system 100 can be used to provide personalized network services to the user, for example, through the user device 113. In one embodiment, the personal information includes electronic medical records. In one embodiment, the sensitive data does not include authentication or authorization information, for example, the sensitive data does not include database credentials. The user device 113 can be any device with network connectivity (for example, a laptop, a desktop computer, or a mobile device such as a mobile phone or tablet (for example, when the personalized service is a web application) or a server (for example, when the personalized service is a web service)).

[0174] In one embodiment, personalized network services are provided to multiple users, e.g., a strict subset of potential users of the service, which corresponds, for example, to a strict subset of entries of database 121. For example, the number of users may be configurable. This may allow for a dynamic security / efficiency tradeoff between the extreme case of implementing personalized network services for individual users with higher security and lower efficiency and the extreme case of providing network services to all users simultaneously with lower security and higher efficiency.

[0175] The various devices of the system 100 communicate with each other via a computer network 190. The computer network may be the Internet, an intranet, a LAN, a WLAN, etc. The computer network 190 may be the Internet. The computer network may be all or partly wired and / or all or partly wireless. For example, the computer network may include an Ethernet connection. For example, the computer network may include a wireless connection, such as Wi-Fi, ZigBee, etc. These devices include a connection interface that is arranged to communicate with other devices of the system 180 as needed. For example, the connection interface may include a connector, such as a wired connector (e.g., an Ethernet connector) or a wireless connector (e.g., an antenna, such as a Wi-Fi, 4G or 5G antenna). For example, the container builder 110 and the cloud service provider 111 may include communication interfaces 150 and 151, respectively. The computer network 190 may include additional elements (e.g., routers, hubs, etc.).

[0176] The network service system 100 can use containerization technology to limit the exposure of sensitive data. The container builder 110 can build a container image 140 and provide the container image 140 for deployment to the cloud service provider 111. The cloud service provider 111 can deploy the container image 140 on, for example, a container host 112. Interestingly, the container image 140 can include sensitive data 122 and instructions, and when the container image 140 is deployed as a container, the instructions enable the container to provide personalized network services based on the sensitive data 122. This can enable the cloud service provider 111 to provide cloud services on a host that does not have access to the database of sensitive information 121, thereby limiting the exposure of the database 121.

[0177] Various techniques for operating a cloud service provider and / or the container host itself are known from the literature. Typically, the container host 112 is configured to run a container platform 160 and one or more containers (e.g., containers 170, 171, and 172) on the container platform. In one embodiment, the container platform 160 runs on an operating system, and the containers 170, 171, and 172 do not include the operating system itself. For example, the container platform 160 may include a Docker Engine, and the containers 170, 171, and 172 may be Docker containers. In one embodiment, the container platform 160 includes a hypervisor, and one or more containers 170, 171, and 172 may be virtual machines (e.g., virtual machines deployed from container images including disk images). In this case, the containers 170, 171, and 172 may include an operating system. In one embodiment, the container platform 160 may include a Unix-like operating system, and one or more containers 170, 171, and 172 may include software operating in a chroot jail. For example, a container image for such a chroot jail may include a collection of files that the software in the chroot jail has access to. In one embodiment, 170 , 171 , 172 are dynamometers of the Heroku platform 160 .

[0178] As discussed above, cloud service provider 111 may deploy container images on cloud service provider 111 itself, rather than on a separate container host. In such a case, for example, as described above, cloud service provider 111 itself acts as a container host, for example, cloud service provider 111 itself may run a container platform and run one or more containers on the container platform. In such an embodiment, service provider 111 is configured to deploy container image 140 as a container on the container platform.

[0179] The cloud service provider 111 may also be a management node that manages one or more container hosts. For example, the cloud service provider 111 may be configured as the master node of a Kubernetes cluster, and the container host 112 and / or other container hosts are configured as computing nodes of a Kubernetes cluster. Alternatively, the cloud service provider 111 may be configured as a group manager of a Docker group, and the container host 112 and / or other container hosts are configured as nodes of a Docker group. The cloud service provider 111 may also be, for example, an OpenStack controller node, and the container host 112 and / or other container hosts are configured as computing nodes of an OpenStack cluster. Using multiple container hosts can improve scalability, but it may also be difficult to predict on which host a container image is deployed as a container and / or which other containers are running on the same container host, thereby complicating attacks across containers running in the same infrastructure. In some embodiments, the cloud service provider 111 may be a conventional cloud service provider 111, for example, Heroku, Amazon Elastic Container Service, Amazon EC2, etc.

[0180] In particular, the cloud service provider 111 may include a communication interface 151 configured to digitally communicate with the container builder 110 and / or the container host 112 and / or other devices of the network service system 100, for example using a computer network 190. The cloud service provider 111 may also include a builder processing unit 135 configured to receive the container image 140, for example from the container builder 110, using the communication interface 151. The cloud service provider 111 may also include a deployment unit 136 configured to deploy the container image as a container. For example, the cloud service provider may deploy the container image 140 on a container host (e.g., the container host 112), or on a container platform running on the cloud service provider 111 itself. This may be transparent to the container builder 110, for example, the container builder 110 may not know on which specific host its container image is deployed before and / or after deployment.

[0181] The deployment of the container image 140 may be initiated by the container builder 110. For example, the container builder 110 may receive instructions to build a container image for providing personalized network services based on sensitive data. For example, the instruction may include one or more of an identification of a network service from a predefined set of multiple network services and an identification of one or more expected users of the network service, wherein the user may be, for example, a person or other network entity, for example, a user associated with the database 121 storing sensitive data. For example, instructions may be received from an external network entity, for example, the container builder 110 may periodically contact the external network entity to receive instructions; instructions may be received from a user of the container builder 110, for example, via a user interface of the container builder 110; or instructions may be received from another component of the container builder 110 (e.g., a component that periodically monitors the status of the database and / or any deployed container images to determine that one or more personalized network services should be provided).

[0182] In some embodiments, the schedule for providing personalized network services may be relatively predictable. For example, in a Web-based patient assessment portal, patients may be asked to fill out questionnaires regularly (e.g., weekly or monthly). In addition, personalized network services may not always be provided to the same set of users, for example, requiring patients to fill out monthly questionnaires within three days, so that on average only about one-tenth of the patients have questionnaires waiting for them to process. Therefore, in some embodiments, personalized network services are only provided to a subset of the potential user set (e.g., a subset of users with sensitive data stored in database 121) at the same time. In such a case, providing personalized network services may be particularly beneficial because the sensitive data of users who have not received the service is not exposed.

[0183] In order to access a database 121 including sensitive data 122 on which the container image 140 is based, the container builder 110 may include a data interface 120. The database 121 may store sensitive data related to multiple users, for example, multiple sensitive records, each record representing sensitive data involving one or more users. For example, a record may include a piece of medical information about a specific person (e.g., a patient). The database 121 may be a locally stored database. The database 121 may also be an external database, wherein the data interface 120 is connected to the external database. For example, when sensitive information from a database is needed, the sensitive information may be queried from the data interface 120, and then the data interface 120 may retrieve the sensitive information, for example, from an external database. The external database may be transparent to the rest of the device 110. The database 121 may be configured as a private database (e.g., a local database) of the container builder. For example, the database 121 may be accessible through or only through a local area network (LAN), or the database 121 may be a local database running on the container builder 110. In particular, database 121 may not be accessible via computer network 190, or may be inaccessible to at least one or more of container host 112, cloud service provider 111, and user device 113. This may advantageously reduce exposure of database 121.

[0184] The container builder 110 may further include a data processing unit 131 configured to retrieve sensitive data 122 from the database 121 using the data interface 120. For example, upon receiving a request to provide a specific personalized network service based on sensitive data related to a specific user, the data processing unit 131 may select a subset of data (e.g., records) related to the user and retrieve the data subset from the database 121.

[0185] The container builder 110 may also include an image processing unit 132, which is configured to build a container image 140 for providing personalized network services. As discussed above, various types of container images 140 (e.g., container images for providing specific network services) and tools for building container images are known and can be applied here. For example, the container image 140 can be a Docker container image, and the image processing unit 132 is configured to use Docker (e.g., using a "docker build" command or a similar command) to build the container image 140 based on a Dockerfile. For example, as described above with reference to Figure 4cAs discussed, building the container image 140 may include selecting the software components (e.g., modules and / or libraries) required to provide a particular personalized network service. Selecting only the required software components may have the advantage that the likelihood that a container is based on the software components is reduced and / or the value of software assets that may be extracted from the container is reduced, for example, only a limited set of clinical decision support or MRI reconstruction components relevant to the current case may need to be included, and components that are not included will not be exposed.

[0186] The image processing unit 132 can be configured to build a container image 140 based on a configuration (e.g., a configuration file), and optionally also configured to generate the configuration. For example, in a Docker-based embodiment, the configuration may include a Dockerfile. The image processing unit 132 may generate the configuration, for example, by instantiating a template configuration, for example, by selecting a portion of such a template and / or by filling in fields to generate the configuration. For example, this may be based on a specific network service to be provided and / or one or more specific users to whom the network service is to be provided. The image processing unit 132 may also reuse the same configuration, for example, building a personalized container image 140 may include arranging various files referenced in the configuration based on a specific network service to be provided and / or one or more specific users to whom the service is to be provided. Various other image building tools may be used similarly, for example, OpenStack's diskimage-builder or jailkit tools to build a chroot environment.

[0187] As mentioned, the container image 140 includes sensitive data 122. For example, the sensitive data may be included in the container image 140 in the form of a local database, for example, the image processing unit 132 may add database software and instructions and / or data to the container image 140 to set up the database software 122 with the sensitive data. For example, the database software may be a serverless database software such as sqlite. The included database may be a sub-database of the database 121. For example, the image processing unit 132 may set the included database to be a subset of the tables, columns, and / or rows of the database 121 (e.g., including the sensitive data 122) required to provide personalized network services. For example, the data may include credentials 441, user data 442, and / or service data 443, as shown in reference Figure 4bAs discussed above. The software (e.g., instructions 141) in the container image 140 can be set to connect to a local database (e.g., instead of connecting to the remote database 121). This is transparent to the software in the container image 140 that accesses the database. For example, other than adjusting the database connection parameters, no other adjustments may be required to the software to enable it to use sensitive data 122 from the container image 140 instead of from a remote database. However, this is not necessary. For example, the use of local sensitive data can also be achieved by adjusting the software of the container 140 so that it uses, for example, a text file instead of a database, or so that the sensitive data 122 is hard-coded in the instructions. In one embodiment, the container image 140 does not include instructions that cause the container to retrieve sensitive data from an external database when the container image 140 is deployed as a container. In general, including sensitive data 122 in the container image 140 can alleviate the need for the cloud service provider 111 and / or the container host 120 and / or the user device 113 to access the database 131, thereby improving security.

[0188] In one embodiment, the container image 140 includes a termination instruction 143. When the container image 140 is deployed as a container, the termination instruction 143 can cause the container to terminate after a time limit. This can have the advantage of not requiring notification and / or regular inspection of termination. Another advantage is that the exposure time of the service will not be unnecessarily extended. The termination instruction 143 can alternatively or additionally cause the container to terminate after the use of the personalized network service is completed. For example, after a predefined number of successful visits to the personalized network service (e.g., after a single visit or after at least or up to three or ten visits), the container terminates. For example, a container providing a Web-based patient assessment portal can be terminated after the assessment is completed. Termination after use can have the following advantages: it will not unnecessarily extend the exposure time of the service and / or can be used as an indication of the completion of the use of the personalized network service by, for example, the container builder 110. The termination instruction 143 can also include instructions to delete certain data from the container (e.g., software modules including sensitive software assets or sensitive data that do not need to be retained), which can further reduce the exposure of sensitive information.

[0189] In one embodiment, the image processing unit 132 is configured to build the container image 140 by, for example, first preparing the container image before receiving a request to build the container image, and customizing the container image based on the sensitive data 122 when the request is received. For example, building the container image 140 may include multiple building steps, preparing the container image includes a first set of building steps, and customizing the container image includes a second set of building steps, and the second set of building steps includes adding specific user credentials and / or sensitive data to the container image. The image processing unit 132 may also use placeholder data instead of sensitive data 122 to build the container image, and then replace the placeholder data with sensitive data 122 after retrieving sensitive data 122 from the database 121. For example, the placeholder data may be included in one or more specific files of the container image. The image processing unit 132 may replace these specific files with personalized files based on the sensitive data 122. For example, as discussed above, these specific files may be text files or database files for database software. In any case, the amount of work performed when customizing may be relatively small, thereby improving overall scalability.

[0190] The container builder 110 may also include a communication interface 150 configured for digital communication with the cloud service provider 111 and / or other devices of the network service system 100, for example, via the computer network 190, as explained in more detail above. In one embodiment, the container builder 110 is connected to the cloud service provider 111 behind a firewall 191. For example, the firewall 191 may include a network firewall that controls communication between the container builder 110 and other devices. In one embodiment, the container builder does not accept incoming network connections from the container builder 111 and / or the container host 112 and / or the user device 113. For example, for incoming connections from the computer network 190, the cloud service provider 111 may not have direct access at all. The firewall 191 may alternatively or additionally include a host-based firewall (e.g., a host-based firewall running on the container builder 110, for example, a firewall that blocks some or all incoming connections from the computer network 190). The use of a firewall further reduces the exposure of sensitive data (e.g., sensitive data from the database 121). The container builder 110 may not need to be continuously connected to the computer network 190. In one embodiment, the container builder 110 is configured to connect to the computer network 190 before providing the container image 140 for deployment, and / or disconnect from the computer network 190 after providing the container image 140, thereby further reducing its exposure.

[0191] The container builder 110 may also include a cloud processing unit 133 configured to provide the container image 140 for deployment to the cloud service provider 111 using the communication interface 150. For example, the cloud processing unit 133 may upload the container image 140 to the cloud provider 111 and send instructions for deploying the container image to the cloud provider 111, for example, via SSH, a RESTful API, etc., for example, when using Docker, using a "docker stack deploy" shell command or a corresponding call to the Docker Engine API. The cloud processing unit 133 may also store the container image 140 in a private registry and instruct the cloud service provider 111 with instructions to pull the image from the private registry and deploy the image.

[0192] In summary, the various steps described above can enable personalized network services to be provided to user devices 113 in a manner that reduces exposure of sensitive data. The container builder 110 can retrieve sensitive data 122 from the private database 121 and put the sensitive data 122 into the container image 140. However, other devices (e.g., cloud service provider 111, container host 112, and user device 113) (e.g., due to firewall 191) cannot directly access the database 121. The container builder 110 provides the container image 140 to the cloud service provider 111, and the cloud service provider deploys the container image 140 on the container host 112, so that the container host 112 can provide personalized services to the user device 113. Although these steps may cause some exposure of the sensitive data 122 required for the current personalized network service, other sensitive data in the database 121 (e.g., sensitive data related to other users) will not be exposed, for example, damage that occurs during the provision of personalized network services may have less impact on other users. Furthermore, various containerization techniques may allow for relatively good scalability, for example because any number of container hosts may be used and / or the number of container hosts may be adjusted dynamically, and / or because container hosts may allow for relatively efficient running of similar or partially overlapping containers.

[0193] Figure 2 An example of an embodiment of a network service system 200 is schematically shown, which involves updated data to be stored in a database. The network service system 200 may be the network service system 100 described above. For example, the network service system 200 may include a private database 221 (e.g., a private database of the container builder 210) storing sensitive data 223 and various components that allow personalized network services to be provided based on the sensitive data.

[0194] In addition to using sensitive data, providing personalized network services also involves obtaining updated data updated by the personalized network services. For example, the updated data 223 may include the input of the user of the personalized network service and / or the result of the data processing performed by the container. The updated data may include sensitive updated data (e.g., updates to sensitive data 122). The updated data may include information about the user of the personalized network service (e.g., personal information, e.g., medical information). Continuing the incentive example of the above Web-based patient assessment portal, various questions related to their health can be presented to the patient, wherein the updated data includes answers to these questions. Typically, the updated data generated by the use of personalized network services may include updates to existing sensitive data on which the service is based and / or new data that was not stored in the database before the service was provided. Various embodiments are discussed here, wherein the updated data 223 is obtained by the container builder 210 and is stored in the database 221.

[0195] The network service system 200 may include a container host 212 (e.g., Figure 1 The container host 112 may include a container 270. The container 270 may run on the container platform 260. The container image (e.g., the container image 240) may be deployed as the container 270 to provide personalized network services based on the sensitive data 223. The network service system 200 may also include a user device 213 (e.g., Figure 1 User device 113). Similar to Figure 1 , this figure shows functional units, for example, units 231, 232, 233, 235 and / or 236, which may be functional units of a processor of a corresponding device.

[0196] In particular, the network service system 200 may include a container builder 210 (e.g., Figure 1Container builder 210 may be used to provide personalized network services based on sensitive data 223. Container builder 240 may include a data interface 220 for accessing database 221. Container builder 240 may also include a communication interface 250 for connecting to cloud service provider 211, for example, via computer network 290. Container builder 240 may also include: a data processing unit configured to retrieve sensitive data 223 from database 221 using data interface 223; an image processing unit 232 configured to build a container image 240 including sensitive data; and / or a cloud processing unit 233 configured to provide a container image 223 for deployment to cloud service provider 211 using communication interface 250. Container image 240 may include instructions that, when container image 240 is deployed as a container, cause the container to provide personalized network services based on sensitive data 223 included in container image 240.

[0197] The network service system 200 may also include a cloud service provider 211 (eg, Figure 1 The cloud service provider 211 may include a communication interface 251 for connecting to the container builder 210 and / or the container host 212. The cloud service provider 211 may also include a builder processing unit 235 configured to receive a container image 240 from the container builder 210 for deployment using the communication interface 251. The cloud service provider 211 may also include a deployment unit 236 configured to deploy the container image 240 as a container. Figure 2 In the example embodiment shown, container image 240 is deployed as container 270 on container host 212 , but as discussed above, container host 212 may also be consistent with cloud service provider 211 .

[0198] As discussed above, as a result of providing personalized network services, container 270 may include updated data 223. For example, one or more files deployed in container 270 may have been modified and / or deleted, and / or one or more new files may have been created in container 270. For example, the updated data may include updates to one or more files included in container image 240. The updated data may be stored in a memory and / or storage device of container 270.

[0199] In various embodiments, the container builder 210 obtains the updated data 223 of the container 270. For example, the image processing unit 232 may be configured to include in the container image 240 an instruction for the container 270 to collect the updated data 223 and provide it to the container builder 210 and / or the cloud service provider 211. For example, the container 270 may upload the collected updated data 223 to a remote storage device 280 (e.g., a remote database or a remote file system); the container 270 may send the collected updated data to an email address accessible to the container builder 211 or the like via email. The remote storage device 280 is shown here as a separate network entity, but it may also be an externally accessible storage device such as the cloud service provider 211. The container builder 210 may be configured to obtain the updated data 223, for example, by retrieving the updated data 223 from the remote storage device 280. The updated data 223 may also be obtained from the container 270, for example, by the container builder 210, the cloud service provider 212, or the container platform 260. For example, container 270 stores updated data 223 in an externally accessible storage device (e.g., a storage device accessible by cloud service provider 212 or container platform 260, such as a Docker bind mount or volume, a network share, etc.) during processing. In such a case, cloud service provider 212 or container platform 260 can be configured to collect updated data 223 and provide it to container builder 210, for example, by uploading updated data 223 to remote storage device 280. For example, collecting updated data can be performed by a post-processing script executed after container 270 is terminated, which can have the following advantages: less customization of the software in the container is required.

[0200] The updated data 223 may be provided to the container builder 210 in various formats (e.g., in the form of one or more database files, text files, etc.). In one embodiment, the cloud processing unit 233 retrieves the updated container image from the cloud service provider 211, and the image processing unit 132 extracts the updated data 244 from the updated container image. For example, the updated container image may have a similar format to the container image 240. This may have the following advantages: less customization of the software in the container is required, for example, providing the updated data 223 may be transparent to the software in the container.

[0201] In various embodiments, the updated data 223 is encrypted with an encryption key 244 when collected, and the cloud processing unit 233 is configured to decrypt the acquired updated data 223 using a decryption key 245 corresponding to the encryption key 244. For example, the image processing unit 232 may include encryption instructions 246 in the container image 240 for encrypting the collected updated data 223 using the encryption key 244 when collected, or the cloud processing unit 233 may provide the encryption key 244 to the cloud service provider 211 and / or the container host 212 for encryption when collected. The image processing unit 232 may be configured to generate the encryption key 244 and the decryption key 245, or to otherwise obtain the encryption key 244 and the decryption key 245. The use of encryption may reduce exposure of the updated data 223. In some embodiments, the encryption key 244 and the decryption key 245 are both the same symmetric key; in other embodiments, the encryption key 244 and the decryption key 245 form a public / private key pair. The latter has the advantage that once the updated data 223 is encrypted, even the party that performed the encryption or the party whose key material is compromised cannot decrypt the updated data 223.

[0202] Typically, the cloud processing unit 233 obtains updated data 223 when the container 270 is terminated. For example, the cloud processing unit 233 can be configured to periodically check whether the container has been terminated. For example, the cloud processing unit 232 can contact the cloud service provider 211 to obtain status updates about the container 270, and the builder processing unit 235 of the cloud service provider 232 is configured to provide such status updates to the container builder 210 upon request. The cloud processing unit 232 can also directly contact the container 270 to obtain status updates, such as by attempting to access a personalized network service provided by the container 270 or by contacting the container 270 in another manner. The presence of updated data in the storage device 280 can also indicate the termination of the cloud processing unit 233. The periodic check performed by the cloud processing unit 232 can have the following advantages: the container builder 210 does not need to accept incoming connections to detect termination, for example, it does not need to receive notifications. However, other options besides the periodic checking described herein may also be used, for example, the cloud service provider 211 may be configured to notify the container builder 210 when the container 270 terminates, for example, using a RESTful API provided by the container builder 210, by email, or using any suitable notification mechanism to notify the container builder 210. However, it may not be necessary to check for termination, for example, the container 270 may be configured to terminate after a time limit as discussed above, and the cloud processing unit 232 is configured to retrieve updated data 223 after the time limit. Moreover, it may not be necessary to wait for termination at all, for example, the cloud processing unit 233 can obtain updated data 223 from the running container.

[0203] The data processing unit 231 of the container builder 210 may be configured to store the updated data 223 in the database 221 using the data interface 220. Storing the updated data 223 may include checking the validity of the updated data 223. If the updated data 223 is found to be valid, the data processing unit 231 may only store the updated data 223 in the database 221. For example, checking the validity may include: checking that the updated data only includes data related to the intended user of the personalized network service; checking that the updated data 223 only includes data related to the personalized network service; and / or checking whether the updated data 223 has not been tampered with, for example, by verifying the checksum and / or digital signature on the data. For example, the data processing unit 231 may assign an identifier (e.g., a unique identifier (e.g., randomly generated)) to each container image provided for deployment. Such an identifier may be included in the container image 240. The data processing unit 231 may also maintain a list of entries, the entries including the identifier of the container image, the user or user set for which personalization is implemented, and / or the specification of the data field that is allowed to be modified. When retrieving updated data 223, data processing unit 231 may obtain, for example, an identifier included in the corresponding container image as part of updated data 223, and may check specifications of data fields of the updated data 223 related to a user or user set and / or a corresponding entry. Checking updated data 223 may have the following advantages: even if a container providing a personalized network service is included, such damage may only affect data related to a specific user and / or a specific network service and / or may not affect data validity.

[0204] In general, the above description and the Figure 2 The various embodiments illustrated by the system shown may allow for updating the database 221 with updated data 223. The updated data 223 may be provided to the container 270, such as inserted or input into the container 270 by the user device 213, as indicated by the dashed line. The updated data 223 may then be obtained by the container builder 210, such as the container 270 uploading the updated data 223 to a remote database, as indicated by another dashed line, and the container builder 210 downloading the updated data 223 from the remote database. Finally, the container builder 210 may store the updated data 223 in the database 221. Thus, the database 221 may be updated without exposing the database 221 to remote access.

[0205] Figure 3An example of an embodiment of a network service system 300 involving user authentication is schematically shown. The network service system 300 may include one or more of a container builder 310, a cloud service provider 311, a container host 312, and a user device 313.

[0206] For example, the container builder 310 may be a container builder as described above (e.g., Figure 1 Container Builder 110 or Figure 2 In particular, container builder 310 may include image processing unit 332 (e.g., image processing unit 132 or image processing 232). Although not shown, container builder 310 may also include a data interface, a data processing unit, and / or a cloud processing unit (e.g., units 120, 131, 133, 220, 231, and / or 233).

[0207] Similarly, cloud service provider 311 may be a cloud service provider as described above (e.g., cloud service provider 111 or 211 (e.g., including a deployment unit 336 such as deployment unit 136 or deployment unit 236)). Although not shown in the drawings, cloud service provider 311 may also include a builder processing unit (e.g., unit 135 or 235).

[0208] Container host 312 may be container host 112 or 212 (e.g., including container 370 such as container 170 or 270). User device 313 may be user device 113 or user device 213. The device may communicate using computer network 390 (e.g., computer network 190 or 290). Figure 1 , this figure illustrates functional units (eg, units 332 and / or 236), which may be functional units of a processor of a corresponding device.

[0209] The image processing unit 332 of the container builder 310 can arrange the container 370 so that the container 370 only provides access to the personalized network service to users who have certain authentication information. The image processing unit 332 can also provide the authentication information to the intended user of the personalized network service, such as to the user device 313 or its owner. This has the advantage of further limiting data exposure because the attacker will need to make additional efforts to obtain the authentication information. Various authentication information or various combinations thereof can be used (e.g., multi-factor authentication, such as two-factor authentication).

[0210] In one embodiment, the authentication information includes a private address 348 (e.g., a URL, domain name, etc.) for connecting to the container. The private address 348 can be unique to a given user or set of users. For example, the private address 348 can be a hidden subdomain. When providing a container image 340 for deployment, the container builder 310 can request the cloud service provider 311 to deploy the container image 340 at the private address. The cloud service provider 311 can deploy the container image 340 at the container host 312, generate a private address such as "a0123.networkservice.com", and map the private address to the container, for example, in a DNS entry. The private address can include a random port number such as 4824, at which a network service (e.g., a web application) can be deployed. The cloud service provider 311 can provide the private address to the container builder 310, or the container builder 310 can select or suggest at least a portion of the private address. In any case, the container builder can instruct the user device 313 to connect to the private address 348 using instructions, such as using a link (e.g., http: / / a0123.networkservice.com:4824 / , e.g., an invitation to fill out a patient evaluation) sent via email to the private address 348. The private address is user-friendly and difficult to compromise the security of the system because it is difficult to guess.

[0211] In one embodiment, the authentication information includes a token 347 (e.g., a secret token). The container image 340 may include instructions 349 that, when the container image 340 is deployed as a container, cause the container to verify whether the connected user possesses the token 347. For example, the token 347 may be a random string (e.g., a random string with a minimum length or minimum entropy, e.g., at least 5 or at least 10 characters or at least 10 or 20 bits of entropy, e.g., "XHnRRIdykv"). For example, the image processing unit 332 may randomly generate the token 347. The container may be configured, for example, to provide a web application only when the container is accessed using a token, e.g., the token is included in a private address 348 (e.g., "http: / / a0123.networkservice.com:4824 / ?token=XHnRRIdyk"). Alternatively, the token 347 may be a parameter for a personalized web service / web API. The use of a token makes it more difficult to compromise the system without placing a heavy burden on the user.

[0212] The examples of authentication information given above can be combined with each other and with other types of authentication information to further improve security. Figure 4a and Figure 4bAs explained, users of the web application may be required to log in using ordinary credentials. The container image 340 may include the credentials 441 of the intended user from an authentication database, which will also typically be used for user authentication. Other types of authentication may be used instead or in addition, such as using a hardware token. Interestingly, when ordinary authentication mechanisms are combined with the authentication information provided by the container builder 310, the use of the container may be transparent to the user, for example, the user may log in in the same manner as using, for example, Figure 4a The personalized network service is used in the same way as the non-personalized network service shown.

[0213] Figure 5 An example of an embodiment of a network service system 500 is shown in which a personalized network service provided by a container is combined with another network service (e.g., a non-personalized network service). Such an embodiment can allow for limiting the exposure of sensitive data 522 without incurring unnecessary overhead, for example by applying containerization only if and when sensitive data 522 is actually used.

[0214] exist Figure 5 4 , which provides non-personalized network services, for example, through application software 534. Cloud server 514 can be any conventional server that provides network services 580 (e.g., Web applications) to user devices. Also shown is a user device 513 to which such services are provided, which is shown here as a laptop computer (e.g., user devices 113, 213, or 313 as discussed above) for illustrative purposes only. As an incentive example, application software 534 can provide a Web store application to a user of user device 513, which the user can use to select various items to purchase. When browsing, the application may not require sensitive data 522 (e.g., the user's address and / or credit card information).

[0215] At some point, the provided application may need to access sensitive information 522. At this point, the application software 534 can provide a redirection 581 that redirects the user device 513 to the container 570 running on the container host 512. The redirection 481 may include incoming information for the application software 534 of the container 570. The container 570 is deployed according to a container image built by a container builder 510, and has access to a database 521 including sensitive information 522 as described above, for example, the container builder 510 can be the container builder 110, the container builder 210, or the container builder 310 as described above. For example, the cloud server 514 can instruct the container builder 510 with instructions to deploy the container, and the container builder 510 can be configured to provide a container image for deployment. In view of the desire to minimize the user's waiting time, in this setting, it is particularly beneficial to prepare the container image in advance and customize the container image based on the sensitive data 522 as described above. After providing the container image for deployment, the container builder 510 can then provide the address of the network service that can achieve personalization to the cloud server 514. The cloud server 514 can then redirect 581 the user device 513 to the address. Alternatively, access to the container 570 can be detected, for example, by the container platform 560 of the container host 512, in which the container builder 510 can provide the container image for deployment.

[0216] In the case of being redirected to container 570, user device 513 can now utilize personalized network services provided by the container. Continuing with the above example, user device 513 can be redirected by redirecting 581 to container 570 for shopping card checkout. In this case, sensitive information 522 included in the container image can include, for example, credit card information and / or address information about the user. The incoming information included in redirection 581 can include, for example, the contents of a shopping cart. Container image 570 can provide personalized network services, for example, to process a user's payment. After providing personalized network services, container 570 can provide redirection 582, which redirects user device 513 to a cloud server, for example, back to cloud server 514. Redirection 582 can include a return value of the personalized network service, such as indicating whether the payment was successful in the payment example. User device 513 can continue to use the web application, and container 570 based on sensitive information 522 can be cleaned up or terminated.

[0217] Therefore, in Figure 5The various embodiments schematically illustrated in the diagram may allow an application to be provided to a user device 513 that is based in part on information from a database 521 and in which exposure of information from the database 521 is limited, while at the same time allowing the use of different technologies, such as a more traditional cloud server 514, to provide portions of the application that do not require access to a database.

[0218] Figure 6 An exemplary hardware diagram 1100 for implementing a container builder, cloud service provider, container host, or user device is illustrated. Exemplary hardware 1100 may correspond, for example, to any of the following: container builder 110, 210, 310, 470, or 510; cloud service provider 111, 211, or 311; container host 112, 212, 312, or 512; or user device 113, 213, 313, or 513. As shown, device 1100 includes a processor 1120, memory 1130, user interface 1140, communication interface 1150, and storage device 1160 interconnected via one or more system buses 1110. It should be understood that in some aspects, Figure 6 a constitutes an abstraction, and the actual organization of the components of device 1100 may be more complex than shown.

[0219] The processor 1120 may be any hardware device capable of executing instructions stored in the memory 1130 or the storage device 1160 or otherwise processing data. As such, the processor may include a microprocessor, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other similar device. The processor 1120 may be provided, for example, in a cloud computing architecture, etc. Other examples are shown herein. The processor 1120 may be implemented in a distributed manner, for example, as a plurality of sub-processors (e.g., sub-processor circuits).

[0220] Memory 1130 may include various memories (e.g., L1, L2 or L3 cache memory or system memory). As such, memory 1130 may include static random access memory (SRAM), dynamic RAM (DRAM), flash memory, read-only memory (ROM), or other similar storage devices. It will be apparent that in embodiments where the processor includes one or more ASICs (or other processing devices) that implement one or more of the functions described herein in hardware, software described in other embodiments as corresponding to such functions may be omitted. Part or all of the memory may be electronic memory, magnetic memory, etc.

[0221] The user interface 1140 may include one or more devices for enabling communication with a user such as an administrator. For example, the user interface 1140 may include a touch screen, a display, a mouse, and / or a keyboard for receiving user commands. In some embodiments, the user interface 1140 may include a command line interface or a graphical user interface that may be presented to a remote terminal via the communication interface 1150.

[0222] The communication interface 1150 may include one or more devices for enabling communication with other hardware devices. The communication interface may be a network interface. For example, the communication interface 1150 may include a network interface card (NIC) configured to communicate according to the Ethernet protocol. The network interface may be a local area network or a wide area network (e.g., the Internet). In addition, the communication interface 1150 may implement a TCP / IP stack for communicating according to the TCP / IP protocol. The communication interface may also be a storage interface of an internal or external data storage device, a keyboard, an application program interface (API), etc. Various alternatives or additional hardware or configurations for the communication interface 1150 will be apparent.

[0223] The storage device 1160 may include one or more machine-readable storage media, such as a read-only memory (ROM), a random access memory (RAM), a disk storage medium, an optical storage medium, a flash memory device, or a similar storage medium. The storage device 1160 may include a plurality of discrete memories that together constitute the storage device. The storage device 1160 may also be a temporary storage device (e.g., RAM). In the case of a temporary storage device, the storage device includes some means for acquiring data before use (e.g., acquiring data through an optional network connection (not shown)). In various embodiments, the storage device 1160 may store instructions executed by the processor 1120 or data that the processor 1120 may operate on. For example, the instructions may have been downloaded and / or stored in a corresponding memory (e.g., a volatile memory such as RAM or a non-volatile memory such as flash memory). For example, the storage device 1160 may store a basic operating system 1161 for controlling various basic operations of the hardware 1100. According to various embodiments described herein, the storage device may also store instructions 1162-1164 for executing the functions of the various units described above (e.g., data processing unit, image processing unit, cloud processing unit, builder processing unit, or deployment unit). The storage device may be distributed across multiple distributed sub-storage devices. For example, the storage device may have a volatile portion and a non-volatile portion. Portions of the storage device may be read-only.

[0224] It will be apparent that various information described as being stored in storage device 1160 may be stored additionally or alternatively in memory 1130. In this regard, memory 1130 may also be considered to constitute a "storage device", and storage device 1160 may be considered to be a "memory". Various other arrangements will be apparent. Additionally, both memory 1130 and storage device 1160 may be considered to be "non-transitory machine-readable media". As used herein, the term "non-transitory" will be understood to exclude transient signals, but rather to include all forms of storage devices (including volatile memory and non-volatile memory).

[0225] Although device 1100 is shown as including one of each described component, various components can be duplicated in various embodiments. For example, processor 1120 may include multiple microprocessors, which are configured to independently perform the method described herein or are configured to perform the steps or subroutines of the method described herein, so that these multiple processors cooperate to realize the functions described herein. In addition, in the case where device 1100 is implemented in a cloud computing system, various hardware components may belong to a separate physical system. For example, processor 1120 may include a first processor in a first server and a second processor in a second server. Device 1100 may also be equipped with a microprocessor and a memory. Alternatively, these devices may be implemented in whole or in part in a programmable logic unit (e.g., implemented as a field programmable gate array (FPGA)). These devices may be implemented in whole or in part as a so-called application-specific integrated circuit (ASIC) (e.g., an integrated circuit (IC) customized for its specific purpose).

[0226] In one embodiment, the container builder may include a data circuit, a processor circuit, and a communication circuit. In one embodiment, the cloud service provider may include a communication circuit and a processor circuit. The container builder may include one or more of a data processing circuit, an image processing circuit, and a cloud processing circuit. The cloud service provider may include one or more of a builder processing circuit and a deployment circuit. These circuits implement the corresponding units described herein. These circuits may be processor circuits and storage circuits, and the processor circuits execute instructions electronically represented in the storage circuits. These circuits may also be FPGAs, ASICs, and the like.

[0227] The processor may be a processor circuit that may be implemented in a distributed manner, for example, as a plurality of sub-processor circuits. The storage device may be distributed across a plurality of distributed sub-storage devices. Part or all of the memory may be an electronic memory, a magnetic memory, etc. For example, the storage device may have a volatile portion and a non-volatile portion. Portions of the storage device may be read-only.

[0228] Figure 1 , Figure 2 , Figure 3 , Figure 5 Functional units are shown that may be functional units of processor 1120. For example, Figure 1 The container builder 110 can be used as a blueprint for possible functional organization of the processor. The processor is not shown separately from the units in the figures. For example, the functional units of the container builder 110 can be implemented in whole or in part in computer instructions stored at the container builder 110 (e.g., implemented in an electronic memory stored in the container builder 110) and can be executed by a microprocessor of the container builder 110. In a hybrid embodiment, the functional units are partially implemented in hardware (e.g., implemented as a coprocessor (e.g., an encryption coprocessor)) and partially implemented in software stored and executed on the container builder 110, and similar situations are also true for other devices in the various figures.

[0229] Typically, container builders, cloud service providers, container hosts, and user devices all include a microprocessor that executes appropriate software stored on each device; for example, the software may have been downloaded and / or stored in a corresponding memory (e.g., a volatile memory such as RAM or a non-volatile memory such as flash memory). The corresponding device may also be equipped with a microprocessor and a memory. Alternatively, these devices may be implemented in whole or in part in a programmable logic unit (e.g., as a field programmable gate array (FPGA)). These devices may be implemented in whole or in part as a so-called application-specific integrated circuit (ASIC) (e.g., an integrated circuit (IC) customized for its specific purpose). For example, these circuits may be implemented in CMOS, for example, using a hardware description language such as Verilog, VHDL, etc.

[0230] Figure 7a An example of an embodiment of a container builder method 1200 for building a container image is schematically shown. The container image is used to provide personalized network services based on sensitive data in a database. The container builder method 1200 includes:

[0231] Provides 1210 access to the database,

[0232] Provide 1220 digital communication with cloud service providers,

[0233] Retrieve 1230 sensitive data from the database,

[0234] Build 1240 container images, which include sensitive data.

[0235] A container image for deployment is provided 1250 to a cloud service provider, the container image including instructions that, when the container image is deployed as a container, enable the container to provide personalized network services based on sensitive data included in the container image.

[0236] Figure 7b An example of an embodiment of a cloud service provider method 1300 for use with a container builder according to one embodiment is schematically shown. The cloud service provider method 1300 includes:

[0237] providing 1310 digital communication with a container builder,

[0238] receiving 1320 a container image for deployment from a container builder, wherein the container image includes sensitive data and instructions, and when the container image is deployed as a container, the instructions enable the container to provide personalized network services based on the sensitive data,

[0239] The container image is deployed 1330 as a container.

[0240] As will be apparent to those skilled in the art, many different ways of performing the method are possible. For example, the order of the steps may be changed, or some steps may be performed in parallel. In addition, other method steps may be inserted between the steps. The inserted steps may represent, for example, a refinement of the method described herein, or may be unrelated to the method. For example, steps 1210 and 1220 may be performed at least partially in parallel. In addition, a given step may not be fully completed before starting the next step.

[0241] Embodiments of these methods may be performed using software including instructions for causing a processor system to perform method 1200 or 1300. Software may include only those steps taken by a specific sub-entity of the system. The software may be stored in a suitable storage medium (e.g., a hard disk, a floppy disk, a memory, an optical disk, etc.). The software may be sent as a signal in a wired manner, wirelessly, or using a data network (e.g., the Internet). The software may be made available for downloading from a server and / or for remote use. An embodiment of the method may be performed using a bitstream arranged to configure a programmable logic unit (e.g., a field programmable gate array (FPGA)), thereby performing the method.

[0242] It should be understood that the present invention also extends to a computer program (particularly a computer program on or in a carrier) suitable for putting the present invention into practice. The program may be in the form of source code, object code, intermediate source code and object code, such as a partially compiled form, or any other form suitable for use in the implementation of the embodiment of the method. An embodiment related to a computer program product includes computer executable instructions corresponding to each processing step in the processing steps of at least one of the methods described. These instructions may be subdivided into subroutines and / or stored in one or more files that may be statically or dynamically linked. Another embodiment related to a computer program product includes computer executable instructions corresponding to each unit in the unit of at least one of the systems and / or products described.

[0243] Figure 7c A computer-readable medium 1900 having a writable portion 1910 is shown, which includes a container image 1920 for providing personalized network services based on sensitive data. The container image 1920 includes sensitive data 1921. The container image 1920 also includes instructions 1922, which, when the container image 1920 is deployed as a container, causes the container to provide personalized network services based on sensitive data 1921. The container image 1920 can be implemented on the computer-readable medium 1900 as a physical mark or by means of magnetization of the computer-readable medium 1900. However, any other suitable embodiment is also conceivable. In addition, it will be appreciated that although the computer-readable medium 1900 is shown here as an optical disk, the computer-readable medium 1900 can also be any suitable computer-readable medium (e.g., a hard disk, a solid-state memory, a flash memory, etc.) and can be non-recordable or recordable.

[0244] Figure 7d A computer-readable medium 2000 having a writable portion 2010 including a computer program 2020 is shown, the computer program 2020 including instructions for causing a processor system to perform a container builder method or a cloud service provider method according to an embodiment. The computer program 2020 may be implemented on the computer-readable medium 2000 as a physical mark or by means of magnetization of the computer-readable medium 2000. However, any other suitable embodiment is also conceivable. In addition, it will be appreciated that although the computer-readable medium 2000 is shown here as an optical disk, the computer-readable medium 2000 may also be any suitable computer-readable medium (e.g., a hard disk, a solid-state memory, a flash memory, etc.) and may be non-recordable or recordable. The computer program 2020 includes instructions for causing a processor system to perform the container builder method or the cloud service provider method.

[0245] It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments.

[0246] In the claims, any reference signs between brackets shall not be construed as limiting the claim. The use of the verb "comprise" and its conjugations does not exclude the presence of other elements or steps not mentioned in the claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a device claim enumerating several units, several of these units may be implemented by the same item of hardware. The fact that certain measures are recited in mutually different dependent claims does not mean that a combination of these measures cannot be used to advantage.

Claims

1. A container builder for building a container image, wherein the container image is used to provide personalized network services based on sensitive data in a database, the container builder comprising: a data interface configured to access the database, the database being configured as a private database of the container builder, a communication interface configured for digital communication with a cloud service provider, A processor configured to: retrieving the sensitive data from the database using the data interface, Building the container image, wherein the container image includes the sensitive data, The container image for deployment is provided to the cloud service provider using the communication interface, wherein the container image includes instructions, and when the container image is deployed as a container, the instructions enable the container to provide the personalized network service based on the sensitive data included in the container image.

2. The container builder according to claim 1, wherein: The personalized network service is a Web application.

3. A container builder according to any one of the preceding claims, wherein: The sensitive data includes personal information about a user, and the container image is arranged to provide the personalized network service to the user.

4. A container builder according to any one of the preceding claims, wherein: The container image includes instructions that, when the container image is deployed as a container, cause the container to terminate after a time limit and / or after use of the personalized network service is completed.

5. A container builder according to any one of the preceding claims, wherein: The processor is further configured to: Acquire updated data, wherein the updated data is updated through the personalized network service, and store the updated data in the database using the data interface.

6. The container builder according to claim 5, wherein: The container image further includes instructions, which, when the container image is deployed as a container, cause the container to collect the updated data and provide the updated data to the container builder or the cloud service provider.

7. The container builder according to any one of claims 5 to 6, wherein: The container image also includes encryption instructions, and when the container image is deployed as a container, the encryption instructions cause the container image to encrypt the updated data, and obtaining the updated data includes decrypting the encrypted updated data using a decryption key corresponding to the encryption key.

8. The container builder according to any one of claims 5 to 7, wherein: The container builder is further configured to check validity of the updated data and store the updated data in the database only if the updated data is valid.

9. A container builder according to any one of the preceding claims, wherein: The container builder is further configured to provide authentication information to prospective users of the personalized web service, the container being arranged to provide access to the personalized web service only to users possessing the authentication information.

10. The container builder according to claim 9, wherein: The authentication information includes a token, and the container image includes instructions that, when the container image is deployed as a container, cause the container to verify that a connecting user possesses the token.

11. A cloud service provider for use with a container builder according to any one of the preceding claims, the cloud service provider comprising: a communication interface configured for digital communication with the container builder, A processor configured to: receiving a container image for deployment from the container builder using the communication interface, wherein the container image has been built by a container builder method, the container builder method involving: providing access to a database, and retrieving sensitive data from the database, whereby the container image includes the sensitive data and instructions, and when the container image is deployed as a container, the instructions cause the container to provide personalized network services based on the sensitive data, The container image is deployed as a container to provide the personalized network service based on the sensitive data.

12. A container builder method for building a container image, wherein the container image is used to provide personalized network services based on sensitive data in a database, the container builder method comprising: providing access to the database, the database being configured as a private database of the container builder, Provide digital communications with cloud service providers, retrieving the sensitive data from the database, Building the container image, wherein the container image includes the sensitive data, The container image for deployment is provided to the cloud service provider, wherein the container image includes instructions, and when the container image is deployed as a container, the instructions enable the container to provide the personalized network service based on the sensitive data included in the container image.

13. A cloud service provider method for use with the container builder according to any one of the preceding claims 1-10, the cloud service provider method comprising: providing digital communication with said container builder, receiving a container image for deployment from the container builder, wherein the container image has been built by a container builder method, the container builder method involving: providing access to a database and retrieving sensitive data from the database, whereby the container image includes the sensitive data and instructions, and when the container image is deployed as a container, the instructions cause the container to provide personalized network services based on the sensitive data, The container image is deployed as a container to provide the personalized network service based on the sensitive data.

14. A computer-readable medium comprising transient or non-transient data, the transient or non-transient data representing a container image for providing personalized network services based on sensitive data, the container image having been built by a container builder method, the container builder method involving: providing access to a database and retrieving the sensitive data from the database, the database being configured as a private database of the container builder, whereby the container image comprises: the sensitive data, and Instructions, when the container image is deployed as a container, the instructions enable the container to provide the personalized network service based on the sensitive data.

15. A computer-readable storage medium comprising transient or non-transient data representing instructions for causing a processor system to perform the method according to any one of claims 12 and 13.

Images