Filtering information for tenant containers

Abstract

Embodiments of the present disclosure provide a method (300) for securing a tenant container (25) executed by a computing device (102). The method (300) is performed by a computing device (102). The method (300) includes filtering (304) information collected by probes (40) enabled within one or more processes being executed on the computing device (102) to protect the tenant container (25). Corresponding computing devices and computer program products are also disclosed.

Description

Technical Field

[0001] The present disclosure generally relates to the field of cloud security systems. More specifically, the present disclosure relates to methods, computing devices, and computer program products for protecting the collection of information related to tenant containers. Background Art

[0002] Traditionally, network functions representing cellular networks have been represented by physical devices. For example, dedicated hardware has been deployed for a specific network function or a set of network functions. Over time, the concept of virtualization has emerged in sync with the advent of the fifth generation 5G networks. Virtualization involves moving network functions from dedicated hardware to commodity rack hardware, thereby providing flexibility for both scaling and hosting of network functions.

[0003] Furthermore, clause 8 of the "Network Function Virtualization (NFV) Use Cases" from the European Telecommunications Standards Institute ETSI standard describes the transformation of use cases enabled by virtualization. One of the use cases is that companies that used to buy dedicated hardware and the host itself can now buy functions packaged as containers. This function corresponds to the network functions of a cellular network, for example.

[0004] With the advent of virtualization, various mechanisms for providing virtualized computing resources are evolving. For example, container technology and corresponding container cluster platforms are emerging as solutions for implementing flexible and scalable application virtualization mechanisms. In such a mechanism, network functions / any other applications can be implemented using, for example, a set of containers with different functions supplied on a set of computing resources. Computing resources can be physical computing resources or virtual computing resources, such as virtualized computing resources in a data center or multiple data centers or a container cluster platform.

[0005] The use of containers is a method of virtualizing computers, or more specifically, computer software applications. Containers separate applications from the operating system and the physical infrastructure that the application uses to connect to the computing network. The use of containers, such as Docker, is known for rapid provisioning within cluster and cloud environments. Docker is an open platform container runtime for developers and system administrators to build and run distributed applications as containers.

[0006] Typically, a container refers to a software package that can be executed in a computing device. Containers can be provided as a service, which is often referred to as container as a service (CaaS), in which one organization provides runtime and resources to another organization to deploy its (one or more) containers in a public cloud. The organization that hosts the container can be referred to as a cloud service provider CSP or an infrastructure provider. In some examples, the CSP / infrastructure provider may be part of a hyperscale provider, a communications service provider, or an organization with containers to be deployed. The organization that provides containers to the CSP is typically referred to as a tenant. The CSP can host and execute many tenant containers, thereby generating a large amount of valuable information. Some of the information generated by the container is metadata and general logs, while other information within the container may be sensitive. In addition, the organization that provides containers to tenants is typically referred to as the supplier of the container.

[0007] Figure 1 Existing implementations of CSPs that host tenant containers are disclosed.

[0008] like Figure 1 As illustrated, the CSP may allow containers belonging to a tenant (ie, tenant container 25 ) to be hosted and executed in any computing device or electronic device (such as computing device 102 ).

[0009] The computing device 102 executes the tenant container 25 to implement one or more applications including, for example, a network function representing a cellular network. The tenant container can be implemented at the application level. The tenant container 25 can be instantiated within the kernel 20 of the operating system OS. The tenant container 25 virtualizes an instance of the application. The use of (one or more) tenant containers 25 enables multiple applications to be executed using the same computing resources of the computing device 102. In some examples, the computing resources may include the underlying hardware 15. The underlying hardware 15 includes a central processing unit CPU 10, a memory 12, and a drive 14. Typically, the tenant container 25 does not have its own externally available Internet Protocol IP address, although it has a unique ID that can be used by the CSP hosting the tenant container 25. The server of the CSP manages the tenant container 25, and the tenant container 25 manages the application code. The tenant has no control or ownership over the underlying hardware 15 including the CPU 10, the memory 12, and the drive 14.

[0010] In addition, the computing device 102 may include an analyzer 50 that decides to use a probe 40 to extract information from the tenant container 25 being executed on the computing device 102. The probe 40 can be enabled from outside the namespace of the tenant container 25. In some examples, the probe 40 can be enabled using the extended Berkeley packet filter eBPF technology. The eBPF technology can execute a sandbox program in the Linux kernel to collect information from the container. The advantages of the eBPF technology include collecting information from the container without affecting the behavior of the kernel, or without changing the kernel itself, or by adding a kernel module without affecting the kernel. Using the eBPF technology, the probe 40 can be enabled on the tenant container 25 to collect information from the container before encryption on the sender side or after decryption on the receiver side. Such a probe 40 can typically be used by a monitoring tool / observability tool executed by the computing device 102 that hosts the tenant container 25.

[0011] The presence of the probe 40 may be activated as needed to monitor the function and health of the tenant container 25 . Summary of the invention

[0012] It may also be problematic for the owner / provider of the tenant container if the information floated / collected from the tenant container by the probe includes sensitive information such as personally identifiable information (PII) belonging to a vendor that has intellectual property rights (IPR) to the tenant container.

[0013]

[0006] Therefore, there is a need for an improved method and arrangement for protecting tenant containers that alleviates at least some of the above-mentioned problems.

[0014] It is therefore an object of the present invention to provide a method, computing device, and computer program product for protecting information associated with a tenant container that mitigates, alleviates, or eliminates all or at least some of the above-discussed disadvantages of currently known solutions.

[0015] This object and others are achieved by a method, a computing device and a computer program product as defined in the appended claims.The term exemplary in this context should be understood as serving as an example, instance or illustration.

[0016] According to a first aspect of the present disclosure, a method for protecting a tenant container executed by a computing device is provided. The method is performed by the computing device. The method includes filtering information collected by a probe enabled within one or more processes executing on the computing device to protect the tenant container.

[0017] In some embodiments, the method further includes encrypting at least some of the filtered information.

[0018] In some embodiments, filtering the collected information to protect the tenant container includes extracting a filtering rule to be applied on the collected information. The method includes obtaining attributes related to one or more of: a computing device, a tenant container, information related to the tenant container, and a probe. The method includes identifying at least a portion of the collected information to be filtered using the filtering rule and based on the obtained attributes, and filtering the identified information according to the filtering rule and the attributes.

[0019] In some embodiments, extracting the filter rules includes receiving the filter rules from one or more of: a tenant container, a data source residing within the computing device, and an external data source in communication with the computing device.

[0020] In some embodiments, the step of using filtering rules and identifying at least a portion of the collected information based on the obtained attributes is based on one or more of the following: tags defined for at least some of the information related to the tenant container, information related to the computing device, at least one function implemented by the tenant container, information related to one or more functions and / or libraries of the tenant container monitored by the probe, an identification ID of the probe, a recipient of the monitored information sent using transport layer security TLS, and parsing of protocol headers and / or data encoding schemes associated with the information related to the tenant container to be protected.

[0021] In some embodiments, filtering the collected information based on the property according to the filtering rule includes identifying a state of a property of one or more of: a computing device, a probe enabled on the tenant container, at least one function of the tenant container being monitored by the probe, the tenant container, and information related to the tenant container. The method includes evaluating the filtering rule for the identified property state. In addition, the method includes activating at least one filtering rule based on the evaluation; and filtering at least some of the collected information of the tenant container according to the activated at least one filtering rule.

[0022] In some embodiments, the state of the attribute of the computing device includes one or more of: an identification of the computing device, a geographic location of the computing device, and a provider identification of the computing device.

[0023] In some embodiments, the state of a property of a probe enabled on a tenant container includes one or more of: a provider identification associated with the probe, and one or more functions of the probe.

[0024] In some embodiments, the state of a property of at least one function of a tenant container being monitored by the probe includes one or more of: one or more functions and / or libraries being monitored by the probe, the functions to which the one or more functions and / or libraries being monitored belong, a recipient of a message being sent from the at least one function, and a service-based architecture (SBA) service associated with the at least one function.

[0025] In some embodiments, the state of the attribute of the information related to the tenant container includes one or more of the following associated with the information related to the tenant container: one or more tags, a protocol specific field, a byte sequence, and a data pattern.

[0026] In some embodiments, the step of encrypting at least some of the information collected by the probe includes extracting a plurality of encryption key materials from one or more of: a tenant container, a data source residing within a computing device, and an external data source in communication with the computing device. The method includes generating a plurality of encryption keys based on the extraction of the plurality of encryption key materials. The method includes evaluating a filtering rule for a state of an attribute of at least one of: a computing device, a probe enabled on a tenant container, at least one function of a tenant container being monitored by a probe enabled on a tenant container, a tenant container, and information related to the tenant container. The method includes selecting an encryption key from a plurality of encryption keys based on the evaluation, and encrypting at least some of the information related to the tenant container using the selected encryption key.

[0027] According to a second aspect of the present disclosure, a computing device for protecting a tenant container is provided. The computing device is suitable for filtering information collected by probes enabled in one or more processes being executed on the computing device to protect the tenant container.

[0028] According to a third aspect of the present disclosure, there is provided a computer program product comprising a non-transitory computer-readable medium, on which is a computer program comprising program instructions, the computer program being loadable into a data processing unit and configured to cause the execution of the method according to the first aspect when the computer program is run by the data processing unit.

[0029] In some embodiments, any of the above aspects may additionally have features that are the same as or correspond to any of the various features explained above for any other aspect.

[0030] An advantage of some embodiments is that alternative and / or improved methods are provided for protecting tenant containers.

[0031] An advantage of some embodiments is that by providing information to the probe about what information must be filtered out, a preference is provided about what information related to a tenant container may be extracted by the probe.

[0032] An advantage of some embodiments is that a profile may be provided to a probe, and the probe may be requested to remove at least some of the information collected by the probe related to the tenant container (eg, sensitive information) before further processing.

[0033] An advantage of some embodiments is that filtering may be useful in situations where the tenant container processes sensitive information (e.g., personally identifiable information PII) and the cloud service provider CSP (typically a mobile network operator MNO) still wants to deploy probes for visibility and security reasons. In such situations, the risk of spreading sensitive information and violating privacy laws and regulations can be avoided.

[0034] An advantage of some embodiments is that a tenant container may be enabled to influence what information is allowed to be extracted therefrom by a probe.

[0035] An advantage of some embodiments is that filtering of information related to tenant containers (i.e., sensitive information) can allow for a realistic solution for deploying sensitive functions in a cloud environment if the CSP ensures that the underlying hardware of the computing device does not extract information from the sensitive functions based on the filtering rules passed to the probe.

[0036] An advantage of some embodiments is that filtering of information related to a tenant container may cause performance penalties for the tenant container. If not all tenant containers need to be filtered, the possibility of obtaining filtering rules for each tenant container makes the method and computing device efficient.

[0037] An advantage of some embodiments is that reciprocity can be provided to CSPs and monitoring tool / observability tool providers by providing technical means to avoid collecting certain information (e.g., PII). In the event of a data leak, the observability tool provider can point out that it has not accessed PII.

[0038] Other advantages may be apparent to those skilled in the art.Some embodiments may have none, some or all of the stated advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The foregoing will be apparent from the following more particular description of example embodiments as illustrated in the accompanying drawings in which like reference characters refer to the same parts throughout the different views. The drawings are not necessarily drawn to scale, emphasis instead being placed upon illustrating the example embodiments.

[0040] Figure 1Existing implementations of cloud service providers (CSPs) that host tenant containers are disclosed;

[0041] Figure 2 A block diagram illustrating a computing device connected to a network according to some examples is disclosed;

[0042] Figure 3 is a flow chart illustrating example method steps according to some examples;

[0043] Figure 4 Example implementations for protecting tenant-related information are disclosed;

[0044] Figure 5 is a schematic block diagram illustrating an example apparatus according to some examples;

[0045] Figure 6 is a flow chart illustrating example method steps according to some examples;

[0046] Figure 7 is a flow chart illustrating example method steps according to some examples;

[0047] Figure 8 is a signaling diagram illustrating example signaling according to some examples; and

[0048] Fig. 9 An example computing environment according to some examples is disclosed. DETAILED DESCRIPTION

[0049] Aspects of the present disclosure will be described more fully below with reference to the accompanying drawings. However, the apparatus and methods disclosed herein may be implemented in many different forms and should not be construed as limited to the aspects set forth herein. Like numbers in the figures always refer to like elements.

[0050] The terms used herein are only used for the purpose of describing specific aspects of the present disclosure and are not intended to limit the present invention. It should be emphasized that when used in this specification, the term "includes / comprising" is used to specify the presence of stated features, integers, steps or components, but does not exclude the presence or addition of one or more other features, integers, steps, components or groups thereof. As used herein, the singular forms of "a", "an" and "the" are also intended to include plural forms unless the context clearly indicates otherwise.

[0051] Embodiments of the present disclosure will be more fully described and illustrated hereinafter with reference to the accompanying drawings. However, the solutions disclosed herein may be implemented in many different forms and should not be construed as limited to the embodiments set forth herein.

[0052] It will be understood that when the present disclosure is described in terms of methods, the present disclosure may also be embodied in one or more processors and one or more memories coupled to the one or more processors, wherein the one or more memories store one or more programs that, when executed by the one or more processors, perform the steps, services, and functions disclosed herein.

[0053] In the following description of exemplary embodiments, the same reference numerals denote the same or similar components.

[0054] Figure 2 A block diagram illustrating a computing device connected to a network is disclosed. Figure 2 As depicted, there may be a plurality of computing devices 102a, 102b, and 102c (hereinafter may be collectively referred to as computing devices 102) connected to a network 106. Additionally, there is a second computing device 104 that communicates with the computing devices 102a, 102b, and 102c by being connected to the network 106. For example, the network 106 may be an information technology network, an operational technology network, a cloud infrastructure, software as a service SaaS, an infrastructure, or any combination thereof that is connected to each of the computing devices 102a, 102b, and 102c and the second computing device 104.

[0055] In some examples, computing devices 102a, 102b, and 102c and second computing device 104 may include, but are not limited to, servers, computing devices, multiprocessor systems, microprocessor-based or programmable consumer electronic devices, network computing devices, or combinations thereof. Computing devices may include cellular phones, personal digital assistants (PDAs), handheld devices, laptop computers, or combinations thereof.

[0056] The computing device 102 may include one or more tenant containers hosted by a cloud service provider CSP. For example, multiple applications including network functions representing a cellular network may be implemented using tenant containers. In some examples, the information generated by the tenant container (also referred to as data, data packets, etc.) may include, but is not limited to, metadata, general logs, sensitive / valuable information, etc. In addition, the tenant container may include different functions supplied on a set of computing resources. In some examples, the computing resources may include physical computing resources, or virtual computing resources, such as virtualized computing resources in a data center or multiple data centers or a container cluster platform. The tenant container may send information to other tenant containers or a second computing device 104.

[0057] In addition, probes (also referred to as monitoring tools, visibility tools, observability tools, etc.) may be enabled within one or more processes executing on computing device 102 for collecting information related to tenant containers executing on computing device 102. Probes may be enabled from outside of the namespace of at least one tenant container to collect information. In some examples, the probes may be eBPF probes.

[0058] It may also be problematic for the owner / provider of the tenant container if the information floating / collected from the tenant container by the probe includes sensitive information such as personally identifiable information (PII) belonging to a vendor that has intellectual property rights (IPR) to the tenant container.

[0059] Therefore, the computing device 102 implements a method capable of efficiently protecting information related to a tenant container executed on the computing device 102. It should be noted that any one of the first computing devices 102a, 102b, and 102c (hereinafter referred to as 102) implements a method for protecting information related to a tenant container.

[0060] The computing device 102 is adapted to filter information collected by probes enabled within one or more processes executing on the computing device to protect the tenant container. Optionally, the computing device 102 is adapted to encrypt at least some of the filtered information.

[0061] Therefore, filtering of information related to the tenant container provides preferences on what information related to the tenant container can be extracted and filtered, which protects sensitive information of the tenant container by avoiding the spread of sensitive information and the risk of violating privacy laws and regulations.

[0062] Various examples for protecting information associated with tenant containers are explained in the following portion of the specification in conjunction with the accompanying drawings.

[0063] Figure 3 is a flow chart illustrating example method steps of a method 300 performed by a computing device to protect a tenant container.

[0064] At step 304 , method 300 includes filtering information collected by probes enabled within one or more processes executing on the computing device to protect the tenant container.

[0065] The step 304 of filtering the collected information may include extracting filtering rules to be applied on the collected information.

[0066] In some examples, the filtering rules to be applied on the collected information can be extracted / received from one or more of the following: a tenant container, a data source residing within the computing device (e.g., a local source), and an external data source in communication with the computing device. Figure 2The second computing device described in may be part of an external data source.

[0067] In extracting the filtering rule, the method may include obtaining attributes related to one or more of: a computing device, a tenant container, information (also referred to as data) related to the tenant container (i.e., information / data processed by the tenant container), and a probe. The method may include using the filtering rule and identifying at least a portion of the collected information to filter based on the obtained attributes.

[0068] In some examples, using the filtering rules and identifying at least a portion of the collected information to filter based on the obtained attributes is based on one or more of:

[0069] ● Tags defined for at least some of the information associated with the tenant container. In some examples, unique tags can be defined for at least some of the information associated with the tenant container by considering the information required for filtering in different situations / events;

[0070] ● Information related to the computing device. In some examples, the information related to the computing device may include, but is not limited to, an identification of the computing device, a geographic location of the computing device, and an identification of a provider of the computing device (i.e., an identification of an owner of the computing device);

[0071] ● At least one function implemented by the tenant container. In some examples, the at least one function corresponds to a Third Generation Partnership Project 3GPP function implemented by the tenant container;

[0072] ● Information related to one or more functions and / or libraries of the tenant container monitored by the probe. One or more functions and / or libraries of the tenant container are used to encrypt information related to the tenant container;

[0073] ●Probe identification (ID);

[0074] ● Recipients of monitored information sent using Transport Layer Security (TLS); and

[0075] - Parsing of protocol headers and / or data encoding schemes associated with information related to the tenant container to be protected. In some examples, the protocol headers and / or data encoding schemes may be associated with JavaScript Object Notation (JSON) present in the tenant container to be filtered.

[0076] Upon identifying at least a portion of the collected information to be filtered, the method may include filtering the identified information according to the filtering rules and attributes.

[0077] In some embodiments, the step of filtering the collected information according to the filtering rules and based on the attributes may include identifying the state of attributes of one or more of the following: the computing device, the probe enabled on the tenant container, at least one function of the tenant container being monitored by the probe, the tenant container, and information related to the tenant container (i.e., information / data processed by the tenant container).

[0078] In some examples, the state of the attribute of the computing device includes one or more of: an identification of the computing device, a geographic location of the computing device, and a provider identification of the computing device.

[0079] In some examples, the state of a property of a probe enabled on a tenant container includes one or more of: a provider identification associated with the probe, and one or more functions of the probe.

[0080] In some examples, the state of a property of at least one function of the tenant container being monitored by the probe includes one or more of: one or more functions and / or libraries belonging to the at least one function, a recipient of a message being sent from the at least one function, and a service-based architecture (SBA) service associated with the at least one function.

[0081] In some examples, when the tenant container includes 3GPP functions, the state of the attributes of the tenant container itself may be considered when filtering at least a portion of the information related to the tenant container. For example, the tenant container may include an access and mobility function AMF.

[0082] In some examples, the state of the attribute of the information related to the tenant container includes one or more of the following associated with the information related to the tenant container: one or more tags (e.g., <8> ,<!--8--> etc.), protocol specific fields, byte sequences, and data patterns.

[0083] When identifying the state of the property, the method may include evaluating a filtering rule for the identified state of the property. Based on the evaluation, the method may include activating at least one filtering rule. In addition, the method may include filtering at least some of the collected information of the tenant container according to the activated at least one filtering rule.

[0084] In some examples, the computing device extracts a filtering rule that states that information tagged with a tag (e.g., a PII tag) must be filtered if the computing device's geographic location is non-EU (note that any other country or group of countries with common regulations may also be considered), and that filtering is not required if the computing device's geographic location is EU. In such a scenario, the computing device identifies whether the computing device's geographic location is non-EU based on the state of the computing device's attribute. When the computing device's geographic location has been identified as non-EU, the computing device filters information associated with the tenant container tagged with the PII tag.

[0085] In some examples, the computing device extracts a filtering rule that states that for a probe associated with an identity (e.g., actor A), information related to a tenant container tagged with a PII tag must be filtered, and for a probe associated with an identity (e.g., actor B), filtering is not required. In such a scenario, the computing device identifies whether the information of the tenant container collected by the probe has the identity actor A based on the state of the attribute of the computing device. When it has been identified that the information of the tenant container collected by the probe has the identity actor A, the computing device filters the information related to the tenant container tagged with the PII tag.

[0086] In some examples, the computing device extracts a filtering rule from a data source residing in the computing device, the filtering rule stating: process unencrypted SBA packets probed by actor A (i.e., the identification of the probe) present in information related to the tenant container. In such a scenario, the computing device filters out sensitive information associated with the SBA packets collected by actor A by identifying sensitive 3GPP identifiers. The sensitive 3GPP identifiers can be identified by analyzing the Hypertext Transfer Protocol HTTP header and JSON data constructed according to 3GPP specifications (e.g., 3GPP TS29.500). In some examples, filtering out sensitive information associated with the SBA packets can correspond to filtering out the Subscriber Permanent Identifier SUPI from the User Equipment UE authentication response. Therefore, filtering of information related to the tenant container helps maintain the privacy of the telecommunication system / cellular system, which helps actor A become more competitive because their potential customers can feel assured that no PII leaves the telecommunication system.

[0087] Therefore, the tenant container may be efficiently protected by filtering at least some of the collected information of the tenant container according to the activated at least one filtering rule.

[0088] When filtering the information, method 300 includes, at step 306 , encrypting at least some of the filtered information.

[0089] In some examples, step 306 of encrypting at least some of the filtered information collected by the probe may include extracting multiple encryption key materials from one or more of the following: a tenant container, a data source residing within the computing device, and an external data source in communication with the computing device. In addition, the method may include generating multiple encryption keys based on the extraction of the multiple encryption key materials. In some examples, the generated encryption key may be an asymmetric key or any other key. An asymmetric key includes a public key and a private key, whereby an authenticated recipient can decrypt the information.

[0090] When generating a plurality of encryption keys, the method may include evaluating the filtering rule for a state of a property of at least one of: a computing device, a probe enabled in the tenant container, at least one function of the tenant container being monitored by the probe enabled on the tenant container, the tenant container, and information related to the tenant container. Based on the evaluation, the method may include selecting an encryption key from the plurality of encryption keys. The method may include encrypting at least some of the filtered information related to the tenant container using the selected encryption key.

[0091] Therefore, the filtered information can be efficiently encrypted according to the filtering rules and based on the current state of the properties of the computing device and the probe.

[0092] Figure 4 Example implementations for protecting information related to tenant containers are disclosed.

[0093] like Figure 4 As depicted, a cloud service provider CSP may allow containers belonging to a tenant (ie, tenant container 25 ) to be hosted and executed in any computing device or electronic device (such as computing device 102 ).

[0094] The computing device 102 executes the tenant container 25 to implement one or more applications including, for example, network functions representing a cellular network. The tenant container can be implemented at the application level. When executed on the computing device 102, the tenant container 25 can generate information such as, but not limited to, metadata, general logs, sensitive / valuable information, etc. In some examples herein, the tenant container 25 includes filtering rules to be applied on information related to the tenant container 25.

[0095] The tenant container 25 may be instantiated within the kernel 20 of the operating system OS. The tenant container 25 virtualizes an instance of an application. The tenant container 25 does not include a kernel. The use of (one or more) tenant containers 25 enables multiple applications to be executed using the same computing resources of the computing device 102. In some examples, the computing resources may include the underlying hardware 15. The underlying hardware 15 includes a central processing unit CPU 10, a memory 12, and a driver 14.

[0096] The computing device 102 also includes an analyzer 50 at the application level. The analyzer 50 may be adapted to execute one or more processes on the computing device 102 to enable the probe 40 to collect information related to the tenant container 25. In some examples, the probe 40 may be an eBPF probe and is invoked from outside the namespace of the tenant container 25. The information collected by the probe 40 may typically be the information before it is encrypted for transmission via a protocol such as Transport Layer Security TLS, or when the information is received and decrypted after encrypted transmission.

[0097] The computing device 102 implements an information filter 402 for filtering information related to the tenant container 25 .

[0098] In some examples, information filter 402 may be implemented as part of or in conjunction with analyzer 50. In some examples, information filter 402 may be implemented directly or in conjunction with kernel / eBPF probe 40. In such a scenario, computing device 102 must keep track of which tenant container the filter rule must be obtained from for each portion of information obtained.

[0099] The information filter 402 is adapted to filter information collected by the probe 40 enabled within one or more processes executing on the computing device 102 to protect the tenant container 25 .

[0100] To filter the collected information, information filter 402 extracts filtering rules to be applied on the collected information. Information filter 402 may extract filtering rules from tenant container 25, data resources (not shown) residing within computing device 102, and external data sources in communication with computing device 102.

[0101] When obtaining the filtering rules, the information filter 402 obtains attributes related to the computing device 102 and / or the tenant container 25 and / or the probe 40. Using the filtering rules and based on the obtained attributes, the information filter 402 identifies at least a portion of the collected information to be filtered. In some examples, the information filter 402 identifies at least a portion of the collected information to be filtered based on one or more parameters. The parameters can be static or dynamic. Some examples of parameters may include, but are not limited to, tags defined for at least some of the information related to the tenant container, information related to the computing device, at least one function implemented by the tenant container, information related to one or more functions and / or libraries of the tenant container monitored by the probe 40, an ID of the probe 40, a recipient of the monitored information sent using TLS, and a protocol header and / or data encoding scheme associated with the information related to the tenant container to be protected.

[0102] After identifying at least a portion of the collected information to be filtered, information filter 402 filters the identified information according to filtering rules and attributes.

[0103] To filter the identified information according to the filtering rules and the properties, the information filter 402 identifies the state of the properties of one or more of the following: the computing device 102, the probe enabled on the tenant container 25, at least one function of the tenant container 25 monitored by the probe, the tenant container 25, and the information related to the tenant container 25. The information filter 402 evaluates the filtering rules for the identified property states and activates at least one filtering rule accordingly. The information filter 402 is adapted to filter at least some of the collected information related to the tenant container 25 according to the activated at least one filtering rule.

[0104] The information filter 402 may also be adapted to encrypt at least some of the filtered information. To encrypt the filtered information, the information filter 402 extracts a plurality of encryption key materials from one or more of the following: the tenant container 25, a data source residing within the computing device 102, and an external data source in communication with the computing device 102.

[0105] When extracting the encryption key material, the information filter 402 generates a plurality of encryption keys based on the extraction of the plurality of encryption key materials. The information filter 402 evaluates the filtering rules for the computing device 102, the probe 40 enabled on the tenant container 25, at least one function of the tenant container 25 being monitored by the probe 40 enabled on the tenant container 25, the state of the tenant container 25, and the properties of the information related to the tenant container 25. Based on the evaluation, the filter 402 selects an encryption key from the plurality of encryption keys. The information filter 402 encrypts at least some of the information related to the tenant container 25 using the selected encryption key.

[0106] In some examples, information filter 402 may also be adapted to delete filtered information related to tenant container 25 .

[0107] Figure 5 is an example schematic block diagram illustrating functional modules of information filter 402 implemented on computing device 102. In some examples, information filter 402 may be implemented as part of or attached to analyzer 50 resident in computing device 102. It should be noted that information filter 402 may be implemented in other ways including those described above.

[0108] like Figure 5 As shown, information filter 402 may include one or more modules configured to cooperate with each other to protect information related to a tenant container. For example, information filter 402 may include filtering module 504 and encryption module 506.

[0109] The filtering module 504 can be adapted to filter information collected by probes enabled within one or more processes executing on the computing device to protect the tenant container. In some examples, the filtering module 504 filters the collected information according to filtering rules and based on the state of an attribute of one or more of the following: the computing device 102, the tenant container, the information / data processed by the tenant container, and the probe. Figure 3 and Figure 4 The filtering of information is described in detail, so a repeated description is omitted here.

[0110] The encryption module 506 can be adapted to encrypt at least some of the filtered information. In some embodiments, the encryption module 506 encrypts at least some of the filtered information according to the filtering rules and based on the state of an attribute of one or more of the following: the computing device, the tenant container, the information / data processed by the tenant container, and the probe. Figure 3 and Figure 4 At least some of the encrypted filtered information is described in detail, so a repeated description is omitted here.

[0111] The communication module 508 may be adapted to send the filtered information to an analyzer (eg, Figure 4 for further processing.

[0112] Figure 6 is a flow chart illustrating example method steps performed by a computing device for filtering information related to a tenant container.

[0113] In step 601, a computing device identifies an analyzer (eg, Figure 4 ) is initiated for analyzing information, for example, in order to detect any suspicious behavior. In step 602, filter rules may be initialized.

[0114] In step 603a, the computing device detects whether the filtering rules must be extracted / obtained from the tenant container. When it has been detected that the filtering rules must be extracted from the tenant container, in step 603b, the computing device obtains the filtering rules from the tenant container.

[0115] When it has been detected that it is not necessary to extract the filtering rules from the tenant container (or the filtering rules have been extracted), in step 604a, the computing device detects whether the filtering rules must be extracted from an external data source / remote data source / external source in communication with the computing device. When it has been detected that the filtering rules must be extracted from the external data source, in step 604b, the computing device extracts the filtering rules from the external data source.

[0116] When it has been detected that it is not necessary to extract the filter rules from the external data source (or the filter rules have been extracted), in step 605a, the computing device detects whether the filter rules must be extracted from the data source residing in the computing device (i.e., the local source). When it has been detected that the filter rules must be extracted from the local source, in step 605c, the computing device extracts the filter rules from the local data source.

[0117] When it has been detected that it is not necessary to extract the filtering rule, the computing device evaluates the filtering rule against the state of the property at step 606. In some examples, the state of the property can be a state of the property of the computing device, a probe enabled on the tenant container, at least one function of the tenant container being monitored by the probe, the tenant container, and information related to the tenant container (i.e., information / data processed by the tenant container).

[0118] Based on the evaluation, at step 607, the computing device activates at least one filtering rule. At step 608, the computing device filters the collected information related to the tenant container according to the at least one filtering rule. In some examples, the filtered information may include at least a portion of the information related to the tenant container identified as filtered based on one or more parameters, the one or more parameters may include, but are not limited to, tags defined for at least some of the information related to the tenant container, information related to the computing device, at least one function implemented by the tenant container, information related to one or more functions and / or libraries of the tenant container monitored by the probe, an ID of the probe 40, a recipient of the monitored information sent using TLS, and parsing of protocol headers and / or data encoding schemes associated with the information related to the tenant container to be protected.

[0119] Thus, at least some of the information related to the tenant container (eg, sensitive information) is filtered / removed before further processing by the probe.

[0120] Figure 7 is a flow chart illustrating example method steps performed by a computing device for securely extracting information from a tenant container.

[0121] At step 701, the computing device begins executing a tenant container. At step 702, the computing device initializes / extracts filtering rules to be applied on information associated with the tenant container.

[0122] In step 703, the computing device identifies whether the tenant container indicates that the collected / detected information needs to be filtered. In some examples, the computing device checks the filtering rules for the tenant container to identify whether the collected / detected information needs to be filtered.

[0123] When it has been identified that filtering is not required, at step 704 , the computing device enables extraction of information associated with the tenant container without using filtering rules.

[0124] When a need to filter the collected / detected information has been identified, the computing device adapts the filtering rules at step 705. At step 706, the computing device enables extraction of information related to the tenant container according to the adapted filtering rules.

[0125] Figure 8 is a signaling diagram illustrating example signaling for protecting a tenant container. Figure 8 As depicted, the computing device includes an information filter 402 for protecting information associated with the tenant container 25 .

[0126] The tenant container 25 starts with a predefined profile including filter rules ( 1 ) that indicates what information can be extracted from the tenant container 25 .

[0127] The analyzer 50 residing on the computing device decides (2) to extract information from the tenant container executing / running on the computing device using a probe having an information filter 402 .

[0128] The information filter 402 extracts / obtains (3) the filtering rules from the tenant container 25. In addition, the information filter 402 communicates (4) with one or more external sources to obtain additional filtering rules. In addition, the information filter 402 communicates (5) with one or more local sources / data sources residing in the computing device to obtain additional filtering rules.

[0129] When obtaining the filtering rules, the information filter 402 compares the attribute states of the computing device, the tenant container, and the probe with the obtained filtering rules (6). The information filter 402 configures the obtained filtering rules accordingly.

[0130] Based on the comparison, the information filter 402 activates (7) at least one filtering rule. Thereafter, the information filter 402 filters / removes (8) information related to the tenant container 25 according to the activated at least one filtering rule, and sends the filtered information to the analyzer 50 for further processing (e.g., to another container, etc.).

[0131] Fig. 9 The diagram shows how to implement Figure 3 An example computing environment 900 of the methods and computing devices described herein. Fig. 9 As depicted, the computing environment 900 includes at least one data processing module 906 equipped with a control module 902 and an arithmetic logic unit (ALU) 904, a plurality of networking devices 914, and a plurality of input and output I / O devices 912, a memory 908, and a storage device 910. The data processing module 906 may be responsible for implementing Figure 3For example, in some embodiments, the data processing module 906 may be equivalent to the above combined Figure 4 The data processing module 906 is capable of executing software instructions stored in the memory 908. The data processing module 906 receives commands from the control module 902 in order to perform its processing. In addition, with the help of the ALU 904, any logical and arithmetic operations involved in the execution of the instructions are calculated.

[0132] The computer program may be loaded into a data processing module 906, which may be included in an electronic device such as a computing device, for example. When loaded into the data processing module 906, the computer program may be stored in a memory 908 associated with or included in the data processing module 906. According to some embodiments, when the computer program is loaded into and executed by the data processing module 906, the computer program may cause the data to be processed according to, for example, Figure 3 The performance of any of the method steps illustrated in or otherwise described herein.

[0133] The overall computing environment 900 may be composed of multiple homogeneous and / or heterogeneous cores, multiple CPUs of different types, special media and other accelerators. In addition, multiple data processing modules 906 may be located on a single chip or on multiple chips.

[0134] The algorithm consisting of instructions and codes required for implementation is stored in the memory 908 or the storage device 910 or both. When executing, the instructions can be obtained from the corresponding memory 908 and / or storage device 910 and executed by the data processing module 906.

[0135] In the case of any hardware implementation, various networking devices 914 or external I / O devices 912 may be connected to the computing environment to support the implementation via the networking devices 914 and I / O devices 912 .

[0136] Any appropriate steps, methods, features, functions or benefits disclosed herein may be performed by one or more functional units or modules of one or more virtual devices. Each virtual device may include a plurality of these functional units. These functional units may be implemented via a processing circuit, which may include one or more microprocessors or microcontrollers, and other digital hardware, which may include a digital signal processor DSP, dedicated digital logic, etc. The processing circuit may be configured to execute program codes stored in a memory, which may include one or more types of memory, such as a read-only memory (ROM), a random access memory RAM, a cache memory, a flash memory device, an optical storage device, etc. The program code stored in the memory includes program instructions for executing one or more telecommunications and / or data communication protocols and instructions for executing one or more of the techniques described herein. In some implementations, the processing circuit may be used to cause the corresponding functional unit to perform the corresponding functions according to one or more embodiments of the present disclosure.

[0137] The foregoing description of specific embodiments will fully reveal the general nature of the embodiments herein so that others can easily modify and / or adapt various applications of such specific embodiments by applying current knowledge without departing from the general concepts, and therefore, these adaptations and modifications should and are intended to be included in the meaning and scope of equivalents of the disclosed embodiments. It will be understood that the wording or terminology used herein is for descriptive purposes and not for limitation. Therefore, although the embodiments herein have been described in terms of preferred embodiments, those skilled in the art will recognize that the embodiments herein can be practiced by modification within the scope of the present disclosure.

[0138] The embodiments disclosed herein may be implemented by at least one software program running on at least one hardware device and performing network management functions to control the elements. Fig. 9 The elements shown in include blocks that may be at least one of a hardware device or a combination of a hardware device and a software module.

Claims

1. A method (300) for protecting a tenant container (25) executed by a computing device (102), the method (300) being executed by the computing device (102), the method (300) comprising: - filtering (304) information collected by a probe (40) enabled within one or more processes executing on the computing device (102) to protect the tenant container (25).

2. The method (300) of claim 1, further comprising: - Encrypting (306) at least some of the filtered information.

3. The method (300) according to any one of the preceding claims, wherein: The step (304) of filtering the collected information includes: - extracting filtering rules to be applied on said collected information; - obtaining properties associated with one or more of: the computing device (102), the tenant container (25), information associated with the tenant container (25), and the probe (40); - identifying at least a portion of the collected information to be filtered using the filtering rules and based on the obtained attributes; and - filtering the identified information according to the filtering rules and the attributes.

4. The method (300) according to any one of the preceding claims, wherein: The step of extracting the filtering rules comprises receiving the filtering rules from one or more of: - said tenant container (25); - a data source residing within said computing device (102); and - An external data source in communication with said computing device (102).

5. The method (300) according to any one of the preceding claims, wherein: The step of using the filtering rules and identifying at least a portion of the collected information based on the obtained attributes is based on one or more of the following: - tags defined for at least some information related to said tenant container (25); - information related to the computing device (102); - at least one function implemented by the tenant container (25); - information related to one or more functions and / or libraries of the tenant container (25) monitored by the probe (40); - an identification ID of the probe (40); - the recipients of the monitored information sent using Transport Layer Security TLS; as well as - Parsing of protocol headers and / or data encoding schemes associated with information related to said tenant container (25) to be protected.

6. The method (300) according to any one of the preceding claims, wherein: The step of filtering the collected information according to the filtering rule and based on the attribute comprises: - identifying a state of a property of one or more of: the computing device (102), the probe enabled on the tenant container (25), at least one function of the tenant container (25) being monitored by the probe, the tenant container (25), and information related to the tenant container (25); - evaluating said filter rules with respect to the status of the identified attributes; - activating at least one filtering rule based on the evaluation; and - filtering at least some of the collected information of the tenant container (25) according to the activated at least one filtering rule.

7. The method (300) of claim 6, wherein: The state of the attribute of the computing device (102) includes one or more of the following: - an identification of the computing device (102); - the geographic location of the computing device (102); and - a provider identification of the computing device (102).

8. The method (300) according to any one of claims 6 or 7, wherein: The status of the properties of the probe (40) enabled on the tenant container (25) includes one or more of the following: - a provider identification associated with said probe (40); and - one or more functions of the probe (40).

9. The method (300) according to any one of claims 6 to 8, wherein: The state of the attribute of the at least one function of the tenant container being monitored by the probe (40) includes one or more of the following: - one or more functions and / or libraries being monitored by the probe (40); - the functionality to which the monitored function or functions and / or libraries belong; - a recipient of a message being sent from said at least one function; as well as - A Service Based Architecture (SBA) service associated with said at least one function.

10. The method (300) according to any one of claims 6 to 9, wherein: The state of the attribute of the information related to the tenant container (25) includes one or more of the following associated with the information related to the tenant container (25): one or more tags, protocol specific fields, byte sequences, and data patterns.

11. The method (300) according to any one of the preceding claims, wherein: The step (306) of encrypting at least some of the filtered information collected by the probe (40) comprises: - extracting a plurality of cryptographic key materials from one or more of: the tenant container (25), a data source residing within the computing device (102), and an external data source in communication with the computing device (102); - generating a plurality of encryption keys based on the extraction of the plurality of encryption key materials; - evaluating the filtering rule with respect to a state of a property of at least one of: the computing device (102), the probe (40) enabled on the tenant container (25), at least one function of the tenant container (25) being monitored by the probe (40) enabled on the tenant container (25), the tenant container (25), and information related to the tenant container (25); - based on the evaluation, selecting an encryption key from the plurality of encryption keys; and - encrypting at least some of said filtered information related to said tenant container (25) using said selected encryption key.

12. A computing device (102) for protecting a tenant container (25), the computing device (102) being adapted to: - filtering (304) information collected by a probe (40) enabled within one or more processes executing on the computing device (102) to protect the tenant container (25).

13. The computing device (102) of claim 12, wherein: The computing device (102) is further adapted to: - Encrypting at least some of the filtered information.

14. The computing device (102) according to any one of claims 12-13, wherein: The computing device (102) is adapted to filter the collected information to protect the tenant container (25) by performing the following operations: - extracting filtering rules to be applied on said collected information; - obtaining properties associated with one or more of: the computing device (102), the tenant container (25), information associated with the tenant container (25), and the probe (40); - identifying at least a portion of the collected information to be filtered using the filtering rules and based on the obtained attributes; as well as - filtering the identified information according to the filtering rules and the attributes.

15. The computing device (102) according to any one of claims 12 to 14, wherein: The computing device (102) is adapted to extract the filter rule by receiving the filter rule from one or more of: - said tenant container (25); - a data source residing within said computing device (102); and - An external data source in communication with said computing device (102).

16. The computing device (102) according to any one of claims 12 to 15, wherein: The computing device (102) is adapted to use the filtering rules and based on the obtained attributes to identify at least a portion of the collected information by one or more of: - tags defined for at least some information related to said tenant container (25); - information related to the computing device (102); - at least one function implemented by the tenant container (25); - information related to one or more functions and / or libraries of the tenant container (25) monitored by the probe (40); - an identification ID of the probe (40); - the recipients of the monitored information sent using Transport Layer Security TLS; as well as - Parsing of protocol headers and / or data encoding schemes associated with information related to said tenant container (25) to be protected.

17. The computing device (102) according to any one of claims 12 to 16, wherein: The computing device (102) is adapted to filter the collected information according to the filtering rule and based on the attribute by performing the following operations: - identifying a state of a property of one or more of: the computing device (102), the probe (40) enabled on the tenant container (25), at least one function of the tenant container (25) being monitored by the probe (40), the tenant container (25), and information related to the tenant container (25); - evaluating said filter rules with respect to the status of the identified attributes; - activating at least one filtering rule based on the evaluation; and - filtering at least some of the collected information of the tenant container (25) according to the activated at least one filtering rule.

18. The computing device (102) of claim 17, wherein: The state of the attribute of the computing device (102) includes one or more of the following: - an identification of the computing device (102); - the geographic location of the computing device (102); and - a provider identification of the computing device (102).

19. The computing device (102) according to any one of claims 17 or 18, wherein: The status of the properties of the probe (40) enabled on the tenant container (25) includes one or more of the following: - a provider identification associated with said probe (40); and - one or more functions of the probe (40).

20. The computing device (102) of any one of claims 17-19, wherein: The computing device (102) is adapted to monitor a state of a property of the at least one function of the tenant container (25), the state of the property of the at least one function of the tenant container (25) being determined by one or more of: - one or more functions and / or libraries being monitored by the probe (40); - the functionality to which the monitored function or functions and / or libraries belong; - a recipient of a message being sent from said at least one function; as well as - A Service Based Architecture (SBA) service associated with said at least one function.

21. The computing device (102) of any one of claims 17-20, wherein: The state of the attribute of the information related to the tenant container (25) includes one or more of the following associated with the information related to the tenant container (25): one or more tags, protocol specific fields, byte sequences, and data patterns.

22. The computing device (102) of any one of claims 12-21, wherein: The computing device (102) is adapted to encrypt at least some of the filtered information collected by the probe (40) by: - extracting a plurality of cryptographic key materials from one or more of: the tenant container (25), a data source residing within the computing device (102), and an external data source in communication with the computing device (102); - generating a plurality of encryption keys based on the extraction of the plurality of encryption key materials; - evaluating the filtering rule with respect to a state of a property of at least one of: the computing device (102), the probe (40) enabled on the tenant container (25), at least one function of the tenant container (25) being monitored by the probe (40) enabled on the tenant container (25), the tenant container (25), and information related to the tenant container (25); - based on the evaluation, selecting an encryption key from the plurality of encryption keys; as well as - encrypting at least some of said filtered information related to said tenant container (25) using said selected encryption key.

23. A computer program product comprising a non-transitory computer-readable medium, on which there is a computer program comprising program instructions, the computer program being loadable into a data processing unit and being configured to cause the execution of the method according to any one of claims 1 to 11 when the computer program is run by the data processing unit.

Images