Computer-implemented method, computer system, and computer program (providing an isolation container for processing user requests)

Abstract

To provide a computer implementation method, a computer system, and a computer program capable of providing isolation of a client's privilege-separated connection when processing a user request received from a local user device, a remote user device, or a combination thereof.SOLUTION: In a cloud computing node, a computer system executes an operation of receiving a connection request from a first user device, an operation of creating an authentication container for the first user device, an operation of authenticating the first user device using the authentication container, an operation of creating a first user request processing container for the first user device in response to successful authentication of the first user device, and an operation of processing the user request received from the first user device by using the first user request processing container.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present invention relates generally to user request processing, and more particularly to providing client privilege separation connection isolation when processing user requests received from local or remote user devices, or a combination thereof. [Background technology]

[0002] Currently, more and more services are provided by network servers. Service users can access services through different types of network connections between user devices and network servers. User requests can be sent from user devices and received by network servers. The network servers can process the user requests and provide responses to the user devices. Summary of the Invention [Problem to be solved by the invention]

[0003] Security vulnerabilities in unprivileged child processes can have potential security impacts on services hosted on network servers, such as privilege escalation, sensitive information acquisition, infinite loops, and CPU consumption. [Means for solving the problem]

[0004] According to an aspect of the present invention, there is provided a computer-implemented method, computer program product, or system, or combination thereof, that performs the following operations (not necessarily in the following order): receiving a connection request from a first user device; generating an authentication container for the first user device; authenticating the first user device using the authentication container; in response to successful authentication of the first user device, generating a first user request processing container for the first user device; and processing a user request received from the first user device using the first user request processing container. [Brief explanation of the drawings]

[0005] The above and other objects, features, and advantages of the present disclosure will become more apparent through a more detailed description of several embodiments of the present disclosure in the accompanying drawings. In the embodiments of the present disclosure, like references generally refer to like components.

[0006] [Figure 1] FIG. 2 illustrates a cloud computing node according to an embodiment of the present invention.

[0007] [Figure 2] FIG. 1 illustrates a cloud computing environment according to one embodiment of the present invention.

[0008] [Figure 3] FIG. 2 illustrates abstraction model layers according to one embodiment of the present invention.

[0009] [Figure 4] 1 is a schematic diagram of a network environment for processing user requests, according to one embodiment of the present invention;

[0010] [Figure 5] 4 is a flowchart of an exemplary method for user request processing implemented by a server, according to one embodiment of the present invention.

[0011] [Figure 6] 4 is another flowchart of an exemplary method for user request processing according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0012] Certain embodiments of the present disclosure will be described in more detail with reference to the accompanying drawings, in which embodiments of the present disclosure are shown. However, the present disclosure may be implemented in various ways and therefore should not be construed as limited to the embodiments disclosed herein.

[0013] Although this disclosure includes detailed descriptions of cloud computing, it is understood that implementation of the teachings described herein is not limited to cloud computing environments. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0014] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with the provider of the service. The cloud model can have at least five characteristics, at least three service models, and at least four deployment models.

[0015] The characteristics are as follows:

[0016] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically, as needed, without the need for human interaction with the service provider.

[0017] Wide network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (eg, mobile phones, laptops, and PDAs).

[0018] Resource Pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated according to demand. Consumers typically have no control or knowledge of the exact location of the resources provided, although there is a sense of location independence in that they may be able to specify a location at a higher level of abstraction (e.g., country, state, or data center).

[0019] Rapid Elasticity: Capacity can be quickly and elastically provisioned, in some cases automatically, to quickly scale out, and quickly released to quickly scale in. To the consumer, the capacity available for provisioning often appears unlimited, and any amount can be purchased at any time.

[0020] Metered Services: Cloud systems automatically control and optimize resource usage using metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being used.

[0021] The service model is as follows:

[0022] Software as a Service (SaaS): The consumer is offered the ability to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through a thin-client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0023] Platform as a Service (PaaS): The ability offered to consumers is to deploy consumer-generated or ingested applications, created using programming languages and tools supported by the provider, on a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and possibly the application hosting environment configuration.

[0024] Infrastructure as a Service (IaaS): The ability offered to consumers is to provision processing, storage, network, and other underlying computing resources. Consumers can deploy and run any software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but do have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0025] The deployment model is as follows:

[0026] Private Cloud: Cloud infrastructure is run exclusively for an organization. It may be managed by that organization or a third party and may reside on-premise or off-premise.

[0027] Community Cloud: Cloud infrastructure is shared by multiple organizations to support a specific community of shared interests (e.g., mission, security requirements, policies, and compliance considerations). The cloud infrastructure may be managed by the organizations or a third party and may reside on-premises or off-premises.

[0028] Public Cloud: Cloud infrastructure is made available to the general public or large industry groups and is owned by organizations that sell cloud services.

[0029] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain their own entities but are tied together by standardized or proprietary technologies that allow for data and application portability (e.g., cloud bursting to balance load between clouds).

[0030] Cloud computing environments are service-oriented and focus on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0031] 1, there is shown a schematic diagram of an example cloud computing node 10. Cloud computing node 10 is merely one example of a suitable cloud computing node and is not intended to suggest any limitation as to the scope of use or functionality of the inventive embodiments described herein. In any event, cloud computing node 10 is capable of implementing or performing any or a combination of the functions described above.

[0032] Cloud computing node 10 may include a computer system / server 12 or a portable electronic device, such as a communications device, that operates in numerous other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof, that may be suitable for use with computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0033] The computer system / server 12 may be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The computer system / server 12 may be practiced in a distributed cloud computing environment where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0034] 1, computer system / server 12 in cloud computing node 10 is shown in the form of a general-purpose computing device. Components of computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, a system memory 28, and a bus 18 coupling various system components, including system memory 28, to processor 16.

[0035] Bus 18 represents any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures, including, by way of example and not limitation, an Industry Standard Architecture (ISA) bus, a MicroChannel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0036] Computer system / server 12 typically includes a variety of computer system-readable media, which may be any available media that can be accessed by computer system / server 12, including both volatile and nonvolatile media, removable and non-removable media.

[0037] The system memory 28 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 30 or cache memory 32, or a combination thereof. The computer system / server 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium (not shown, typically referred to as a "hard drive"). Although not shown, a magnetic disk drive may be provided for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive may be provided for reading from or writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical medium. In such an example, each may be connected to the bus 18 by one or more data media interfaces. As further shown and described below, the memory 28 may include at least one program product including a set (e.g., at least one) of program modules configured to perform the functions of embodiments of the present invention.

[0038] By way of example and not limitation, a program / utility 40 including a set (at least one) of program modules 42 may be stored in memory 28, as well as an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may comprise an implementation of a network environment. The program modules 42 typically perform the functions or methods, or combinations thereof, of embodiments of the present invention described herein.

[0039] The computer system / server 12 may communicate with one or more external devices 14, such as a keyboard, pointing device, display 24, etc., one or more devices that allow a user to interact with the computer system / server 12, or any device (e.g., network card, modem, etc.) that allows the computer system / server 12 to communicate with one or more other computing devices, or a combination thereof. Such communication may occur via an input / output (I / O) interface 22. Furthermore, the computer system / server 12 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet), or a combination thereof, via a network adapter 20. As shown, the network adapter 20 communicates with other components of the computer system / server 12 via a bus 18. Although not shown, it should be understood that other hardware or software components, or combinations thereof, may be used with the computer system / server 12. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, data archive storage systems, or the like, or combinations thereof.

[0040] Referring now to FIG. 2, an exemplary cloud computing environment 50 is illustrated. As shown, the cloud computing environment 50 comprises one or more cloud computing nodes 10 that may communicate with local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or a combination thereof. The nodes 10 may also communicate with each other. The nodes 10 may be physically or virtually grouped (not shown) in one or more networks, such as the private, community, public, or hybrid clouds described above, or a combination thereof. This enables the cloud computing environment 50 to provide infrastructure, platform, or software, or a combination thereof, as a service without requiring cloud consumers to maintain resources on their local computing devices. The types of computing devices 54A-N illustrated in FIG. 2 are intended to be merely exemplary, and it will be understood that the computing nodes 10 and the cloud computing environment 50 may communicate with any type of computerized device over any type of network or network-addressable connection, or a combination thereof (e.g., using a web browser).

[0041] Referring now to Figure 3, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 2) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 3 are intended to be merely exemplary, and that embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0042] Hardware and software layer 60 comprises hardware and software components. Examples of hardware components include mainframe 61, RISC (reduced instruction set computer) architecture-based servers 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0043] The virtualization layer 70 provides an abstraction layer from which the following example virtual entities can be provided: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0044] In one example, management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources used to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection of data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 provides cloud computing resource allocation and management so that required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides advance provisioning and procurement of cloud computing resources in anticipation of future requirements according to SLAs.

[0045] The workload tier 90 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instruction delivery 93, data analysis processing 94, transaction processing 95, and user request processing 96.

[0046] In general, network servers may use unprivileged child processes to contain and limit the impact of programming errors. Bugs in unprivileged child processes do not result in a system compromise. For some, security vulnerabilities in unprivileged child processes may have potential security impacts on services hosted on the network server, such as privilege escalation, sensitive information acquisition, infinite loops, and CPU consumption.

[0047] However, by exploiting some Common Vulnerabilities and Exposures (CVEs), a network attacker can maliciously cause a denial of service by consuming the server's computing resources, maliciously escalate user permissions, or gain unauthorized access to the server.

[0048] According to aspects of the present disclosure, a system and method can be provided that protects server resources, for example, from security vulnerability attacks, by isolating privilege-separated client connections. In particular, the system and method can create an isolated container in response to a connection request and create a user process within the container. The system and method can also provide provisioning, allocation, and / or limitation of computing resources (e.g., I / O, volume, memory, CPU resources, etc.) for the container.

[0049] Referring now to FIG. 4 , an example of a network environment 400 according to an embodiment of the present disclosure is shown. As an example, user devices 401 / 402 can be connected to a server 411 through a data link. The user devices 401 / 402 can be any type of device (including physical or virtual devices) that can be used to send / receive data. The server 411 can be any type of device (including physical or virtual devices) that can be used to process user requests and provide network services. The server 411 can include multiple modules. These modules of the server 411 can be located in the same physical device or different physical devices associated with the server 411. Also, some modules can be located in devices external to the server 411 but accessible to the server 411. The data link between the user devices 401 / 402 and the server 411 can be direct or indirect. The data link can be a wired or wireless link that can be used for communication between devices, such as a local area network (LAN) link, a wide area network (WAN) link, an internet link, a cellular network link, or the like, or a combination thereof.

[0050] In some embodiments, server 411 may be a server that supports the OpenSSH protocol, the SSH protocol, or the like, or a combination thereof. Also, in some embodiments, server 411 may be an Apache web server. It should be understood that server 411 may also support other types of network protocols now known or developed in the future. In some embodiments, user device 401 / 402 may be a cloud computing node, such as cloud computing node 10 shown in FIG. 1 or FIG. 2, or a combination thereof.

[0051] According to aspects of the present disclosure, in some embodiments, the user device 401 can send a connection request to the server 411. As an example, the connection request can be a message or a data packet. The connection request may include the Internet Protocol (IP) address or Media Access Control (MAC) address of the user device 401, or a combination thereof. Using the OpenSSH protocol as an example, the connection request can be a message that initiates SSH (Secure Shell) protocol negotiation and Crypto negotiation between the user device 401 and the server 411. For other types of protocols supported by the server 411 and the user device 401, the connection request can be a message that can initiate the following process to establish a connection between the server 411 and the user device 401:

[0052] In some embodiments, in response to receiving a connection request, server 411 can spawn authentication forwarding process 421 based, at least in part, on the received connection request. As an example, if server 411 determines that the received connection request should be processed in an unprivileged process, the spawned authentication forwarding process 421 can be an unprivileged process. For purposes of describing the principles of the present disclosure, authentication forwarding process 421 may also be referred to as a first forwarding process. In some other embodiments, after receiving a connection request, server 411 can spawn authentication forwarding process 421 as a privileged process. As an example, a system operation or system call (e.g., "fork") can be used to spawn authentication forwarding process 421 based on a process currently running on server 411. The process that initiates the system operation or system call (e.g., "fork") can be considered the parent process, and the newly spawned process can be its child process. In some other embodiments, system operation "spawn" can also be used to spawn authentication forwarding process 421. It should be understood that the above-described system operations are merely examples illustrating embodiments of the present disclosure, and that server 411 may use any other system operations or system calls, now known or hereafter developed, to generate authentication forwarding process 421.

[0053] According to aspects of the present disclosure, authentication container 451 may be generated, for example, by Docker engine 441 of server 411. It should be understood that the sequence of generating authentication forwarding process 421 and generating authentication container 451 may be optional. Server 411 may generate authentication forwarding process 421 before, in parallel with, or after generating authentication container 451.

[0054] In some embodiments, authentication container 451 can be dedicated to user device 401. Different authentication containers can be used to authenticate different user devices. For example, user device 402 can be authenticated using another authentication container different from authentication container 451.

[0055] The resource manager 431 of the server 411 can prepare computing resources to be allocated to the authentication container 451. Computing resources may include, but are not limited to, input / output (I / O), volumes (directories), processing units, memory, or the like, or a combination thereof. In some embodiments, the computing resources to be allocated to the authentication container 451 are pre-configured by an administrator of the server 411. In some embodiments, the computing resources to be allocated to the authentication container 451 can be determined based on characteristics of the user device 401 and / or other characteristics, such as available computing resources at the server 411, resource requests from other user devices, or the like, or a combination thereof. In some embodiments, the containers can be isolated from each other and have their own software, libraries, files, or the like, or a combination thereof.

[0056] In some other embodiments, authentication container 451 can be shared among one or more user devices (e.g., user devices 401 / 402). If an available authentication container is detected to exist in server 411 (e.g., an authentication container generated in server 411 for user device 402), the available authentication container can be retrieved and applied for user device 401. In this example, Docker engine 441's generation of authentication container 451 can include retrieving the available authentication container, and the retrieved available authentication is referred to as authentication container 451.

[0057] After the authentication container 451 is generated, an identifier associated with the authentication container 451 can be provided to the authentication forwarding process 421. As an example, the identifier of the authentication container 451 can be a port number, a universally unique identifier (UUID), a serial number, a tag, or the like, associated with the authentication container 451. It should be understood that other types of identifiers are also applicable in embodiments of the present invention. In some embodiments, the authentication container 451 can be mapped to a port number of the server 411, and the port number of the server 411 can also be used as the identifier of the authentication container 451. In that case, the authentication forwarding process 421 can use the identifier associated with the authentication container 451 to forward data retrieved from the authentication container to a device external to the server 411 and / or forward data received from a device external to the server 411 to the authentication container. In some embodiments, the authentication forwarding process 421 can be shared among different authentication containers, and the authentication forwarding process 421 can obtain the identifiers of the authentication containers generated for different user devices.

[0058] According to aspects of the present disclosure, the user device 401 can be authenticated using the authentication container 451. The authentication container 451 can provide an authentication request to the authentication forwarding process 421, which can then forward the authentication request to the user device 401. In one example, the authentication request can be obtained by the authentication forwarding process 421, which can map the authentication request with an identifier associated with the authentication container 451. The authentication request can be sent to the user device 401 to request the user device 401 to provide authentication material, such as an account and / or password for the user device 401, or the like, or a combination thereof.

[0059] The user device 401 can send an authentication response to the server 411, and the authentication response can be received using the authentication forwarding process 421. The authentication forwarding process 421 can map the received authentication response with an identifier associated with the authentication container 451. The authentication forwarding process 421 can then deliver the authentication response to the authentication container 451 based on the identifier of the authentication container 451 mapped to the received authentication response. In one example, the authentication forwarding process 421 can monitor the mapping between the port number of the server 411 and the authentication container 451, and then deliver the received authentication response to the authentication container 451 based on the port number of the server 411.

[0060] In some embodiments, the authentication container 451 can authenticate the user device 401 based on the received authentication response. If the authentication of the user device 401 is successful (e.g., the user device 401 provides a valid account or password or combination thereof), the user device 401 can be granted access to services provided by the server 411. If the authentication of the user device 401 fails, the user device 401 is not granted access to services.

[0061] According to aspects of the present disclosure, in response to successful authentication of the first user device, a user request processing container 461 can be spawned by the Docker engine 441 for the user device 401. A user request from the user device 401 can be processed in the user request processing container 461. As an example, the user request from the user device 401 may include a request sent from the user device 401 to access a service or a file provided by the server 411, or a combination thereof.

[0062] The resource manager 431 can prepare computing resources to be allocated to the user request processing container 461. Computing resources can include, but are not limited to, input / output (I / O), volumes (directories), processing units, memory, etc. In some embodiments, the computing resources to be allocated to the user request processing container 461 are pre-configured by an administrator of the server 411. In some embodiments, the computing resources to be allocated to the user request processing container 461 can be determined based on characteristics of the user device 401 and / or other characteristics, such as available computing resources at the server 411, resource requests from other user devices, or the like, or a combination thereof. As an example, a root and directory (such as / Home / User1 / .ssh / or the like) can be allocated to the user request processing container 461 for the user device 401.

[0063] In some embodiments, the server 411 can create the user request forwarding process 422 before, in parallel with, or after creating the user request processing container 461. When describing the principles of the present disclosure, the user request forwarding process 422 may also be referred to as a second forwarding process. As an example, a system operation or system call (such as "fork") can be used to create the user request forwarding process 422 based on a process currently running on the server 411. In some other embodiments, the system operation "spawn" can also be used to create the user request forwarding process 422. It should be understood that the above-described system operations are merely examples illustrating embodiments of the present invention, and that the server 411 can use any other system operation or system call, now known or hereafter developed, to create the user request forwarding process 422.

[0064] After the authentication container 461 is generated, an identifier associated with the user request processing container 461 can be provided to the user request forwarding process 422. As an example, the identifier of the user request processing container 461 can be a port number associated with the user request processing container 461, a universally unique identifier (UUID), a serial number, a tag, or the like, or a combination thereof. It should be understood that other types of identifiers are also applicable in embodiments of the present invention. In some embodiments, the user request processing container 461 can be mapped to a port number of the server 411, and the port number of the server 411 can also be used as the identifier of the user request processing container 461. In that case, the user request forwarding process 422 can use the identifier associated with the user request processing container 461 to forward data packets provided by the user request processing container 461 to the user device 401 and / or deliver data packets received from the user device 401 to the user request processing container 461. In some embodiments, the user request forwarding process 422 can be shared among different user request processing containers, and the user request forwarding process 422 can obtain the identifiers of the user request processing containers generated for different user devices.

[0065] In some embodiments, when the user device 401 requests access to a service or a file, or a combination thereof, provided by the server 411, the user request forwarding process 422 can be used to receive the user request from the user device 401. The user request forwarding process 422 can map the received user request with an identifier associated with the user request processing container 461. The user request forwarding process 422 can then deliver the user request to the user request processing container 461 based on the identifier associated with the user request processing container 461. In one example, the user request forwarding process 422 can monitor the mapping between the port number of the server 411 and the user request processing container 461, and then deliver the received user request to the user request processing container 461 based on the port number of the server 411. The user request can be processed in the user request processing container 461. The user device 401 can only access the services or files, or a combination thereof, included in the resources of the user request processing container 461, which are prepared by the resource manager 431.

[0066] The user request processing container 461 can process user requests received from the device 401 and provide a response to the user request to the user request forwarding process 422. In this example, the response can be obtained by the user request forwarding process 422. The user request forwarding process 422 can map the response with an identifier associated with the user request processing container 461. In some embodiments, a non-privileged process can be established within the user request processing container 461 to process the user request and provide the response. The user request forwarding process 422 can then forward the response provided by the user request processing container 461 to the user device 401.

[0067] According to an aspect of the present disclosure, the user request processing container 461 is dedicated to the user device 401, and a user request received from another user device (e.g., the user device 402) is processed in another user request processing container (such as the user request processing container 462) different from the user request processing container 461. As an example, if the user device 402 is authenticated as valid, the user request processing container 462 can be created for the user device 402 to process user requests from the user device 402. The user request processing containers 461 and 462 can have different roots and directories. As an example, a resource with restricted access assigned to the user request processing container 461 is not assigned to the user request processing container 462. For example, " / Home / User1 / .ssh / " can be set as accessible only by the user device 401, and " / Home / User2 / .ssh / " can be set as accessible only by the user device 402. As a result, user device 401 cannot access directories that are only permitted for user device 402 (e.g., " / Home / User2 / .ssh / "), and user device 402 cannot access directories that are only permitted for user device 401 (e.g., " / Home / User1 / .ssh / "). Therefore, even if a malicious user escalates their privileges, for example, through a security vulnerability, the host server and other connections and users are largely unaffected. Furthermore, even if a malicious user escalates to root, for example, through the use of some CVE, user device 401 can only access the root of user request processing container 461, not the root of server 411.

[0068] According to aspects of the present disclosure, the server 411 can create an isolated user request processing container 461 when privilege separation occurs, and then create a process or processes inside the user request processing container 461 and limit resources, such as I / O, volume, memory, CPU resources, or the like, or a combination thereof, allocated to the user request processing container 461. A connection can then be established between the user device 401 and the process inside the user request processing container 461. Thus, embodiments of the present disclosure can provide more effective protection of a network server, for example, from vulnerability attacks.

[0069] 5 illustrates a flowchart of operations 500 for processing a user request that may be implemented, for example, by a server (e.g., server 411 of FIG. 4 ), according to one embodiment of the present disclosure. It should be noted that operations 500 are exemplary for discussion purposes and are not intended to suggest any limitation on the scope of use or functionality of embodiments of the present invention.

[0070] Operations begin at block 510, where a server receives a connection request from a user device. Operations proceed to block 512, where, in response to receiving the connection request, the server may generate an authentication forwarding process based, at least in part, on the received connection request. Operations proceed to block 514, where the server may generate an authentication container for the user device. It should be understood that the described sequence of operations in blocks 512 and 514 may differ in some embodiments. In alternative embodiments, the server may generate the authentication forwarding process before, in parallel with, or after generating the authentication container. The authentication forwarding process may use an identifier associated with the authentication container to forward data from the authentication container to the user device and / or to forward data from the user device to the authentication container.

[0071] The generated authentication container can then be used to authenticate the user device. If authentication of the user device fails at block 516, the operations can terminate, the request from the user device can be rejected, and the user device is not allowed to access services and / or files provided by the server.

[0072] If authentication of the user device is successful at block 516, the operation proceeds to block 518, where the server may create a user request forwarding process for the user device. The operation proceeds to block 520, where the server may create a user request processing container for the user device. It should be understood that the described sequence of operations at blocks 518 and 520 can differ in some embodiments. In alternative embodiments, the server can create the user request forwarding process before, in parallel with, or after creating the user request processing container. In some embodiments, the user request processing container can be dedicated to the user device. In such embodiments, user requests received from another, different user device can be processed in a different user request processing container than the user request processing container created at block 520.

[0073] Operation proceeds to block 522, where the server may process user requests received from the user device using the created user request processing container. A user request forwarding process may use an identifier associated with the user request processing container to forward user requests received from the user device to the user request processing container and / or forward responses to the user requests provided by the user request processing container to the user device. In some embodiments, a non-privileged process may be established within the user request processing container to process user requests and provide responses.

[0074] If the user request from the user device is complete, the operation ends at block 524. If the user request from the user device is not complete at block 524, the operation may return to block 522 for further user requests to be processed.

[0075] 6 illustrates a flowchart of operations 600 for processing a user request according to one embodiment of the present disclosure. Operations 600 may be implemented, for example, by computer system / server 12 of FIG. 1, by server 411 of FIG. 4, or by another computing device provided in a network environment. It should be noted that operations 600 are merely exemplary and are not intended to suggest any limitation as to the scope of use or functionality of embodiments of the present invention.

[0076] The operations begin at block 610, where the computing system receives a connection request from a first user device. The operations proceed to block 612, where the computing system generates an authentication container for the first user device. The operations proceed to block 614, where the computing system may attempt to authenticate the first user device using the authentication container. In response to successful authentication of the first user device at block 614, the operations proceed to block 616, where the computing system may generate a first user request processing container for the first user device. The operations proceed to block 618, where the computing system may process a user request received from the first user device using the first user request processing container.

[0077] According to aspects of the present disclosure, in some embodiments, a first user request processing container that is generated can be dedicated to a first user device, and a user request received from a second user device can be processed in a second user request processing container that is different from the first user request processing container.

[0078] It should be noted that operations associated with processing user requests according to embodiments of the present disclosure may be implemented by computer system / server 12 of FIG.

[0079] The present invention may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail integration. The computer program product may include computer-readable storage medium(s) having computer-readable program instructions that cause a processor to perform aspects of the present invention.

[0080] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge-in-groove structures having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not, per se, to be construed as a transitory signal such as an electric wave or other propagable electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted over an electrical wire.

[0081] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions to a computer-readable storage medium within the respective computing / processing device for storage.

[0082] Computer-readable program instructions for carrying out operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages such as Smalltalk®, C++, or the like, and procedural programming languages such as the “C” programming language or similar. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry to perform aspects of the present invention.

[0083] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0084] These computer-readable program instructions may be provided to a computer processor or other programmable data processing apparatus to produce a machine, such that the instructions, when executed by the computer processor or other programmable data processing apparatus, generate means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and / or other device to function in a particular manner, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0085] The computer-readable program instructions may be loaded into a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to create a computer-implemented process, such that the instructions executing on the computer, other programmable apparatus, or other device implement the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0086] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions shown in the blocks may be performed out of the order shown in the figures. For example, two blocks shown in succession may actually be realized as a single step, or may be performed simultaneously, substantially simultaneously, partially, or fully overlapping in time, or the blocks may even be performed in the reverse order depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations or executes a combination of special-purpose hardware and computer instructions.

[0087] The description of various embodiments of the present invention is provided for illustrative purposes and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements over commercially available technologies, or to enable those skilled in the art to understand the embodiments disclosed herein. According to this specification, the following items are also disclosed. [Item 1] receiving a connection request from a first user device; generating an authentication container for the first user device; authenticating the first user device using the authentication container; generating a first user request processing container for the first user device in response to successful authentication of the first user device; processing a user request received from the first user device using the first user request processing container; A computer-implemented method comprising: [Item 2] Item 10. The computer-implemented method of item 1, wherein the first user request processing container is dedicated to the first user device. [Item 3] creating a first forwarding process; providing an identifier associated with the authentication container to the first forwarding process; 3. The computer-implemented method of claim 1 or 2, further comprising: [Item 4] authenticating the first user device using the authentication container, forwarding an authentication request provided by the authentication container to the first user device using the first forwarding process; receiving an authentication response from the first user device using the first forwarding process; providing the authentication response to the authentication container based on the identifier associated with the authentication container; Item 4. The computer-implemented method of item 3, further comprising: [Item 5] generating a second forwarding process; providing an identifier of the first user request processing container to the second forwarding process; 5. The computer-implemented method of any one of items 1 to 4, further comprising: [Item 6] The step of processing a user request received from the first user device using the first user request processing container includes: receiving the user request from the first user device using the second forwarding process; providing the user request to the first user request processing container based on the identifier associated with the first user request processing container; forwarding a response to the user request provided by the first user request processing container to the first user device using the second forwarding process; Item 6. The computer-implemented method of item 5, further comprising: [Item 7] Item 7. The computer-implemented method of item 6, wherein computing resources allocated to the first user request processing container are determined based on characteristics of the first user device. [Item 8] Item 8. The computer-implemented method of item 7, wherein the access-restricted resources allocated to the first user request processing container are not allocated to a second user request processing container created for a second user device. [Item 9] 9. The computer-implemented method of any one of items 6 to 8, wherein the response to the user request is provided in a non-privileged process within a user request processing container established to process the user request. [Item 10] 10. The computer-implemented method of any one of items 6 to 9, wherein the second forwarding process is a non-privileged process. [Item 11] one or more processors; a computer-readable memory coupled to the one or more processors, the computer-readable memory, when executed by the one or more processors, capable of: receiving a connection request from a first user device; generating an authentication container for the first user device; authenticating the first user device using the authentication container; generating a first user request processing container for the first user device in response to successful authentication of the first user device; processing a user request received from the first user device using the first user request processing container; a computer-readable memory containing instructions for performing the A computer system comprising: [Item 12] Item 12. The computer system of item 11, wherein the first user request processing container is dedicated to the first user device. [Item 13] The operation is an operation of generating a first forwarding process; providing an identifier associated with the authentication container to the first forwarding process; 13. The computer system according to item 11 or 12, further comprising: [Item 14] The act of authenticating the first user device using the authentication container includes: forwarding an authentication request provided by the authentication container to the first user device using the first forwarding process; receiving an authentication response from the first user device using the first forwarding process; providing the authentication response to the authentication container based on the identifier associated with the authentication container; Item 14. The computer system of item 13, further comprising: [Item 15] The operation is generating a second forwarding process; providing an identifier associated with the first user request processing container to the second forwarding process; 15. The computer system of any one of items 11 to 14, further comprising: [Item 16] The operation of processing a user request received from the first user device using the first user request processing container includes: receiving the user request from the first user device using the second forwarding process; providing the user request to the first user request processing container based on the identifier associated with the first user request processing container; providing a response to the user request provided by the first user request processing container to the first user device using the second forwarding process; Item 16. The computer system of item 15, further comprising: [Item 17] Item 17. The computer system of item 16, wherein the computing resources allocated to the first user request processing container are determined based on characteristics of the first user device. [Item 18] Item 18. The computer system of item 17, wherein the access-restricted resources allocated to the first user request processing container are not allocated to a second user request processing container created for a second user device. [Item 19] On the computer, receiving a connection request from a first user device; generating an authentication container for the first user device; authenticating the first user device using the authentication container; generating a first user request processing container for the first user device in response to successful authentication of the first user device; using the first user request processing container to process a user request received from the first user device; A computer program that executes [Item 20] 20. The computer program product of claim 19, wherein the first user request processing container is dedicated to the first user device.

Claims

1. receiving a connection request from a first user device; creating an authentication container dedicated to the first user device; authenticating the first user device using the authentication container; generating a first user request processing container for the first user device in response to successful authentication of the first user device; processing a user request received from the first user device using the first user request processing container; A computer-implemented method comprising:

2. receiving a connection request from a first user device; generating an authentication container for the first user device; authenticating the first user device using the authentication container; generating a first user request processing container for the first user device in response to successful authentication of the first user device; creating a second forwarding process; providing an identifier of the first user request processing container to the second forwarding process; processing a user request received from the first user device using the first user request processing container; receiving the user request from the first user device using the second forwarding process; providing the user request to the first user request processing container based on the identifier associated with the first user request processing container; forwarding a response to a user request provided by the first user request processing container to the first user device using the second forwarding process; and Equipped with the computing resources allocated to the first user request processing container are determined based on characteristics of the first user device; Computer-implemented methods.

3. The computer-implemented method of claim 1 or 2, wherein the first user request processing container is dedicated to the first user device.

4. creating a first forwarding process; providing an identifier associated with the authentication container to the first forwarding process; The computer-implemented method of claim 1 , further comprising:

5. authenticating the first user device using the authentication container, forwarding an authentication request provided by the authentication container to the first user device using the first forwarding process; receiving an authentication response from the first user device using the first forwarding process; providing the authentication response to the authentication container based on the identifier associated with the authentication container; The computer-implemented method of claim 4 further comprising:

6. creating a second forwarding process; providing an identifier of the first user request processing container to the second forwarding process; The computer-implemented method of claim 1 and any one of claims 3 to 5 without reciting claim 2, further comprising:

7. The step of processing a user request received from the first user device using the first user request processing container includes: receiving the user request from the first user device using the second forwarding process; providing the user request to the first user request processing container based on the identifier associated with the first user request processing container; forwarding a response to a user request provided by the first user request processing container to the first user device using the second forwarding process; The computer-implemented method of claim 6 further comprising:

8. The computer-implemented method of claim 7 , wherein computing resources allocated to the first user request processing container are determined based on characteristics of the first user device.

9. The computer-implemented method of claim 2 or 8, wherein the access-restricted resources allocated to the first user request processing container are not allocated to a second user request processing container created for a second user device.

10. 10. The computer-implemented method of claim 2, wherein the response to the user request is provided in a non-privileged process within a user request processing container established to process the user request.

11. The computer-implemented method of claim 2 and any one of claims 7 to 10, wherein the second forwarding process is a non-privileged process.

12. one or more processors; a computer-readable memory coupled to the one or more processors, the computer-readable memory, when executed by the one or more processors, capable of: receiving a connection request from a first user device; generating an authentication container dedicated to the first user device; authenticating the first user device using the authentication container; generating a first user request processing container for the first user device in response to successful authentication of the first user device; processing a user request received from the first user device using the first user request processing container; a computer-readable memory containing instructions for performing the A computer system comprising:

13. one or more processors; a computer-readable memory coupled to the one or more processors, the computer-readable memory, when executed by the one or more processors, capable of: receiving a connection request from a first user device; generating an authentication container for the first user device; authenticating the first user device using the authentication container; generating a first user request processing container for the first user device in response to successful authentication of the first user device; creating a second forwarding process; providing an identifier associated with the first user request processing container to the second forwarding process; and processing a user request received from the first user device using the first user request processing container, the operation comprising: receiving the user request from the first user device using the second forwarding process; providing the user request to the first user request processing container based on the identifier associated with the first user request processing container; providing a response to the user request provided by the first user request processing container to the first user device using the second forwarding process; and a computer-readable memory containing instructions for performing the Equipped with the computing resources allocated to the first user request processing container are determined based on characteristics of the first user device; Computer system.

14. 14. The computer system of claim 12 or 13, wherein the first user request processing container is dedicated to the first user device.

15. The operation is creating a first forwarding process; providing an identifier associated with the authentication container to the first forwarding process; 15. The computer system of claim 12, further comprising:

16. The act of authenticating the first user device using the authentication container includes: forwarding an authentication request provided by the authentication container to the first user device using the first forwarding process; receiving an authentication response from the first user device using the first forwarding process; providing the authentication response to the authentication container based on the identifier associated with the authentication container; 16. The computer system of claim 15, further comprising:

17. The operation is creating a second forwarding process; providing an identifier associated with the first user request processing container to the second forwarding process; The computer system according to any one of claims 14 to 16, without reciting claims 12 and 13, further comprising:

18. The operation of processing a user request received from the first user device using the first user request processing container includes: receiving the user request from the first user device using the second forwarding process; providing the user request to the first user request processing container based on the identifier associated with the first user request processing container; providing a response to the user request provided by the first user request processing container to the first user device using the second forwarding process; 20. The computer system of claim 17, further comprising:

19. 20. The computer system of claim 18, wherein computing resources allocated to the first user request processing container are determined based on characteristics of the first user device.

20. 20. The computer system of claim 13 or 19, wherein the access-restricted resources allocated to the first user request processing container are not allocated to a second user request processing container created for a second user device.

21. On the computer, receiving a connection request from a first user device; generating an authentication container dedicated to the first user device; authenticating the first user device using the authentication container; generating a first user request processing container for the first user device in response to successful authentication of the first user device; using the first user request processing container to process a user request received from the first user device; A computer program that executes

22. On the computer, receiving a connection request from a first user device; generating an authentication container for the first user device; authenticating the first user device using the authentication container; generating a first user request processing container for the first user device in response to successful authentication of the first user device; creating a second transfer process; providing an identifier of the first user request processing container to the second forwarding process; using the first user request processing container to process a user request received from the first user device, receiving the user request from the first user device using the second forwarding process; providing the user request to the first user request processing container based on the identifier associated with the first user request processing container; forwarding a response to the user request provided by the first user request processing container to the first user device using the second forwarding process; Including steps and Execute the computing resources allocated to the first user request processing container are determined based on characteristics of the first user device; Computer program.

23. 23. The computer program product of claim 21 or 22, wherein the first user request processing container is dedicated to the first user device.

Images