A method for adapting an access control level of an access control profile for a service and a profiling device configured to perform the method

Abstract

A method (200) for adapting an access control level of an access control profile for a service, S, associated with a container (100) on a host device, HD, (102) by using a profiling device, PD, (104) configured to run a profiling service is disclosed. The method (200) comprising: receiving (202), by the profiling device, PD, (104) a registration request (108) for the access control profile provided by the profiling service, wherein the registering (204) comprises: setting (208), a first access control level, P1, of the access control profile (110), the first access control level, P1, defining operational rules for the host device, HD, (102) for running the service, S. The method (200) further comprises running (212) the service, S, on the host device, HD, (102) and logging (214), by the access control profile (110) on the host device, HD, (102) audit data (116) pertaining to operational requests occurring during the running (212) of the service, S; and determining (220), by the profiling device, PD, (104) a second access control level, P2, based on the received audit data (116), wherein the second access control level, P2, is different from the first access control level, P1, in defining operational rules for the host device, HD, (102) for running the service, S.

Description

[0001] A method for adapting an access control level of an access control profile for a service and a profiling device configured to perform the method

[0002] Technical field

[0003] The present disclosure relates to a method for adapting an access control level of an access control profile for a service, a profiling device, a computer program product and a cloud environment. More specifically, the disclosure relates to a method for adapting an access control level of an access control profile for a service associated with a container, a profiling device, a computer program product and a cloud environment as defined in the introductory parts of the independent claims.

[0004] Background art

[0005] A container, also referred to as a container environment, is a light-weight operating system level virtualization technology. Containers are standalone, executable software packages that comprise code, system tools and settings allowing them to operate in isolation, i.e. isolated from each other and from the host system. In opposition to virtual machines, VM, containers do not embed their own kernel but run directly on a host kernel enabling the container to be light-weight. A first drawback of containers is that since the containers run directly on the host kernel they are not as secure as VMs. A second drawback of containers is that the light-weightiness of the containers, i.e., lack of isolation layers between the container and the host kernel, make them more vulnerable to kernel exploits and attacks on the shared host resources.

[0006] In more detail, VMs implement a layer called hypervisor to add an isolation between applications and the host. Containers, however, implement a high-level interface between guest and host, which hides complexity to a user at the cost of becoming more complex itself. The absence of hypervisor around containers makes them more vulnerable to kernel exploits and attacks on the shared host resources. Therefore, there is a need for approaches for generating protection layers for containers.

[0007] By way of example, this may be addressed by Docker containers and the implementation of Linux kernel security mechanisms such as Capabilities, Seccomp and the enabling of mandatory access control, MAC, profiles with rule and policy enforcement layers such as SELinux or AppArmor. However, even with such security measures in place, due to the problem with configuring them and also limitations in the protection scope, the containers may still be vulnerable to kernel exploits and attacks.

[0008] In order to overcome at least some of the above limitations, WO 2021 / 242160 Al discloses a method allowing an administrator to upload a container service on a dedicated computer device on a MAC profile generator service. Then by stimulating the service with a generic test suite, the profile generator service will generate a tailored MAC profile for the particular service. There are, however, still a need for improvements.

[0009] It is an object of the present disclosure to mitigate, alleviate or eliminate one or more of the above-identified deficiencies and disadvantages in the prior art and solve the above- mentioned problems. According to a first aspect there is provided a method for adapting an access control level of an access control profile for a service, S, associated with a container on a host device, HD, by using a profiling device, PD, configured to run a profiling service, the method comprising: receiving, by the profiling device, PD, from a local domain device, LD, a registration request for the access control profile provided by the profiling service, wherein the registering comprises: indicating the type of the access control profile to be used when running the service, S, and; setting, a first access control level, Pl, of the access control profile, the first access control level, Pl, defining operational rules for the host device, HD, for running the service, S; transmitting, by the profiling device, PD, the access control profile to the local domain device, LD, such that program code related to the service, S, and the access control profile can be transmitted from the local domain device, LD, to the host device, HD; running the service, S, on the host device, HD, and logging, by the access control profile on the host device, HD, audit data pertaining to operational requests occurring during the running of the service, S; establishing, by the profiling device, PD, a communication channel to the host device, HD; receiving, by the profiling device, PD, the logged audit data via the communication channel ; determining, by the profiling device, PD, a second access control level, P2, based on the received audit data, wherein the second access control level, P2, is different from the first access control level, Pl, in defining operational rules for the host device, HD, for running the service, S; transmitting, from the profiling device, PD, to the host device, HD, via the communication channel the second access control level, P2, such that the access control profile is updated by replacing the first access control level, Pl, with the second access control level, P2.

[0010] An advantage being that the method allows for creating of adaptive access control profiles. Put differently, the method allows for an update of the definition of operational rules for the host device, HD. An efficient protection layer may thereby be provided. In more detail, by logging, by the access control profile on the host device, HD, audit data pertaining to operational requests occurring during the running of the service, S, a more effective determining of a suitable access control level may be performed. A more versatile defining of operational rules for the host device, HD, is further provided. A more secure service may, moreover, be achieved. Put differently, the access control profiled generation can be made in an adaptive way such that risks associated with container security can be controlled. A more flexible setting of a first access control level may moreover be achieved. The method further allows for an adaptation of the control access profile by the restriction level being possible to be increased or decreased between the first and the second access control level. Problems associated with having a too restrict access control level may thereby be mitigated. A less- complex configuration of the control access profile for a service, S, associated with a container is provided. A further advantage is that it is possible to efficiently update the control access profile while the service is running in the target environment.

[0011] According to some examples, the second access control level, P2, is more restrictive than the first access control level, Pl, in defining operational rules for the host device, HD, for running the service, S.

[0012] An advantage being that the method allows for an adjustment of the allowable operational requests, starting with the first access control profile, having the first access control level, and then restricting the access control level to the second access control level for the second access control profile. Put differently, the access control may be refined based on the audit data. An adaptive access control may therefore be provided. An improved container security may therefore be provided in an iterative manner. By way of example, operational requests that may jeopardize the security and / or the functionality of the service may be monitored and / or restricted. In other words, the first control level may set to be sufficiently compliant allowing for a simpler initiation of the service, S, e.g. not being to restricting for the service, S, to run properly on the host device, HD. The second control level may then restrict the operational request being allowed allowing thereby providing improved safety while running the service, S. Thus, the containers may thereby be made less vulnerable to kernel exploits and attacks while allowing for a more efficient and less complex configuration and initiation of the service, S.

[0013] According to some examples, the audit data comprises data pertaining to all operational requests occurring during the running of the service, S.

[0014] An advantage being that a better tracking of the operational request performed during the running of the service is achieved. A more detailed adjustment of the access control may therefore be provided. A more efficient and faster revision of the access control profile may be provided.

[0015] According to some examples, the audit data comprises data pertaining to operational requests blocked by the access control profile based on the defined operational rules of the first access control level, Pl, during the running of the service, S.

[0016] An advantage being that the type and / or frequency of non-allowed operational request performed during the running of the service, S, may be determined without compromising the security while running the service, S. Put differently, operational requests or certain types of operational requests may be identified based on the audit data. By way of example, operational requests that are blocked by the first access control level, but determined, by the profiling service, to improve the running and / or function of the service, S, on the host device, HD, could be allowed in the second access control level. The method may thereby be understood to allow for adjustment of the restriction level such that a less restrictive access control profile is provided. A dynamic method for adapting the access control level may thereby be provided. By way of example, a method allows for an increase or decrease in restriction level such that the service, S, may be run efficiently while providing adequate security.

[0017] According to some examples, the audit data comprises data pertaining to all operational requests logged by the access control profile during the running of the service, S.

[0018] The method may be performed in an iterative manner. By way of example, the method may comprise receiving, by the profiling device, PD, via a communication channel established by the profiling device, PD, and the host device, HD, updated logged audit data and determining, by the profiling device, PD, a third access control level, P3, based on the received updated audit data, wherein the third access control level, P3, is different from the first and the second access control levels, Pl and P2, in defining operational rules for the host device, HD, for running the service, S; and transmitting, from the profiling device, PD, to the host device, HD, via the communication channel the third access control level, P3, such that the access control profile is updated by replacing the second access control level, P2, with the third access control level, P3.

[0019] According to some examples, the third access control level, P3, is more restrictive than the first access control level, Pl, and the second access control level, P2, in defining operational rules for the host device, HD, for running the service, S.

[0020] According to some examples, the third access control level, P3, is more restrictive than the first access control level, Pl, and less restrictive than the second access control level, P2, in defining operational rules for the host device, HD, for running the service, S.

[0021] According to some examples, the indicating of the type of the access control profile comprises indicating a profile restriction level, RP, and / or a profile update policy, FP, for the access control profile, wherein the profile restriction level, RP, is associated with an access control level for the access control profile and wherein the profile update policy, FP, comprises a threshold value for the maximum number of updates of the access control profile that are to be performed by the profiling device, PD.

[0022] An advantage being that an efficient method for providing the access control profile is achieved. The threshold value for the maximum number of updates allows for reduced computational power as the number of updates may be set during the running of the service and / or pre-set. Problems associated with slow convergence may thereby be mitigated. A more efficient setting of the access control level of an access control profile may thereby be provided.

[0023] According to some examples the profiling device, PD, starts a session timer, t, and / or a counter, c, associated with the starting of the service, S, run on the host device, HD, and wherein the audit data comprises the number of operational requests through the counter, c, which is incremented for each additional operational request logged in the audit data and wherein the host device, HD, is configured to, for each operational request logged, send an event count to the profiling device, PD, such that the profiling device, PD, monitors the number of operational requests and / or the time the timer, t, is running.

[0024] An advantage being that a more efficient monitoring and determining of the access control level of an access control profile may be provided. Another advantage being that the number and / or frequency of all operational request performed during the running of the service, S, may be efficiently determined. Put differently, operational requests or certain types of operational requests may be efficiently identified. A better tracking of the operations during the running of the service, S, may be provided.

[0025] According to some examples, the profiling device, PD, starts a session timer, t, and / or a counter, c, associated with the starting of the service, S, run on the host device, HD, and wherein the audit data comprises the number of operational requests blocked by the access control profile, based on the defined operational rules of the access control level, through the counter, c, which is incremented for each additional operational request blocked and wherein the host device, HD, is configured to, for each operational request blocked, send an event count to the profiling device, PD, such that the profiling device, PD, monitors the number of operational requests blocked and / or the time the timer, t, is running.

[0026] An advantage being that a more efficient monitoring and determining of the access control level of an access control profile may be provided. Another advantage being that the number and / or frequency of non-allowed request performed during the running of the service, S, may be efficiently determined without compromising the security while running the service, S. Put differently, operational requests or certain types of operational requests may be efficiently identified. A better tracking of the operations during the running of the service, S, may be provided.

[0027] The blocking may be understood as the access control profile comprises data regulating operational request. By way of example, the access control profile may comprise labels and / or rules, where both data, i.e. objects and / or users / processes, i.e. subjects are given labels and a defined set of rules then determines if a subject with a specific label can access an object with its own label. The set of rules defining which operational request that are allowable or to be blocked by the access control profile.

[0028] According to some examples, the profile update policy, FP further comprises a time threshold value and / or a counter maximum value, wherein the profiling device, PD, is configured to, when the session timer, t, is greater in time than the time threshold value or when the counter, c, is equal to the counter maximum value, transmit an updated access control level Pi pertaining to an updated control access profile, to the host device, where i > 1, and where i=l corresponds to the first control access level, Pl, and wherein the profiling device, PD, is configured to increment i = i+1, and reset the counter c = 0 after transmitting the updated access control level Pi. An advantage being that an efficient selection of access control profile is provided. A reduced computational power may be provided as the number of updates may be set during the running of the service and / or pre-set. Problems associated with slow convergence may thereby be mitigated. A more efficient setting of the access control level of an access control profile may thereby be provided.

[0029] According to some examples, the profiling device, PD, is configured to run one or more virtual profiles based on the received audit data, each virtual profile having an associated access control level, Pi, defining allowable operational request as defined by operational rules and an associated counter, c; the method further the method comprises: for each virtual profile, counting by the associated counter, c, the number of operational requests being blocked by the virtual profile when running the service, S, and selecting, by the profiling device, PD, the access control profile among the virtual profiles based on a maximum counter value, wherein the selected access control profile determines the second access control level, P2.

[0030] An advantage being that the access control profile may be tested at the profiling device, PD. A further advantage is that a plurality of VMs may be run in parallel in the profiling service. Analysis and determining of the suitable access control profile, i.e. having a suitable accesses control level may be performed more efficiently. To this end, the VMs may provide an improved consistency in the environment for testing different access control profiles having different access control levels. By having each test environment starting from the same baseline an improved performance benchmarking may be achieved. By way of example, a too restrictive access control level that may lead to errors and / or crashes during profiling may not have an effect of the other VMs. A more reliable and efficient operation of the profiling service may thereby be achieved. A more cost effective and less time-consuming profiling service may thereby be provided. An improved method for adjusting the access control level of an access control profile for the service may therefore be provide.

[0031] According to some examples, the profiling device, PD, is configured to run one or more virtual profiles based on the received audit data, each virtual profile having an associated access control level, Pi, and an associated counter, c; the method further comprising: for each virtual profile, counting by the associated counter, c, the number of operational requests as logged by the virtual profile when running the service, S, and selecting, by the profiling device, PD, the access control profile among the virtual profiles based on a maximum counter value, wherein the selected access control profile determines the second access control level, P2. According to some examples, the first access control level, Pl, is non-restrictive to the operational requests or has a default restriction level.

[0032] An advantage being that an open profile may be used as a starting point and the method may thereafter iteratively restrict the access control level thereby controlling the operational requests allowed. An advantage of utilizing a default restriction level is that the adaptation of the access control level may be performed efficiently while having defined operational rules such that the security while running the service, S, is not compromised while the service may be allowed to run efficiently. A more fail-safe method may thereby be provided.

[0033] According to some examples, the receiving, by the profiling device, PD, of a registration request from a local domain device, LD, for an access control profile is via an authentication communication channel established between the local domain device, LD, and the profiling device, PD, wherein the authentication communication channel is associated with authentication credentials, AC.

[0034] A safer communication may between the local domain device, LD, and the profiling device, PD, may thereby be obtained. The communication channel may be via wired or wireless communication.

[0035] According to some examples, the access control profile is a mandatory access control, MAC, profile.

[0036] An advantage being that the MAC may provide an improved security. By way of example, the MAC profile may mitigate problems associated with a user of the host device, HD, changing permissions set by the profile. To this end, problems associated with a system administrator changing user permissions set may be reduced. A more robust access control profile is therefore provided.

[0037] According to some examples, the container is a Kubernetes or Docker container, the container running as a Virtual Machine, VM, or directly on a single host operating system.

[0038] According to a second aspect there is provided a profiling device, PD, communicatively connected to a local domain device, LD, and a host device, HD, wherein the profiling device, PD, is configured to perform the method according to the first aspect together with the local domain device, LD, and the host device, HD. Effects and features of the second aspect are to a large extent analogous to those described above in connection with the first aspect. Embodiments mentioned in relation to the first aspect are largely compatible with the second aspect.

[0039] According to a third aspect there is provided a computer program product comprising a non-transitory computer readable medium, having thereon a computer program comprising program instructions, the computer program being loadable into a data processing unit and configured to cause execution of the method according to the first aspect when the computer program is run by the data processing unit.

[0040] Effects and features of the third aspect are to a large extent analogous to those described above in connection with the first and second aspects. Embodiments mentioned in relation to the first and second aspect are largely compatible with the third aspect.

[0041] According to a fourth aspect there is provided a cloud environment comprising a local domain device, LD, a host device, HD, and a profiling device, PD, wherein the cloud environment is configured to perform the method according to the first aspect.

[0042] Effects and features of the forth aspect are to a large extent analogous to those described above in connection with the first, second and third aspects. Embodiments mentioned in relation to the first, second and third aspect are largely compatible with the forth aspect.

[0043] The present disclosure will become apparent from the detailed description given below. The detailed description and specific examples disclose preferred embodiments of the disclosure by way of illustration only. Those skilled in the art understand from guidance in the detailed description that changes and modifications may be made within the scope of the disclosure.

[0044] Hence, it is to be understood that the herein disclosed disclosure is not limited to the particular component parts of the device described or steps of the methods described since such device and method may vary. It is also to be understood that the terminology used herein is for purpose of describing particular embodiments only, and is not intended to be limiting. It should be noted that, as used in the specification and the appended claim, the articles "a", "an", "the", and "said" are intended to mean that there are one or more of the elements unless the context explicitly dictates otherwise. Thus, for example, reference to "a unit" or "the unit" may include several devices, and the like. Furthermore, the words "comprising", "including", "containing" and similar wordings does not exclude other elements or steps.

[0045] Brief of the

[0046] The above objects, as well as additional objects, features and advantages of the present disclosure, will be more fully appreciated by reference to the following illustrative and non-limiting detailed description of example embodiments of the present disclosure, when taken in conjunction with the accompanying drawings.

[0047] Figure 1 shows schematically a cloud environment comprising a host device, HD, a profiling device, PD, and a local domain device, LD according to some embodiments of the present disclosure.

[0048] Figures 2a and 2b show schematically a method for adapting an access control level of an access control profile for a service, S, associated with a container on a host device, HD, according to some embodiments of the present disclosure.

[0049] Figure 3 shows schematically an implementation of a method for adapting an access control level of an access control profile for a service, S, associated with a container on a host device, HD, according to some embodiments of the present disclosure.

[0050] Figure 4 shows schematically a flow chart of actions from a perspective of a profiling services run on a profiling device, PD, according to some embodiments of the present disclosure.

[0051] Figure 5 shows schematically a computer program product according to some embodiments of the present disclosure.

[0052] Figure 6 exemplifies suitable implementation options of a profiling service according to some embodiments of the present disclosure.

[0053] Detailed

[0054] The present disclosure will now be described with reference to the accompanying drawings, in which preferred example embodiments of the disclosure are shown. The disclosure may, however, be embodied in other forms and should not be construed as limited to the herein disclosed embodiments. The disclosed embodiments are provided to fully convey the scope of the disclosure to the skilled person.

[0055] In the following a number of terms are defined for reference and improved understanding of the disclosure.

[0056] The term "container" is to be interpreted as a lightweight, standalone, executable software package that encompasses a piece of software and everything it needs to run: computer program code, runtime, system tools, system libraries, and settings.

[0057] Containers, also referred to as container environments, as described herein, may typically comprise stateless software components that may virtually package and isolate services, e.g., distributed applications, for deployment in an execution environment. Further, containers may share access to an operating system, OS, kernel of one or more deployment resources via the execution environment in which the one or more containers are deployed in.

[0058] Containers are isolated from each other and from the host system on which they are to be run. In more detail, containers run applications, apps, in isolation from each other on a shared operating system, OS. Each container has its own filesystem, central processing unit, memory, and process space, much like a virtual machine, VM. The containers are, however, more lightweight than VMs because they share the host system's kernel, rather than running their own OS. An advantage being that containers provide a way to package and run applications in a defined environment, isolated from the rest of the system, ensuring they run the same regardless of where they are deployed.

[0059] The skilled person in the art, would, moreover understand that alternative wordings to containers for describing implemented isolated software to run applications may be referred to by other terms such as "Docker containers" or "Dockers" in the Docker environment for creating and managing containers. In the Kubernetes ecosystem the term "pod". To this end, the terms "Linux containers", "zones" or micro virtual machines" may be used depending on software environment and overlapping use cases. In the following the term container will be used for clarity.

[0060] The wording "access control profile" for a container may be understood to refers to a defined set of rules, policies, and configurations that dictate how the container interacts with other entities, such as other containers, the host system, networks, storage, file data and how entities interact with it. Put differently, the access control profile defines what a container can and cannot do and who can interact with the container. The operational rules for operating a service, S, may thereby be defined by the access control profile. To this end, the operational rules may be set by defining an access restriction level for the access control profile.

[0061] The term "service", S, is to be interpreted as an orchestrated or managed way to run, scale, and maintain containerized applications, i.e. apps, over time. These services are configured to ensure that the specified number of container instances are running, and to handle various tasks such as load balancing, scaling, and self-healing. A service, as described herein, may typically comprise, processes and / or threads configured to run in one or more containers.

[0062] The term "audit data" is to be interpreted in a container context to refer to the collection of logs, metadata, and data pertaining to activities, requests and / or events associated with the operation of a container. The audit data may be used for monitoring, and ensuring security and compliance of containerized applications run by a service.

[0063] The audit data may comprise data pertaining to how and / or who accessed the container, when, and what operations were performed. The audit data may comprise data pertaining to any changes to the container's configuration, environment variables, mounted volumes, or network settings. The audit data may comprise data pertaining to network activity by logging network traffic, e.g. network traffic going in and out of the container. The audit data may comprise information pertaining to changes within the container's filesystem.

[0064] The term "profiling device" is here to be understood as a device such as a computer on which a profiling service may be run. The profiling device may be a server. The profiling service is further to be understood as a tool or platform that is configured for analyse the performance characteristics of an application or system. By way of example, the profiling service may be configured to monitor how containers use system resources like central processing unit, memory, and / or input / output, I / O, systems.

[0065] The term "local domain device" is here to be understood as a device, e.g. a computer, server, mobile device, connected to and operational within a network domain such as a cloud environment. The local domain device may comprise specific hardware components and / or virtual devices to operate within the cloud environment. The local domain device may be configured to assigning a particular network interface or virtual network interface for communicating with the host device and / or the profiling device such that a container associated with the service may be configured. In the context of containers, a term "host device" may be understood as a device such as a computer or server configured to run the service by use of one or more containers. Put differently, the container runtime or engine is operating on the host device to run the service.

[0066] The local cloud may be a cloud infrastructure and services that are hosted within an organization's own data center and / cloud environment. The external cloud environment may according to some example, be referred to as a "public cloud". The external cloud environment may comprise a cloud infrastructure provided by third-party vendor over the internet.

[0067] The term mandatory access control, MAC, profile may be understood as a type of access control profile that restricts access to objects, like files or tasks, based on certain attributes tied to them and to the subjects, typically users or processes, that try to access them. In a MAC system, the operating system may constrain the ability of a subject or initiator to access or perform some sort of operation on an object or target.

[0068] The mandatory access control, MAC, profile may be configured to monitor and / or block operational requests, based on labels and rules associated with data and / or subjects, such as users and / or processes. In more detail, a set of defined rules for the MAC profile may determine if a subject with a specific label can access an object with its own label. By way of example, Security-Enhanced Linux, AppArmor, is a MAC profile implementation using the concept of types as labels and has policy rules that dictate the interactions between these types. By way of example, users and / or processes may be assigned a label, often indicative of its security clearance level (e.g., "Top Secret", "Confidential", etc.). Objects such as files, directories, and / or devices may be given a label that indicates its sensitivity or required clearance for access, e.g., a document might be labelled as "Secret".

[0069] The restriction level may define the label and / or rule.

[0070] By way of example, an operational request may be an access request. For example, the access request may pertain to a subject requesting to perform an action on an object or attempt to access data such as to read a file.

[0071] The access control profile, e.g. a MAC profile may consult its set of operational rules, e.g. access control rules, to decide if the operational request should be allowed. These rules may be based on the labels of the subject and object in question. The profiling device may therefore evaluate the label of the subject against the label of the object using its rules. Virtual machines, VM, as described herein, may comprise a hypervisor configured to provide a layer of abstraction, e.g., configured to emulate hardware from pooled central processing units, CPUs, memory, storage and network resources of one or more deployment resources.

[0072] With reference to Figures 1 and Figure 2, a method 200 for adapting an access control level of an access control profile for a service, S, associated with a container 100 on a host device, HD, 102 is described in the following.

[0073] Figure 1 illustrates a cloud environment 10. A host device, HD, 102, a profiling device, PD, 104, and a local domain device, LD, 106 are communicatively connected as will be described. The communication may be via a wireless or a wired communication allowing for data communication between the devices 102, 104, 106. Each of the device may comprise a data processing unit 107.

[0074] Each of the devices 102, 104, 106 may comprise a controller 103 configured to control the operation of the associated device. The controller 103 may further comprises, or is otherwise associated with; e.g., connected or connectable to, a transceiver 105, e.g. transceiving circuitry or transceiving module, configured to transmit radio signals for sending and receiving data such as data logs and or software data. Data pertaining to an access protection profile may, for example, be transmitted by the transceiver 105.

[0075] The method 200 may be deployed in the cloud environment 10. The cloud environment 10 may be a local cloud environment or an external cloud environment comprising the local domain device, LD, 106.

[0076] The local domain device may be operated by an administrator.

[0077] The method 200 comprises using a profiling device, PD, 104. The profiling device, PD, is configured to run profiling service. The method 200 comprises receiving 202, by the profiling device, PD, 104 from a local domain device, LD, 106 a registration request 108 for an access control profile 110 provided by the profiling service.

[0078] The local domain device, LD, 106 may receive session authentication credentials, AC, as part of the registration from the profiling device, PD.

[0079] The local domain device, LD, 106 may comprise a client certificate for registering on the profiling device, PD, and wherein the profiling device, PD, is configured to allocate a profiling session ID for the access control profile, wherein the client certificate and the profiling session ID constitutes an authentication credential, AC, wherein the profiling device is configured to transmit the profiling session ID to the local domain device, LD.

[0080] The authentication credentials, AC, may be selected from a group comprising client certificate, username password and end-user token such as a Web token or OAuth token.

[0081] The registering 204 may further comprises indicating 206 the type of the access control profile 110 to be used when running the service, S, and; setting 208, a first access control level, Pl, of the access control profile 110, the first access control level, Pl, defining operational rules for the host device, HD, 102 for running the service, S.

[0082] The indicating may be by selecting an access control profile among a plurality of access control files. The indicating may alternatively by configuring an access control profile.

[0083] The profiling device, PD, may associate the access control profile 110 with access credentials AC; and transfers the access credentials, AC, to the host device, HD, and wherein the host device, HD, 102 is associated with a trusted device certificate, DC, for the profiling services such that a secure communication is enabled on the communication channel 112.

[0084] The method 200 may further comprise transmitting 210, by the profiling device, PD, 104 the access control profile 110 to the local domain device, LD, 106 such that program code 111 related to the service, S, and the access control profile 110 can be transmitted from the local domain device, LD, 106 to the host device, HD, 102. The program code 111 may be transmitted on a communication channel 112, as illustrated in Figure 1.

[0085] The method 200 may then comprise running 212 the service, S, on the host device, HD, 102 and logging 214, by the access control profile 110 on the host device, HD, 102 audit data pertaining to operational requests occurring during the running 212 of the service, S.

[0086] The audit data thereby comprising data pertaining to operations performed during the running of the service, S. The audit data may comprise data related to the tasks and operational request performed while running the service, S at the host device, HD, 102. The operational requests may relate to request to access data such as files or programs stored on a memory of the host device, 102. By way of example, the operational requests may relate to access requests to access or alter data stored on the host device, HD, 102. The data may form part of program code configured to run the service and / or an operating system forming part of the host device, HD, 102. With further reference to Figures 1 and 2a, the method 200 comprises establishing 216, by the profiling device, PD, 104 a communication channel 112 to the host device, HD, 102; receiving 218, by the profiling device, PD, 104 the logged audit data 116 via the communication channel 112. The method 200 comprising determining 220, by the profiling device, PD, 104 a second access control level, P2, based on the received audit data, wherein the second access control level, P2, is different from the first access control level, Pl, in defining operational rules for the host device, HD, 102 for running the service, S. The method 200 further comprises transmitting 222, from the profiling device, PD, 104 to the host device, HD, 102 via the communication channel 112 the second access control level, P2, such that the access control profile 110 is updated by replacing the first access control level, Pl, with the second access control level, P2. By way of example, this is illustrated in Figure one as an access control level Pi being transmitted via the communication channel 112. The skilled person understands that the communication channel 112 described above may comprise one or more communication channels.

[0087] The second access control level, P2, may be more restrictive than the first access control level, Pl in defining operational rules for the host device, HD, 102 for running the service, S.

[0088] By way of example, the operational rules may be rules set to define the container's operational privileges. The operational privileges may comprise rules determining access rights to memory, files, applications, permissions, capabilities, and / or network accesses.

[0089] The audit data may, for example, comprise file modifications which might be a sign of a security breach or malware activity. The audit data may comprise data pertaining to metrics related to the processor usage and network usage of the container. By way of example, the audit mechanisms, like Linux's audit system "auditd", may be used to log system calls made by processes within the container.

[0090] The audit data comprises data pertaining to all operational requests occurring during the running of the service, S.

[0091] The audit data may comprise data pertaining to operational requests blocked by the access control profile 110 based on the defined operational rules of the first access control level, Pl, during the running of the service, S. By way of example, the operational requests may include request to access parameters, functions, execution of programs, particular data or objects, parts of memory, files, etc.

[0092] The indicating 206 of the type of the access control profile 110, as discussed above, may comprise indicating a profile restriction level, RP, and / or a profile update policy, FP, for the access control profile 110, wherein the profile restriction level, RP, is associated with an access control level for the access control profile 110 and wherein the profile update policy, FP, comprises a threshold value for the maximum number of updates of the access control profile 110 that are to be performed by the profiling device, PD, 104.

[0093] With reference to Figures 1 and 2b, the profiling device, PD, 104 may starts 224 a session timer, t, and / or a counter, c, associated with the starting of the service, S, run on the host device, HD, and wherein the audit data comprises the number of operational requests blocked by the access control profile 110, based on the defined operational rules of the access control level, through the counter, c, which is incremented for each additional operational request blocked and wherein the host device, HD, 102 is configured to, for each operational request blocked, send 226 an event count to the profiling device, PD, such that the profiling device, PD, 104 monitors 228 the number of operational requests blocked and / or the time the timer, t, is running.

[0094] Alternatively, the profiling device, PD, 104 starts 224 a session timer, t, and / or a counter, c, associated with the starting of the service, S, run on the host device, HD, and wherein the audit data comprises the number of operational requests through the counter, c, which is incremented for each additional operational request logged in the audit data and wherein the host device, HD, 102 is configured to, for each operational request logged, send 226 an event count to the profiling device, PD, such that the profiling device, PD, 104 monitors 228 the number of operational requests and / or the time the timer, t, is running.

[0095] The profile update policy, FP may further comprise a time threshold value and / or a counter maximum value, wherein the profiling device, PD, 104 is configured to, when the session timer, t, is greater in time than the time threshold value or when the counter, c, is equal to the counter maximum value, transmit 230 an updated access control level Pi pertaining to an updated control access profile, to the host device, where i > 1, and where i=l corresponds to the first control access level, Pl, and wherein the profiling device, PD, 104 is configured to increment i = i+1, and reset the counter c = 0 after transmitting the updated access control level Pi. According to some examples the Pi is stricter than Pi-1 such that the method further restricts the operational rules for the host device, HD, for running the service, S.

[0096] According to some examples the Pi is less strict than Pi-1 such that the method further loosens the operational rules for the host device, HD, for running the service, S. According to some examples the method 200 may be described as comprising the steps SI to S8 as exemplified below and with reference to Figure 3. By way of example an implementation of the method 200 is described wherein a host device 102, a profiling device 104 and a local domain device 106 in a cloud environment 10 is used. The method 200 for adapting an access control level of an access control profile for a service, S, associated with a container on a host device, HD, by using a profiling device, PD, is described according to some examples as:

[0097] SI: An administrator, A, 105 may prepare a service, S, in a target container environment. This can be a Kubernetes or Docker environment running as a virtual machine, VM, or directly on a single host operating system. In particular, during the deployment, the following may be applied.

[0098] The administrator, A, 105 may register a control access profile built by the profiling service of the profiling device, PD, 104. The profiling service may be configured to use access control profiles being mandatory access control, MAC, profiles. During the registration, the administrator, A, 105 may authenticate him / herself by the profiling service of the profiling device, PD, 104. Optional as part of the service registration, the administrator, A, 105 may receive session authentication credentials, AC, back from the profiling service. In an alternative embodiment, the administrator, A, may register or may have previously registered a client certificate at the profiling service of the profiling device, PD, 104. In the latter case, the client certificate together with a profiling session identification, ID, may constitute AC and the administrator will only get a session ID back from the profiling service. The administrator, A, 105 may also indicate to the profiling service if the service will be started with zero MAC profile, i.e. no restriction in terms of operational requests. Alternatively, the service may be started with a default MAC profile as given by the profiling service, S or chosen by the administrator, A, 105. The default MAC profile may have a predetermined access control level regulating allowable operational rules.

[0099] The wording "default" is here to be understood as a predefined configuration of the restriction level of the MAC profile. The administrator, A, 105 may also indicate to the profiling service, PD, on the profiling device, PD, 104 what type of access control profile he / she wants to execute. The access control profile 110 may be a mandatory access control, MAC profile as in this example. The profile may, for instance, be a SELinux profile or an AppArmor profile.

[0100] The administrator, A, 105 may also set profile restriction level, RP, as well as profile update policy, FP, for the access control profile 110. A low restriction level, RP, may cause the profiling service to generate looser, i.e. less restrictive, access control profile. A higher restriction level may generate a tighter, i.e. a more restrictive access control profile. The profile update policy, FP, may determine when there is a need for an update of the access control profile, i.e. such that the access control level is updated. The profile update policy, FP, may determine the maximum number of updates of the profiling service as discussed above. The profiling service, S, may associate the access control parameters RP and FP with the authentication credentials, AC, and / or session ID for the new profiling session.

[0101] S2: The administrator, A, 105 transfers the AC to the container host / node, i.e. to the host device, HD, 102. The host device, HD, 102 is responsible for the MAC configuration of the containers running on the host device. HD, 102. The host device, HD, may be preconfigured with the trusted server certificate of the profiling services, SC or certificate authority certificate certifying SC.

[0102] S3: The administrator, A, 105 launches the service, S on the host device, HD 102. The service, S, may by way of example, be either launched with a default MAC profile or a completely open profile, i.e. no access restrictions apply as discussed in step SI. The service, S, might be run with an access control profile operating in accordance with the set access control level. Alternatively, the access control profile may be operating in an audit mode, i.e. where the operational rules defined by the access control profile is not enforced and the host device, HD, 102 is logging access violations, i.e. operational requests not being allowed by the operational rules, as if the access control profile was enabled and enforcing the access control as set by the access control level.

[0103] S4: The host device, HD, 102, hosting the service, S, may set up a secure session with the profiling device, PD, 104 with the profiling service. The secure session may be mutually authenticated using SC and AC and all message exchanges are from this point on integrity and confidentiality protected. According to some examples, the transport layer security, TLS, may be used to achieve the secures session. The profiling server may according to some examples start a session timer, t, and or a counter, c, associated with the starting of the service, S. S5: The service, S, may be run in a test mode, i.e. without operational requests being executed at the hot device, HD or in normal operation, i.e. where the operational requests are being executed. Operational requests, e.g. access attempts, from the service, S, will be logged by the access control profile on the host device, HD, 102 and transferred over the secure session to the profiling device, PD, 104 with the profiling service. Put differently, the access control profile on the host device, HD, 102 logs audit data 116 pertaining to operational requests occurring during the running of the service, S.

[0104] The audit data 116 is transmitted from the host device, HD, 102 to the profiling device, PD, 104. The transmitting may be via the secure session. Put differently, the transmission of the audit data 116 may be via a communication channel 112 established between the host device, HD and the profiling device, PD. The communication channel 112 may be understood as a secure channel, 113.

[0105] The profiling service may then use the information received, i.e. the audit data, to create service tailored access control profiles, e.g. MAC profiles for the service, S. The tailored access control profiles are based on the by the profiling device, PD, received audit data. In more detail, the method 200 comprises determining, by the profiling device, PD, a second access control level, P2, based on the received audit data, wherein the second access control level, P2, is different from a first access control level, Pl in defining operational rules for the host device, HD, for running the service, S as discussed above.

[0106] The tailoring of the updated access control profile may be achieved in different ways. According to some example, the access control profile may log and / or report all operational requests, e.g. access events, i.e. from S. The access control profile may thereby log or report both those operational requests that are blocked by the current access control profile as well as the operational requests that are not blocked. In this case, the profiling service will have all access information from the service and can use it for creating a suitable tailored MAC profile given the restriction profile, RP.

[0107] The profiling device, e.g. a server, may then run one or several "virtual" profiles and count all access attempts outside these virtual profiles when obtaining the new more restrictive new profile for service, S. The counter, c, is incremented for each new access event the profiling service processes.

[0108] According to other examples, the profiling device, e.g. a server, may then run one or several "virtual" profiles and count all access attempts outside these virtual profiles when obtaining the new less restrictive new profile for service, S. The counter, c, is incremented for each new access event the profiling service processes.

[0109] By way of example, the profiling device may allow for a control access profile being more restrictive based on the counted access attempts. Thus, a more secure access control profile is provided. However, in some cases, there is a need to loosen the control access profile as it may be determined by the profiling service to be too restrictive to allow the service run in an efficient manner. Then new control access profile may thereby be made less restrictive in next round. Thus, the method allows for a trade-off between security and service availability.

[0110] A container, C, associated with the service, S, having a certain access control profile, P are schematically illustrated by the box 11 in Figure 3 for clarity. The container, C, may be run on a virtual machine, VM, as also illustrated in Figure 3 and discussed above.

[0111] According to some examples, the service, S, may be run in audit mode as discussed above. All operational request, e.g. access events, will then be logged and counted and operational request that would have been blocked if the operational rules as defined by the access control profile was executed will also be reported. The profiling service may then run as normal, but no access prevention enforcements are applied on the host device, HD, during the audit mode.

[0112] S6: When time, t, for the session timer is greater than the update interval as specified by profile update policy, FP, or the counter, c, has a larger value than a threshold value for the maximum number of updates or a maximum number of logged access events as given by the profile update policy, FP, the profiling service may return a new MAC profile to the host, Pi where i = 0 if this is the first profile generated for service, S during this session. The profiling service may then reset the counter, c, i.e. so that c = 0. The access control profile may further have a restriction level given by RP. For instance, if RP, is looser, the MAC profile will allow several accesses typically used in containers for services of the type which service, S, belongs to, but not so far identified in the logs received from the service, S, when run on the host device, HD, while if RP indicates a more restrictive MAC, rather few accesses beyond what has been indicated in RP will be allowed.

[0113] S7: The host device, HD, may apply the received access control profile (or run with it in audit mode), Pi, on the container environment while continuing measuring and sending audit data base on the logged operational request to the profiling device, PD, with the profiling service. The MAC enforcement layer, i.e. the access control profile on the host device, HD, may block all operational request, i.e. access attempts outside Pi.

[0114] S8: The profiling service on the profiling device, PD, may increment the index i, such that i = i+1. If i then has reached the maximum number of updates as specified by profile update policy, FP, the profiling service returns the latest profile Pi to the host device, HD, which then applies it and stop sending logged data to the profiling service. If not the maximum number of updates has been reached, the profiling server resets t = 0 and step 5 above is repeated with the new incremented index.

[0115] In Figure 4, a flow chart 20 of actions from a perspective of a profiling services run on a profiling device, PD, is illustrated according to some examples. The details of the different steps SI - S15 in the flow chart are further explained below:

[0116] SI: The profiling service may receive a new request for an access control profile from a host device, HD, through a communication channel, e.g. an authenticated communication channel. For the host device, HD, e.g. an administrator or a client of the host device may indicate a wanted restriction level for the new profile restriction level, RP. As part of the request, a profile update policy, FP, may be selected. The profile update policy, FP, may include a number of threshold values. By way of example the threshold values may be a time threshold, TF; used by the profiling service to determine MAC update interval, an event threshold, TE, used by the profiling service to determine MAC update interval, and a MAC generation threshold, Tl, used to determine the maximum number of profiles to generate by the profiling service.

[0117] S2: The profiling service may generate a profile ID and new authentication credentials, AC, (also referred to as access credentials) or identifies existing authentication credentials, AC, that can be used to secure the profile communication.

[0118] S3: The access credentials, (e.g. including an identification, ID, may be returned to the profile requester or just an ID together with a reference to existing authentication credentials, AC, to be used to secure the profiling service.

[0119] S4: The profiling service may receive a request for setting up a new profiling service with a client. The request is protected by a profiling server certificate, SC, and access credentials, AC, and may include the ID of the profiling service. S5: The profiling service may start a timer, t, and resets a counter, c = 0, reset profile counter, i = 0.

[0120] S6: The profiling service continuously listens to access events from the container. If a new access event is received jump top step 9.

[0121] S7: The profiling service may check if the timer exceeds the threshold TF, i.e. if t > TF it jumps to next step, otherwise jump back to step 6.

[0122] S8: The timer is reset, t = 0.

[0123] S9. The event is processed and as a result the access profile for the client is potential updated to a new profile according to the profile restriction level, RP.

[0124] S10. The counter is incremented, c = c+1.

[0125] Sil: The profiling service checks if the counter value exceeds the threshold TC, i.e. if c

[0126] > Tc it jumps to step 12, otherwise jump back to step 7.

[0127] S12: The event counter is reset, c = 0.

[0128] S13: The profiling server transfers the updated control access profile to the host device, HD.

[0129] S14: The profiling counter is incremented, i = i+1.

[0130] S15: The profiling service checks if the profile counter exceeds the threshold Tl, i.e. if i

[0131] > Tl this ends the procedure, otherwise jump back to step 6).

[0132] According to some examples, the profiling device, PD may be configured to run one or more virtual profiles 114, based on the received audit data illustrated schematically e.g. in Figure 1 or Figure 3. Each virtual profile 114 having an associated access control level, Pi, defining allowable operational request as defined by operational rules and an associated counter, c; the method 200 further comprises: for each virtual profile 114, counting 221, see Figure 2a, by the associated counter, c, the number of operational requests being blocked by the virtual profile when running the service, S, and selecting, by the profiling device, PD, 104 the access control profile 110 among the virtual profiles based on a maximum counter value, wherein the selected access control profile determines the second access control level, P2.

[0133] According to some examples, the profiling device, PD, 104 is configured to run one or more virtual profiles 114 based on the received audit data, each virtual profile having an associated access control level, Pi, and an associated counter, c; the method 200 further comprising: for each virtual profile, counting 232 by the associated counter, c, the number of operational requests as logged by the virtual profile when running the service, S, and selecting, by the profiling device, PD, 104 the access control profile 110 among the virtual profiles based on a maximum counter value, wherein the selected access control profile determines the second access control level, P2.

[0134] By running multiple virtual profiles, a plurality of access control profiles may be applied in parallel. A more effective determining, by the profiling device, PD, of an updated access control level based on the received audit data may be achieved. The updated access control level may by way of example the second access control level, P2.

[0135] The second access control level may be more restricted than the first access control level. Alternatively, the second control level may be less restrictive than the first access control level. A trade-off between security and service availability may therefore be achieved.

[0136] The first access control level Pl, may be non-restrictive to the operational requests or has a default restriction level.

[0137] The receiving 202, by the profiling device, PD, 104 a registration request from a local domain device, LD, 106 for an access control profile 110 may be via an authentication communication channel 113 established between the local domain device, LD, 106 and the profiling device, PD. The authentication communication channel 113 may be associated with authentication credentials, AC, as described above.

[0138] The access control profile 110 may be a mandatory access control, MAC, profile.

[0139] According to some example, the indicating 206 of the type of the access control profile may comprise indicating the first access control profile restriction level, Pl, by selecting between an open mandatory access control, MAC, profile according to some examples. The MAC profile may have a restriction level that is non-restrictive to the operational requests. The MAC profile may alternatively have a restriction level for a default mandatory access control, MAC, profile having a predetermined restriction level.

[0140] The container 100 may be a Kubernetes or Docker container, the container 100 running as a Virtual Machine, VM, or directly on a single host operating system.

[0141] An advantage by the container running directly on the host operating system is that it allows for an efficient use of system resources. This as the containers may share the host operating system, OS, kernel rather than running a full-blown OS like in virtual machines. This leads to faster start up times and better hardware utilization.

[0142] Again, with reference to, for example, Figure 1, a second aspect of this disclosure is a profiling device, PD, 104 as described above. The profiling device, PD, 104 the first aspect communicatively connected, e.g. one or more communication channels 112, to a local domain device, LD, 106 and a host device, HD, 102 wherein the profiling device, PD, 104 is configured to perform the method 200 described above together with the local domain device, LD, 106 and the host device, HD 102. The profiling device, PD, 104, may be configured to perform the method 200 described above. The profiling device, PD, 104 may use the controller 103, the transceiver 105 and the data processing unit 107 to perform one or more of the steps of the method 200 and / or one or more of any steps otherwise described herein.

[0143] The third aspect of this disclosure shows a computer program product 300 the first aspect comprising a non-transitory computer readable medium 302, having thereon a computer program 304, see Figure 5. The computer program 304 comprising program instructions, wherein the computer program 304 is loadable into a data processing unit and configured to cause execution of the method 200 described when the computer program 304 is run by the data processing unit. The data processing unit 107 may form part of one or more of the devices described herein, i.e. the host device, 102, the profiling device, 104, and local domain device, LD. By way of example, data processing units 107 are illustrated in Figure 1, for the respective devices, 102, 104, and 106.

[0144] Generally, when a device is referred to herein, it is to be understood as a physical product. The physical product may comprise one or more parts, such as controlling circuitry in the form of one or more controllers, one or more processors, or the like.

[0145] The described embodiments and their equivalents may be realized in software or hardware or a combination thereof. The embodiments may be performed by general purpose circuitry. Examples of general-purpose circuitry include digital signal processors, DSP, central processing units, CPU, Graphics Processing Units, GPU, co-processor units, field programmable gate arrays, FPGA, and other programmable hardware. Alternatively, or additionally, the embodiments may be performed by specialized circuitry, such as application specific integrated circuits, ASIC. The general-purpose circuitry and / or the specialized circuitry may, for example, be associated with or comprised in an apparatus such as a wireless communication device. Embodiments may appear within an electronic device, such as a computer or server, comprising arrangements, circuitry, and / or logic according to any of the embodiments described herein. Alternatively, or additionally, an electronic device such as a wireless communication device, may be configured to perform methods according to any of the embodiments described herein.

[0146] In some embodiments, a device is completely or partially comprised in a server.

[0147] According to some embodiments, a computer program product comprises a computer readable medium such as, for example a universal serial bus, USB, memory, a plug-in card, an embedded drive or a read only memory, ROM.

[0148] The fourth aspect of this disclosure shows a cloud environment 10 as described in connection with the first aspect. The cloud environment comprising a local domain device, LD, 106 a host device, HD, 102 and a profiling device, PD, 104, see for example Figures 1 and 3. The cloud environment 10 is configured to perform the method 200 as described above.

[0149] The profiling service run on the profiling device, PD, 104 may be realized using several different architecture and implementation options. Figure 6 exemplifies one suitable implementation option of the profiling service. It also shows one embodiment of event format used by the profiling service.

[0150] Example audit log lines:

[0151] > type=AVC msg=audit(1676365806.121:23964): apparmor="AUDIT" operation="getattr" profile="quritis-audit-l-2" name=" / usr / src / wordpress / wp-admin / images / menu-vs-2x.png" pid=6014 comm="tar" requested_mask="r" fsuid=0 ouid=33FSUID="root" OUID="www-data"

[0152] > type=AVC msg=audit(1676365806.121:23967): apparmor="AUDIT" operation="open" profile="quritis-audit-l-2" name=" / usr / src / wordpress / wp-admin / images / menu-vs.png" pid=6014 comm="tar" requested_mask="r" fsuid=0 ouid=33FSUID="root" OUID="www-data"

[0153] > type=AVC msg=audit(1676365806.121:23969): apparmor="AUDIT" operation="mknod" profile="quritis-audit-l-2" name=" / var / www / html / wp-admin / images / post-formats.png" pid=6015 comm="tar" requested_mask="c" fsuid=O ouid=OFSUID="root" OUID="root"

[0154] > type=AVC msg=audit(1676365806.305:25489): apparmor="AUDIT" operation="create" profile="quritis-audit-l-2" pid=5978 comm="apache2-foregro" family="unix" sock_type="stream" protocol=0 requested_mask="create" addr=none

[0155] It should be clear to anybody familiar with the state of the art, that alternative implementations options in accordance with the invention are possible.

[0156] The person skilled in the art realizes that the present disclosure is not limited to the preferred embodiments described above. The person skilled in the art further realizes that modifications and variations are possible within the scope of the appended claims. Additionally, variations to the disclosed embodiments can be understood and effected by the skilled person in practicing the claimed disclosure, from a study of the drawings, the disclosure, and the appended claims.

Claims

CLAIMS1. A method (200) for adapting an access control level of an access control profile for a service, S, associated with a container (100) on a host device, HD, (102) by using a profiling device, PD, (104) configured to run a profiling service, the method (200) comprising: receiving (202), by the profiling device, PD, (104) from a local domain device, LD, (106) a registration request (108) for the access control profile provided by the profiling service, wherein the registering (204) comprises: indicating (206) the type of the access control profile (110) to be used when running the service, S, and; setting (208), a first access control level, Pl, of the access control profile (110), the first access control level, Pl, defining operational rules for the host device, HD, (102) for running the service, S; transmitting (210), by the profiling device, PD, (104) the access control profile (110) to the local domain device, LD, (106) such that program code related to the service, S, and the access control profile (110) can be transmitted from the local domain device, LD, (106) to the host device, HD (102); running (212) the service, S, on the host device, HD, (102) and logging (214), by the access control profile (110) on the host device, HD, (102) audit data pertaining to operational requests occurring during the running (212) of the service, S; establishing (216), by the profiling device, PD, (104) a communication channel (112) to the host device, HD, (102); receiving (218), by the profiling device, PD, (104) the logged audit data (116) via the communication channel (112); determining (220), by the profiling device, PD, (104) a second access control level, P2, based on the received audit data (116), wherein the second access control level, P2, is different from the first access control level, Pl, in defining operational rules for the host device, HD, (102) for running the service, S; transmitting (222), from the profiling device, PD, (104) to the host device, HD, (102) via the communication channel (112) the second access control level, P2, such that the accesscontrol profile (110) is updated by replacing the first access control level, Pl, with the second access control level, P2.

2. The method according to claim 1, wherein the second access control level, P2, is more restrictive than the first access control level, Pl in defining operational rules for the host device, HD, (102) for running the service, S.

3. The method according to claim 1 or 2, wherein the audit data comprises data pertaining to all operational requests occurring during the running of the service, S.

4. The method according to claim 1 or 2, wherein the audit data comprises data pertaining to operational requests blocked by the access control profile (110) based on the defined operational rules of the first access control level, Pl, during the running of the service,S.

5. The method according to any one of claims 1 to 4, wherein the indicating (206) of the type of the access control profile (110) comprises indicating a profile restriction level, RP, and / or a profile update policy, FP, for the access control profile (110), wherein the profile restriction level, RP, is associated with an access control level for the access control profile (110) and wherein the profile update policy, FP, comprises a threshold value for the maximum number of updates of the access control profile (110) that are to be performed by the profiling device, PD, (104).

6. The method according to any one of claims 1 to 5, wherein the profiling device, PD, (104) starts (224) a session timer, t, and / or a counter, c, associated with the starting of the service, S, run on the host device, HD, and wherein the audit data comprises the number of operational requests through the counter, c, which is incremented for each additional operational request logged in the audit data and wherein the host device, HD, (102) is configured to, for each operational request logged, send (226) an event count to the profiling device, PD, such that the profiling device, PD, (104) monitors (228) the number of operational requests and / or the time the timer, t, is running.

7. The method according to any one of claims 1 to 5, wherein the profiling device, PD, (104) starts (224) a session timer, t, and / or a counter, c, associated with the starting of the service, S, run on the host device, HD, and wherein the audit data comprises the number of operational requests blocked by the access control profile (110), based on the defined operational rules of the access control level, through the counter, c, which is incremented for each additional operational request blocked and wherein the host device, HD, (102) isconfigured to, for each operational request blocked, send (226) an event count to the profiling device, PD, such that the profiling device, PD, (104) monitors (228) the number of operational requests blocked and / or the time the timer, t, is running.

8. The method according to claim 5 or 6, wherein the profile update policy, FP, further comprises a time threshold value and / or a counter maximum value, wherein the profiling device, PD, (104) is configured to, when the session timer, t, is greater in time than the time threshold value or when the counter, c, is equal to the counter maximum value, transmit (230) an updated access control level Pi pertaining to an updated control access profile, to the host device, where i > 1, and where i=l corresponds to the first control access level, Pl, and wherein the profiling device, PD, (104) is configured to increment i = i+1, and reset the counter c = 0 after transmitting the updated access control level Pi.

9. The method according to any one of claims 1 to 8, wherein the profiling device, PD, (104) is configured to run one or more virtual profiles (114) based on the received audit data, each virtual profile having an associated access control level, Pi, defining allowable operational request as defined by operational rules and an associated counter, c; the method (200) further comprising: for each virtual profile, counting (232) by the associated counter, c, the number of operational requests being blocked by the virtual profile when running the service, S, and selecting, by the profiling device, PD, (104) the access control profile (110) among the virtual profiles based on a maximum counter value, wherein the selected access control profile determines the second access control level, P2.

10. The method according to any one of claims 1 to 8, wherein the profiling device, PD, (104) is configured to run one or more virtual profiles (114) based on the received audit data, each virtual profile having an associated access control level, Pi, and an associated counter, c; the method (200) further comprising: for each virtual profile, counting (232) by the associated counter, c, the number of operational requests as logged by the virtual profile when running the service, S, and selecting, by the profiling device, PD, (104) the access control profile (110) among the virtual profiles based on a maximum counter value, wherein the selected access control profile determines the second access control level, P2.

11. The method according to any one of the claims 1 to 10, wherein the receiving (202), by the profiling device, PD, (104) of a registration request from a local domain device, LD, (106) for an access control profile (110) is via an authentication communication channel (113) established between the local domain device, LD, (106) and the profiling device, PD, (104)wherein the authentication communication channel (113) is associated with authentication credentials, AC.

12. The method according to any one of claims 1 to 10, wherein the access control profile (110) is a mandatory access control, MAC, profile.

13. A profiling device, PD, (104) communicatively connected to a local domain device,LD, (106) and a host device, HD, (102) wherein the profiling device, PD, (104) is configured to perform the method (200) according to any one of claims 1 to 12 together with the local domain device, LD, (106) and the host device, HD (102).

14. A computer program product (300) comprising a non-transitory computer readable medium (302), having thereon a computer program (304) comprising program instructions, the computer program (304) being loadable into a data processing unit and configured to cause execution of the method according to any of claims 1 to 12 when the computer program is run by the data processing unit.

15. A cloud environment (10) comprising a local domain device, LD, (106) a host device, HD, (102) and a profiling device, PD, (104) wherein the cloud environment (10) is configured to perform the method (200) according to any one of the claims 1 to 12.

Images