5G Container Secret Injection via Metadata for Secure Runtime Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing processes for providing secrets to containers in a container management system lack security, standardization, and automation, leading to potential exposure of sensitive information and operational complexity, especially in managing network elements of a 3GPP 5G mobile network core.
Innovation Solution
A method and system for managing dynamic runtime information provision in containers, where a secret sub-unit within the container image defines metadata for secret values, enabling standardized and automated injection of secrets into containers, ensuring security and reducing operational complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secrets are provided to containers using existing processes, then containers can obtain necessary secret values, but security is compromised and operational complexity increases
Solution Approach 1:
The patent introduces a secret manager as an intermediary component that mediates between the container management system and secret storage. The secret manager receives secret provisioning requests, retrieves secrets securely, and injects them into containers through standardized interfaces, eliminating the need for direct access to secret storage by container processes and reducing operational complexity
Solution Approach 2:
The patent implements preliminary action by pre-configuring secret metadata in container images and establishing secret provisioning templates before container deployment. This allows the system to automatically determine secret requirements and provisioning parameters in advance, reducing operational complexity during container instantiation while maintaining security
2Extent of automation
If secrets are manually provisioned to containers, then flexibility is maintained, but automation is lacking and errors increase
Solution Approach 1:
The patent implements self-service by enabling container images to self-describe their secret requirements through metadata embedded in the image structure. The container management system automatically parses this metadata, determines the appropriate secret provisioning strategy, and executes the provisioning process without manual intervention, achieving both automation and precision
Solution Approach 2:
The patent incorporates feedback mechanisms where the secret manager validates secret provisioning status and provides status information back to the container management system. This feedback loop ensures that secrets are correctly provisioned and allows for automatic error detection and correction, maintaining high provisioning accuracy while automating the process
3Ease of operation
If secrets are injected into containers, then containers can function properly, but secret exposure risk increases
Solution Approach 1:
The patent extracts secrets from the container image structure and separates them into a dedicated secret management component. Secrets are stored externally in a secure secret manager rather than being embedded in container images or process memory, eliminating the exposure risk while maintaining container functionality through controlled injection only when needed
Solution Approach 2:
The patent creates an inert environment for secret storage by implementing encrypted secret repositories and using secure communication channels between the secret manager and container processes. Secrets are kept in an encrypted, inaccessible state until the moment of provisioning, minimizing exposure risk while ensuring containers receive necessary secrets for proper functionality
4Adaptability or versatility
If container images include secret sub units, then standardization is achieved, but device complexity increases
Solution Approach 1:
The patent implements universality by creating a standardized secret sub-unit structure that can be used across all container images regardless of their specific secret requirements. This single standardized format handles multiple secret types and provisioning scenarios, achieving standardization without increasing actual complexity since the same structure serves multiple purposes
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system for managing dynamic runtime information provision for a container implementing a Session Management Function (SMF) executed by an electronic device in a 3rd generation partnership project (3GPP) 5th Generation (5G) mobile network core. The method includes starting a container image load, the 5 container image including at least a secret sub unit and an application sub unit, the application sub unit providing the SMF, determining an input source to provide a secret value for the container, the input source identified by information in the secret sub unit in the container image, and providing the secret value to a destination sub unit of the container.