Build Container Secret Truncation via STI Framework
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container-based computing architectures fail to effectively protect build secrets during the application image build process, as previous solutions expose these secrets once the image is built, compromising security.
Innovation Solution
The implementation of a source-to-image (STI) framework in a Platform-as-a-Service (PaaS) system truncates the configuration file containing build secrets to zero bit length after the application image is built, ensuring the secrets remain protected and are not exposed upon deployment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If the configuration file containing build secrets is retained in the build container after image building, then the build process can be simplified and reuse is enabled, but the build secrets are exposed and compromised
Solution Approach 1:
The patent extracts the harmful element (configuration file with build secrets) from the build container after the build process completes. By removing the file that contains sensitive authentication data, the system eliminates the security risk while preserving the beneficial build artifacts in the image.
Solution Approach 2:
The patent discards the configuration file containing build secrets after successful image building, while recovering and preserving the application image that was created. This selective discarding maintains the useful build output while eliminating the sensitive information.
2Reliability
If build secrets are stored in the configuration file for authentication, then secure access to private repositories is enabled, but the secrets remain accessible after image deployment
Solution Approach 1:
The patent performs a preliminary action by removing the configuration file immediately after the build process completes. This preventive measure ensures that build secrets are not accessible in subsequent deployment phases, while still allowing secure authentication during the build process.
Solution Approach 2:
The configuration file containing build secrets is treated as a disposable object that is created temporarily for the build process and then discarded. This approach prioritizes security over reuse, accepting that the file serves its purpose during building but must be eliminated afterward.
3Object-affected harmful factors
If the configuration file is truncated to zero bit length, then build secrets are completely removed and security is improved, but the file cannot be reused for future builds
Solution Approach 1:
The patent segments the build process into distinct phases: a build phase where the configuration file is needed for authentication, and a deployment phase where the file is removed. This temporal segmentation allows the file to serve its purpose when needed while being eliminated when security becomes the priority.
Solution Approach 2:
The patent uses the build image itself as an intermediary carrier that contains the application artifacts without the sensitive configuration file. The image serves as a mediator that preserves the build results while excluding the harmful secrets, enabling future builds to proceed without the original configuration file.
Data Source
AI summary
Implementations provide for a container-based architecture that can maintain build secrets. A method of the disclosure includes storing a file in a destination directory of a build container. The file includes authentication data to retrieve information from a repository. A build of an application image is initiated at a build container. The application image is built using the information retrieved from the repository via the loaded file. In response to receiving an indication that the build of the application imaged is complete, the loaded file is truncated.