Client-Side RAM Encryption for Container Image Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for securing container images in a container registry fail to protect against internal malicious attacks by the administrator or clumsy handling, and encrypting at the client machine limits functionality when the decryption key is not stored securely.

Innovation Solution

Encrypting container images on the client machine's RAM before transmission to the server and decrypting them in the same RAM upon download, with the encryption/decryption key being inaccessible on mass memory and the server, and using a symmetric key for faster operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If encryption is carried out at the level of the server machine (container registry), then the container images can be stored securely against external threats, but the confidentiality of the container images is not ensured vis-à-vis the administrator of the container registry

Engineering Contradiction:

Improvesecurity against external threatsVSAvoidinternal malicious attacks by administrator

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The encryption key is extracted from the server-side storage system and placed exclusively in the client machine's RAM. The key never resides on the server machine or in persistent storage, thereby removing the vulnerability to administrator access while maintaining encryption security against external threats

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The client machine's RAM acts as an intermediary between the encryption key and the container image. The key is temporarily held in volatile memory during encryption/decryption operations and then discarded, preventing any persistent storage vulnerability while enabling secure operations

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If encryption is carried out at the level of the client machine, then confidentiality is ensured against administrators, but the decryption operation becomes difficult if the decryption key is not stored on the client machine

Engineering Contradiction:

Improveprotection against administrator accessVSAvoiddecryption operation accessibility

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The decryption key is made dynamic by loading it into the client machine's RAM only when needed for decryption operations. The key exists temporarily in volatile memory during the operation and is then discarded, providing both security against administrator access and ease of operation when needed

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The state of the decryption key changes from persistent storage to temporary volatile storage. By changing the storage medium from non-volatile (hard drive) to volatile (RAM), the system achieves both security (key disappears on reboot) and operational ease (key is readily available when loaded)

Inventive Principle:

Principle #35Parameter changes

3Ease of operation

If the decryption key is stored on the compute node with its password, then decryption operations are easy to perform, but confidentiality is no longer ensured with regard to the administrators of the compute nodes

Engineering Contradiction:

Improvedecryption key availabilityVSAvoidinternal threats from compute node administrators

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The decryption key is extracted from the compute node's persistent storage system and placed exclusively in the client machine's RAM. This removal of the key from the compute node eliminates the vulnerability to administrator access while maintaining operational capability through temporary loading

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The decryption key is treated as a short-lived object that exists only temporarily in the client machine's RAM during decryption operations. The key is discarded after use and does not persist, providing security against administrator access while enabling easy operation during the brief period it is needed

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentEP3623979B1Method for secure storage in a network of an image of a container in a directory of containers

Publication Date: 2023.11.01 BULL SA

Figure 1~2
Figure 3

AI summary

The invention relates to a method for securely storing, in a network (1), a container image (22) in a container register (20), comprising a step of sending (11) a container image (22), this container image (22) corresponding to an initial state of a client machine environment from which this container can then be executed, from a client machine (3) of the network (1) to a container register (20) of a server machine (4) of the network (1) remote from the client machine (3), characterized in that the storage method also comprises a step of encrypting this container image (20), carried out in the RAM of the client machine (3), before the step of sending (1) to the server machine (4), so that said container image (22) is already encrypted when it is received by the container register (20) to be stored therein,and in that the encryption key (25) of this container image (22) is usable in the RAM of the client machine (3), inaccessible in the mass storage of the client machine (3) and inaccessible on the server machine (4).