Container Directory and Interface Policies for Authorized Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Unauthorized access and unauthorized modification or spying out of container instances, particularly regarding file systems and network interfaces, is a challenge due to the lack of control over subdirectory and network interface allocations in container instances.

Innovation Solution

Implementing directory and interface policies that enforce incorporation rules for subdirectories and network interfaces, ensuring only authorized container instances can access specific directories and interfaces by checking against a central incorporation database before instance generation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If container instances are allowed to access shared subdirectories and network interfaces freely, then resource utilization and ease of operation are improved, but security and reliability deteriorate due to unauthorized access and data interception

Engineering Contradiction:

Improveease of container instance operationVSAvoidsecurity of container instance

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The system performs preliminary actions by creating incorporation rules and policies for subdirectories and network interfaces before container instances are deployed. These rules are stored in a database and used to pre-validate authorized access relationships, ensuring security is established before any potential unauthorized access can occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary validation mechanism that acts as a mediator between container instances and shared resources. The incorporation rules and policies serve as intermediary layers that control and regulate access, preventing direct unauthorized access while maintaining authorized communication channels.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If container instances can share network interfaces, then resource utilization improves, but the risk of unauthorized data interception and spying increases

Engineering Contradiction:

Improveresource utilization efficiencyVSAvoidunauthorized data interception

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system establishes network interface incorporation rules and validation policies before container instances are deployed. These preliminary security configurations ensure that only authorized container instances can access specific network interfaces, preventing unauthorized data interception while maintaining efficient resource sharing.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary validation mechanism that controls network interface access. This intermediary layer validates each access request against pre-defined incorporation rules, allowing legitimate traffic while blocking unauthorized interception attempts.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If subdirectories are mounted into container instances for persistent storage, then data persistence and functionality are improved, but vulnerability to unauthorized access and modification increases

Engineering Contradiction:

Improvecontainer instance functionalityVSAvoidunauthorized access and modification

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The system creates subdirectory incorporation rules and validation policies before container instances are deployed. These rules pre-define which subdirectories can be accessed by which container instances, ensuring that persistent storage functionality is established with built-in security constraints from the outset.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary validation mechanism that controls subdirectory access. This intermediary layer ensures that only authorized container instances can access and modify specific subdirectories, preventing unauthorized access while maintaining the necessary functionality for data persistence.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12547441B2Protection of a process of setting up a subdirectory and a network interface for a container instance

Publication Date: 2026.02.10 SIEMENS AG

AI summary

A method for protecting a process of setting up a subdirectory and/or a network interface for a container instance for providing a container-based application, is provided including—generating a directory guideline which includes at least one incorporation rule for assigning the subdirectory of the container instance to the subdirectory in the source directory; and/or generating an interface guideline which includes at least one incorporation rule for assigning the network interface of the container instance to the network interface of the associated host computer, loading a container image, an associated configuration file and the directory guideline and/or the interface guideline into a runtime environment of the host computer, checking, before the process of starting the container instance, and—generating the container instance from the container image in the host computer only in the event of a positive checking result.