Application-Specific Encryption for Software Container Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software containers face security challenges due to variability in content and shared resources, making it difficult to ensure integrity and detect malicious activity, particularly in shared computing systems with common operating system kernels and resources, where access control and encryption are needed on a granular per-application basis.
Innovation Solution
Implementing application-specific encryption and access control within software containers using a security agent that generates unique encryption keys for each application and manages access control rules, allowing for secure execution of multiple applications with different security provisions in a single container.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If whole container encryption is implemented, then security of applications and data is improved, but flexibility to execute multiple different applications with different access control provisions is lost
Solution Approach 1:
The patent segments the container into multiple namespaces, each namespace containing specific applications and data. Each namespace is encrypted separately with its own encryption key, allowing different security policies to be applied to different applications within the same container while maintaining overall container security.
Solution Approach 2:
The patent implements local quality by applying different encryption keys and access control policies to different namespaces within the container. Each namespace can have customized security provisions tailored to its specific applications, rather than applying a uniform encryption scheme to the entire container.
2Adaptability or versatility
If container content is made variable to accommodate different applications, then adaptability is improved, but integrity verification and malicious activity detection become difficult
Solution Approach 1:
The patent performs preliminary action by generating cryptographic hashes of namespace metadata and configuration data before the container executes. These hashes are stored and used for verification, allowing the system to detect any unauthorized modifications to the container content while still permitting legitimate variations in application content.
Data Source
Figure 1~2
Figure 3
AI summary
A computer implemented method of securing an application executing in a software container deployed in a computer system, the method comprising: identifying at least one application executing in the container; determining an application installation path for the application as a location in a container data storage facility at which the code for the application at least partially resides; generating an encryption key for the application; determining a data path for the application as a location in the container data storage facility at which data processed or generated by the application at least partially resides; securely communicating an identifier of the container, the application path, the data path and the generated encryption key for secure storage by a security component external to the container; securely receiving, from the security component, one or more access control rules defining computing components authorised to access the application; encrypting the application path and the data path using the generated key; and providing access to the application selectively in accordance with the access control rules by sharing the encryption key with authorised accessors.