Software Container Attestation and Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional software containers are susceptible to cybersecurity breaches and are often untrustworthy, posing risks to large-scale deployments, and existing efforts to secure software supply chains are sporadic and chaotic.
Innovation Solution
A system and process for securing software containers using machine-readable configuration data, involving scanning, scoring, and attestation to evaluate the security of software containers and their components, employing tools like SLSA and dm-verity to ensure integrity and trustworthiness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional software containers are used for deployment, then deployment speed and ease are improved, but security and trustworthiness deteriorate due to susceptibility to breaches and undetectable modifications
Solution Approach 1:
The patent applies preliminary action by embedding integrity verification mechanisms (dm-verity) and security attestations (SLSA) into the container image before deployment. This allows security checks to be performed proactively during the build and deployment process rather than reactively after breaches occur, maintaining deployment speed while ensuring trustworthiness through pre-configured security measures
Solution Approach 2:
The patent introduces intermediary verification layers between the container and the runtime environment. Specifically, dm-verity acts as an intermediary that verifies container image integrity, while SLSA attestations serve as intermediary trust signals. These intermediaries enable secure verification without disrupting the containerization workflow, thus maintaining ease of deployment while enhancing security
2Reliability
If security scanning and verification processes are implemented, then security trustworthiness is improved, but processing time and complexity increase
Solution Approach 1:
Security scanning and verification are performed as preliminary actions during the container build process rather than during runtime deployment. Integrity checks using dm-verity and security attestations using SLSA are embedded into the build pipeline, allowing verification to occur before the container is deployed. This shifts the time cost to the build phase, enabling faster runtime deployment while maintaining high security trustworthiness
Solution Approach 2:
The container images are made self-verifying through embedded dm-verity integrity checks and SLSA attestations. The verification process is automated and self-executing, requiring minimal manual intervention. The container itself carries its own security credentials and integrity proofs, enabling rapid automated verification that reduces processing time while maintaining high security standards
3Reliability
If component-level security evaluation is performed, then security coverage is improved, but system complexity increases due to multiple scanning and verification steps
Solution Approach 1:
The patent merges multiple security verification mechanisms into a unified container image structure. dm-verity integrity verification, SLSA security attestations, and component-level scanning are combined into a single verified artifact. This consolidation provides comprehensive security coverage while presenting a simplified interface to the deployment system, as the merged security layers work together through standardized protocols rather than as separate complex systems
Data Source
AI summary
Techniques for data security transactions using software container machine readable configuration data are described, including identifying an input to a software container and an output generated by the software container, storing the input and the output in a data container, the data container being configured to be stored in a storage volume, the storage volume also being configured to store the software container, determining a state associated with the data container, encrypting the data container using a key to generate an encrypted data container, and retrieving the software container and the encrypted data container, the version being determined by the state, when a query is received from a platform to retrieve the encrypted data container to be used to execute the software container in a container runtime.