Container Block Device Signatures for Pre-Execution Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Container runtimes have vulnerabilities that allow attackers to gain access to host machines, and conventional security techniques often fail to prevent host compromise until it's too late.
Innovation Solution
Implement a block device signature for containers, verifying the integrity of containerized applications using a single signature for all files, and enforce an integrity policy through an operating system to prevent unauthorized execution and file access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security notification techniques are used, then users are informed of malicious attacks, but the host machine or kernel is already compromised by the time notification occurs
Solution Approach 1:
The patent implements integrity measurement of containerized applications during the boot process, before the application executes. The measurement occurs at startup, allowing detection of compromised applications before they can execute malicious code and compromise the host system, thus preventing the timing issue where detection occurs too late.
2Reliability
If individual file signatures are used to verify container integrity, then security is improved, but the complexity of signing and verifying multiple files increases significantly
Solution Approach 1:
The patent merges all container files into a single squashed filesystem image and applies a single signature to this consolidated image. This eliminates the need to sign and verify individual files separately, reducing signature management complexity while maintaining comprehensive integrity verification of the entire container.
Solution Approach 2:
The patent segments the container filesystem into discrete blocks and creates a block device from these blocks. This segmentation allows the single signature to cover the entire container image efficiently, enabling verification of all container contents through one signature check rather than multiple individual file signatures.
3Reliability
If strict integrity policy enforcement is implemented, then security against malicious code is improved, but legitimate operations that violate the policy are blocked
Solution Approach 1:
The patent implements an audit mode that monitors container operations without blocking them, providing feedback on what operations occur. Based on this feedback, the integrity policy can be updated to allow legitimate operations while maintaining security against malicious activities, thus balancing enforcement with adaptability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Integrity verification of a containerized application using a block device signature is described. For example, a container deployed to a host system is signed with a single block device signature. The operating system of the host system implements an integrity policy to verify the integrity of the container when the container is loaded into memory and when its program code executes. During such events, the operating system verifies whether the block device signature is valid. If the block device signature is determined to be valid, the operating system enables the program code to successfully execute. Otherwise, the program code is prevented from being executed. By doing so, certain program code or processes that are not properly signed are prevented from executing, thereby protecting the host system from such processes. Moreover, by using a single block device signature for a container, the enforcement of the integrity policy is greatly simplified.