Container File System Control-Level Tagging for Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current container technologies suffer from inadequate file system isolation, leading to vulnerabilities that can be exploited by attackers, compromising system security.
Innovation Solution
Implement a control level tagging method and system by tagging container directory entries in a virtual file system with distinct control levels to enhance isolation, including first, second, and third control levels for container, shared volume, and host file systems, and dynamically tag path control levels during access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If container technology is used to improve resource utilization and portability, then resource efficiency and deployment flexibility are improved, but file system isolation effect deteriorates, creating security vulnerabilities
Solution Approach 1:
The patent applies segmentation by dividing the file system into multiple control levels (first control level for container files, second control level for shared volume files, third control level for host files). This segmentation creates distinct isolation zones that prevent attackers from exploiting file system vulnerabilities to escape containers or access unauthorized resources, thereby maintaining both resource utilization and security isolation.
2Device complexity
If traditional container file system management is used, then system simplicity is maintained, but security against path access attacks and container escape deteriorates
Solution Approach 1:
The patent introduces control level tags as an intermediary mechanism between the container file system and the host file system. These tags act as mediators that enable the system to distinguish between different types of files and apply appropriate access control policies, thereby preventing path access attacks and container escape without fundamentally altering the underlying container file system architecture.
Solution Approach 2:
The patent applies parameter changes by adding control level parameters to directory entries in the file system. By changing the parameter structure of file system objects to include control level information, the system can dynamically control access permissions and implement security policies while maintaining compatibility with existing container file system operations.
3Reliability
If control level tagging is implemented to enhance isolation, then security against path access attacks and container escape is improved, but system complexity increases
Solution Approach 1:
The patent applies universality by designing control level tags that serve multiple functions simultaneously: they provide security isolation, enable access control decisions, and maintain file system hierarchy information. This multi-functionality reduces the need for separate security mechanisms, thereby improving container isolation without proportionally increasing system complexity.
Data Source
AI summary
A method comprises: determining a container directory entry in a container virtual file system corresponding to a container, where the container virtual file system is configured to manage at least one file corresponding to the container, and has a container directory entry that reflects a hierarchical relationship between the at least one file; and tagging the container directory entry in the container virtual file system as a first control level, to make a distinction from a control level of a directory entry that is different from that in the container virtual file system and that is in a host virtual file system of a processing device, where the host virtual file system is configured to manage files in the processing device, and has a directory entry that reflects a hierarchical relationship between the files in the processing device.