Container Execution Inventory for Security Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IT enterprise configuration management systems lack effective control over what code can run and what software changes are allowed, making it difficult to maintain regulatory compliance and security, especially in dynamic IT environments.
Innovation Solution
A method to maintain an inventory of executable files and containers across various execution environments on a computer system, determining which files are executable and using this inventory to control execution and manage changes, ensuring only authorized files are executed and changes are authorized.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive inventory tracking of all containers across multiple execution environments is implemented, then control over executable files and regulatory compliance is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent segments the inventory management by creating separate execution environment identifiers for different execution environments (native, Java, .NET, etc.). Each container is tracked with environment-specific metadata, dividing the complex inventory task into manageable environment-specific segments rather than treating all containers uniformly.
Solution Approach 2:
The system performs preliminary actions by maintaining an inventory of containers before execution decisions are made. The inventory is proactively updated with container metadata including execution environment information, so that authorization decisions can be made based on pre-collected data rather than gathering information at the moment of execution.
2Measurement precision
If detailed metadata is collected and maintained for each container across different execution environments, then authorization accuracy is improved, but data management complexity increases
Solution Approach 1:
The patent applies local quality by maintaining environment-specific metadata for each container. Different execution environments (native, Java, .NET) have their own specific attributes and characteristics that are captured in the inventory. This localized metadata approach provides precise authorization decisions for each environment without requiring uniform detailed tracking across all environments.
Solution Approach 2:
The system implements a universal inventory structure that can accommodate multiple execution environments through a common identifier system. The execution environment identifier serves as a universal key that links containers to their specific environment metadata, allowing the same inventory mechanism to handle diverse environment types without requiring separate management systems for each environment.
3Object-affected harmful factors
If the system tracks and controls executables across multiple execution environments, then security control is improved, but processing overhead increases
Solution Approach 1:
The system performs preliminary actions by pre-populating the inventory with container metadata including execution environment information before execution decisions are required. This advance preparation allows authorization decisions to be made by simple lookup and comparison operations rather than complex analysis at execution time, reducing processing overhead while maintaining security control.
Solution Approach 2:
The patent uses copying by maintaining an inventory record (a data copy) of each container's execution environment information. Instead of repeatedly analyzing the actual container and its environment at execution time, the system creates and maintains copied metadata in the inventory that can be quickly referenced for authorization decisions, reducing the computational burden of security checks.
Data Source
AI summary
A method is described to maintain (including generate) an inventory of a system of a plurality of containers accessible by a computer system. At least one container is considered to determine whether the container is executable in at least one of a plurality of execution environments characterizing the computer system. Each execution environment is in the group comprising a native binary execution environment configured to execute native machine language instructions and a non-native execution environment configured to execute at least one program to process non-native machine language instructions to yield native machine language instructions. The inventory is maintained based on a result of the considering step. The inventory may be used to exercise control over what executables are allowed to execute on the computer system.