Container Execution Policy Validation via Signature Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualization systems face challenges in reducing resource overhead while maintaining security, and containers introduce risks such as tampering and lack of control over accessed content.
Innovation Solution
A central management system validates container signatures and encryption keys stored outside the container runtime, allowing independent evaluation and approval, and controls user access to containers based on execution policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If virtualization is used to allocate hardware resources among multiple users, then resource efficiency is improved, but resource overhead remains significant
Solution Approach 1:
The patent segments the container execution process into distinct phases: validation phase (checking signatures and manifests before execution) and execution phase (running the container). This segmentation allows security validation to occur separately from resource allocation, enabling more efficient resource management while maintaining security controls.
Solution Approach 2:
The patent implements preliminary validation actions before container execution by verifying digital signatures, checking manifests, and validating security policies in advance. This preliminary action ensures that only authenticated and authorized containers are executed, reducing the need for ongoing security overhead during runtime and improving overall resource efficiency.
2Loss of energy
If attempts are made to reduce resource overhead, then resource efficiency improves, but security is weakened
Solution Approach 1:
The patent introduces an intermediary validation layer between resource allocation and container execution. This intermediary checks digital signatures, validates manifests, and verifies security policies without requiring continuous resource overhead during execution. The intermediary acts as a gatekeeper that maintains security while allowing efficient resource utilization once validation is complete.
Solution Approach 2:
Security validation actions are performed preliminarily before container execution, including signature verification, manifest validation, and policy checking. By completing these security actions in advance, the system reduces ongoing security overhead during runtime while maintaining strong security controls, thus resolving the contradiction between resource efficiency and security.
3Speed
If containers are executed without validation, then execution speed is improved, but security risks increase due to tampering and lack of control
Solution Approach 1:
The patent performs validation actions preliminarily before container execution, including verifying digital signatures, checking manifests for tampering, and validating security policies. By completing these validation steps in advance, the system ensures security and authenticity without compromising execution speed, as the validation overhead occurs before the execution phase begins.
Solution Approach 2:
An intermediary validation mechanism is introduced between the container request and execution phases. This intermediary quickly verifies digital signatures and checks manifests for tampering, providing security assurance without significantly impacting execution speed. The intermediary acts as a fast gatekeeper that maintains security while enabling rapid container deployment.
Data Source
AI summary
In one embodiment, a method is performed by a computer system. The method includes receiving a request to execute a particular container. The method further includes retrieving a manifest of the particular container from a data store, the manifest indicating a plurality of items included in the particular container. In addition, the method includes validating one or more signatures of the container that are associated with the items indicated in the manifest. Also, the method includes determining an execution context of the request. Further, the method includes accessing an applicable execution policy for the determined execution context. Additionally, the method includes, responsive to a determination that the applicable execution policy is satisfied, causing the particular container to be installed on a target resource.