Software Container File System Verification Against Unauthorized Changes

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional software containers are susceptible to cybersecurity breaches and unsuitable for large-scale deployment due to vulnerabilities that can be exploited without leaving a trail of corrupted configuration data, posing a risk to software supply chains.

Innovation Solution

A system and method for securing software containers using machine-readable configuration data, involving a platform that scans and scores software containers for security threats, applies integrity checks using SquashFS and dm-verity modules, and generates attestation to ensure trustworthiness, thereby preventing unauthorized modifications and ensuring secure deployment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If conventional software containers are used for deployment, then deployment speed and ease are improved, but security vulnerability and susceptibility to breaches worsen

Engineering Contradiction:

Improvedeployment speedVSAvoidsecurity vulnerability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent applies preliminary action by performing integrity verification of container configuration data before deployment. The system scans and verifies configuration files (dockerfile, Docker Compose, Kubernetes manifests) using hash comparison against stored reference values, preventing compromised containers from being deployed in the first place

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary verification system that acts as a mediator between container creation and deployment. This system includes configuration data scanners, hash generators, and verification modules that intercept and validate container configurations before they reach the deployment stage

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If security scanning and verification processes are added to software containers, then security and integrity are improved, but system complexity and processing time worsen

Engineering Contradiction:

Improvesecurity integrityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies segmentation by dividing the security verification process into distinct modular components: configuration data identification, hash generation, hash storage, and hash verification. Each module performs a specific function, making the overall complex system manageable and maintainable

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent uses copying by creating hash copies of configuration data instead of storing and comparing entire configuration files. This approach simplifies the verification process by working with compact hash values rather than large configuration datasets

Inventive Principle:

Principle #26Copying

3Measurement precision

If integrity verification using hash comparison is implemented, then detection of unauthorized changes is improved, but processing overhead and computational resources worsen

Engineering Contradiction:

Improvedetection accuracyVSAvoidcomputational overhead

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent applies copying by generating and storing hash copies of configuration data instead of storing and comparing the actual configuration files. This reduces computational overhead significantly while maintaining detection accuracy, as hash comparison is much less resource-intensive than full file comparison

Inventive Principle:

Principle #26Copying

4Reliability

If software containers are secured against exploitation, then security and trustworthiness are improved, but ease of deployment and operational simplicity worsen

Engineering Contradiction:

ImprovetrustworthinessVSAvoiddeployment simplicity

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent applies self-service by enabling the system to automatically verify its own configuration integrity without external intervention. The verification system autonomously scans configurations, generates hashes, compares them against stored values, and blocks deployment if discrepancies are detected, making security verification as simple as the deployment process itself

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12579296B2Data security transactions using software container machine readable configuration data

Publication Date: 2026.03.17 SYLABS IP HOLDINGS LLC SERIES G

AI summary

Techniques for data security transactions using software container machine readable configuration data are described, including transmitting a query from a platform to a container registry, receiving a software container as responsive data transmitted from the container registry to the platform, parsing the software container to identify a data structure associated with a first file system of the software container, rewriting the first file system to a second file system, the second file system being annotated with dm-verity data, executing the software container in a runtime environment, evaluating the second file system after being validated to check a data block in the second file system of the software container to determine if the data block associated with the software container has been modified, and applying a corrective action to the data block if the data block has been modified.