Containerized Application Validation via Hash Comparison

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current software management systems for containerized applications lack effective security measures to validate and authorize applications at boot-up, download, and runtime execution, making them vulnerable to non-approved or malicious containers.

Innovation Solution

An apparatus and method that utilize a validator service on customer premises equipment (CPE) and a validator broker on a server to perform validation checks using Secure Hash Algorithm (SHA) and Message-Digest (MD) hashes, ensuring that only authorized containerized applications are executed by verifying their integrity and authenticity through a public key-based validation process.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If software management systems implement basic lifecycle management of containerized applications, then application deployment and management capabilities are improved, but security vulnerabilities to malicious containers remain unresolved

Engineering Contradiction:

Improvecontainerized application management capabilityVSAvoidsecurity against malicious containers

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary validation actions by computing hash identifiers of containerized applications and comparing them against authorized lists before execution. This preventive measure ensures that only approved containers can be deployed, blocking malicious containers before they can execute harmful code.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary validation mechanism that acts as a mediator between the containerized application and the execution environment. The hash identifier comparison system serves as this intermediary, verifying application integrity and authorization status before allowing execution, thereby securing the system without preventing legitimate application management.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If hash validation and server interaction checks are implemented for every containerized application, then security against unauthorized applications is improved, but system complexity and processing overhead increase

Engineering Contradiction:

Improvevalidation of authorized applicationsVSAvoidsecurity validation system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system performs preliminary hashing of containerized applications and stores these hash identifiers for quick comparison. By pre-computing and caching hash values, the system avoids repeated complex validation computations during execution, reducing processing overhead while maintaining security.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses lightweight hash identifiers as disposable validation tokens instead of performing heavy cryptographic verification for each execution check. These simple hash comparisons serve as cheap, fast validation mechanisms that can be repeatedly applied without significant computational cost, simplifying the overall system complexity.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Reliability

If hash identifiers are computed and validated at boot-up, download, and runtime, then comprehensive security coverage is improved, but processing time and system performance deteriorate

Engineering Contradiction:

Improvesecurity coverage across application lifecycleVSAvoidvalidation processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system implements periodic validation at specific lifecycle events (boot-up, download, runtime) rather than continuous verification. This event-driven approach ensures comprehensive security coverage at critical transition points while avoiding unnecessary validation during stable operation phases, thereby reducing overall processing time.

Inventive Principle:

Principle #19Periodic action

Solution Approach 2:

Validation preparations such as hash computation are performed preliminarily at earlier lifecycle stages (e.g., computing hashes during download before runtime execution). This staging of validation tasks distributes processing load across different time points, preventing performance deterioration at any single moment while maintaining comprehensive security coverage.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12095923B2Securing containerized applications

Publication Date: 2024.09.17 NOKIA SOLUTIONS & NETWORKS OY

AI summary

Various example embodiments for supporting security for containerized applications may be configured to support security for containerized applications deployed to customer devices. Various example embodiments for supporting security for containerized applications that are deployed to customer devices may be configured to properly secure and validate containerized applications that are deployed to customer devices. Various example embodiments for supporting security for containerized applications that are deployed to customer devices may be configured to secure and validate containerized applications that are deployed to customer devices based on a framework configured to monitor and secure download of containerized applications to protect against the download of non-approved or malicious containers and to monitor and secure the run-time execution of containerized applications in various types of execution environments, thereby providing a capability to verify that the containerized applications are approved and authorized by the service provider and that the customer device has not been compromised.