Runtime Injection of Aggregate User Permissions for Container Host Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Application containers face challenges in enforcing host access control rules due to their isolated nature, which compromises file permissions and access control when mounting host data volumes, leading to security and data access control issues.

Innovation Solution

A runtime information calculation and injection system is employed to extract and combine user identifiers and permissions from both the temporary container and the host, injecting the aggregate set into the working container to enforce host access control rules correctly.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If application containers are isolated to maintain security, then security is improved, but access control to host data volumes is compromised

Engineering Contradiction:

ImprovesecurityVSAvoidaccess control

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces an intermediary mechanism that extracts user identifiers and permissions from both the container and host, combines them into an aggregate set, and injects this aggregate into the working container. This mediator resolves the contradiction by enabling access control information to flow between the isolated container and host environments without breaking the isolation boundary.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the access control information into two distinct sets: user identifiers and permissions from the container environment, and user identifiers and permissions from the host environment. By processing these segments separately and then combining them, the system maintains the integrity of both isolated environments while enabling coordinated access control.

Inventive Principle:

Principle #1Segmentation

2Reliability

If container isolation is enforced, then security is improved, but file permissions and access control are compromised when mounting host data volumes

Engineering Contradiction:

ImprovesecurityVSAvoidfile permissions

Core Design Contradiction:

ReliabilityVSManufacturing precision

Solution Approach 1:

The intermediary mechanism extracts file permission information from both container and host environments, combines them into an aggregate permission set, and injects this into the working container. This ensures that file permissions are precisely controlled while maintaining container isolation and security.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10691816B2Applying host access control rules for data used in application containers

Publication Date: 2020.06.23 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Embodiments for applying host access control rules for application containers by one or more processors. A first set of user identifiers and permissions is extracted from a temporary container and a second set of user identifiers and permissions is extracted from a host on which a working container will reside. The first set and the second set of user identifiers and permissions are combined into an aggregate set of user identifiers and permissions and injected into the working container.