Container Host Communication Gateway for Isolation Reliability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In embedded applications using container-based virtualization, there is a need for inter-process communication between containers and the host machine while minimizing the risk of accidental file deletion or OS setting changes, which are potential issues with existing methods that reduce container isolation.
Innovation Solution
An information processing apparatus with a controller that includes a processor and memory for storing communication methods associated with containers and processes, enabling controlled communication between containers and host processes through a reception unit, obtaining unit, and transmission unit, which receives and transmits data based on stored communication methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the isolation feature of the container is decreased to enable hardware control and inter-process communication with the host machine, then communication capability is improved, but system reliability deteriorates due to risks of accidental file deletion and OS setting changes
Solution Approach 1:
The patent introduces a gateway as an intermediary component between containers and the host machine. The gateway manages and controls access requests from containers to the host, acting as a mediator that enables communication while maintaining security. The gateway validates requests, determines appropriate communication methods, and executes transmissions only through approved channels, thus preventing direct access that could cause system damage.
Solution Approach 2:
The system implements self-service mechanisms where the gateway autonomously manages communication routing and method selection. The gateway automatically determines the appropriate communication method based on the target process location (host or container) and handles the transmission without requiring direct container-to-host access. This self-managing approach reduces the need for decreased isolation while enabling necessary communication.
2Productivity
If direct access from container to host machine is enabled for inter-process communication, then communication efficiency is improved, but device complexity increases due to security management requirements
Solution Approach 1:
The patent merges the security management functionality into the gateway, which consolidates multiple responsibilities including access control, communication method determination, and transmission management. By combining these functions in a single intermediary component, the system reduces overall complexity compared to implementing separate security mechanisms for each container-host interaction. The gateway becomes a centralized security management point that simplifies the architecture.
3Reliability
If container isolation is maintained to prevent system damage, then system reliability is improved, but communication capability between container and host machine deteriorates
Solution Approach 1:
The patent segments the communication path into distinct stages: container to gateway, gateway processing, and gateway to host machine. This segmentation allows the container to maintain isolation while still achieving communication goals. The gateway segment acts as a buffer that preserves container security boundaries while enabling controlled interaction with the host, thus maintaining both reliability and communication capability.
Data Source
AI summary
An information processing apparatus includes a first obtaining unit that references a first storage unit and obtains a communication method of communication data corresponding to a transmission source information and transmission destination information included in data received by a reception unit, and a second obtaining unit that references a second storage unit and obtains the content of transmission destination corresponding to the transmission source information and the transmission destination information included in the received data. The content of the transmission destination indicates destination information used in the obtained communication method, and a transmission unit transmits, to a container or a process of the transmission destination indicated by the transmission source information included in the received data, the communication data according to the communication method obtained by the first obtaining unit and the content of transmission destination obtained by the second obtaining unit.