Container Image Trust Evaluation via Intermediary Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems that execute containers are vulnerable to deploying malicious container images, which can be introduced during the build process or downloaded from untrusted third-party registries, posing a risk to system security.
Innovation Solution
A method is implemented to protect the computer system by evaluating the trustworthiness of container images through an image evaluation service, which checks images against a database of known trustworthy and malicious images, and employs machine-learning algorithms to assess unknown files, thereby preventing the deployment of untrustworthy images.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If container images are downloaded from third-party registries or built from software packages, then the computer system can deploy and execute containers, but the system becomes vulnerable to malicious images that may contain harmful files
Solution Approach 1:
The patent implements image evaluation and security scanning before containers are deployed. The system evaluates images from third-party registries or newly built images before allowing execution, checking for malicious files and verifying trustworthiness. This preliminary security check prevents malicious images from being deployed while maintaining the ability to use external image sources.
Solution Approach 2:
The patent introduces an image evaluation service as an intermediary between the container deployment system and the images. This service acts as a mediator that scans, evaluates, and verifies images before they are executed by the container runtime, providing a security buffer without blocking legitimate deployment operations.
2Reliability
If an image evaluation service is implemented to scan and verify container images before deployment, then system security is improved, but the deployment process time increases
Solution Approach 1:
The system performs image evaluation in advance before deployment is requested. By pre-scanning and caching security evaluation results, the system avoids repeating full scans during deployment, reducing the time impact while maintaining security.
Solution Approach 2:
The image evaluation service likely implements incremental scanning or selective evaluation, focusing on critical components of images rather than performing exhaustive analysis on every single file. This partial evaluation approach provides sufficient security protection while reducing processing time.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of protecting a computer system (100) from execution of container images that are not trustworthy, the method comprising: receiving a message from an application programming interface (API) server of a container orchestration system of the computer system (100), wherein the message indicates that a first container image has been requested for deployment; in response to receiving the message from the API server (142) that the first container image has been requested, transmitting a request to an image evaluation service (162) to evaluate whether the first container image is trustworthy for execution; and in response to receiving an indication from the image evaluation service (162) that the first container image is not trustworthy, transmitting to the API server (142), an instruction not to deploy containers using the first container image.