Container Image Verification via Digital Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current container engine systems lack a uniform method for authorization and verification of container images, leading to poor compatibility and ease of bypassing verification. Additionally, existing solutions for verifying software running in containers are inconvenient, difficult to manage, and cannot handle cases where different container images share host files.
Innovation Solution
A container platform-oriented trusted software authorization and verification system that includes a public key infrastructure builder, container image identity builder, signature list builder, container image verifier, signature list and user certificates loader, and container program verifier. This system generates and verifies container images and software running in containers using digital signatures and user certificates, ensuring the integrity and trustworthiness of container images and programs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital signature algorithms are used to verify container images, then the security and integrity of container images are improved, but the complexity of the verification system increases
Solution Approach 1:
The verification system is segmented into multiple specialized components: a signature verification module that handles digital signature validation, a trust policy enforcement module that manages access control, and a container runtime module that executes containers. This segmentation allows each component to focus on a specific security function, improving overall reliability while managing complexity through modular design.
Solution Approach 2:
Security verification is performed in advance before container execution. Container images are verified against trusted policies during the build and push phases, and signatures are validated before runtime. This preliminary action ensures that only trusted images can be executed, improving security without adding complexity during the actual container execution phase.
2Reliability
If IMA namespacing scheme is used to verify software in containers, then the trustworthiness of running software is improved, but the difficulty of key management and cache design increases
Solution Approach 1:
The complex key management and cache design responsibilities are extracted from the container runtime and delegated to the host system's security modules. The host system maintains the trusted keys and verification caches, while the container runtime focuses on executing verified containers. This extraction simplifies the container runtime's complexity while maintaining software trustworthiness through host-level security enforcement.
Solution Approach 2:
The host system acts as an intermediary between the container images and the verification mechanism. The host system's security modules (such as IMA on Linux) manage the verification keys and caches at the host level, mediating the trust relationship between container images and the execution environment. This intermediary approach allows container-level verification without requiring complex key management within each container runtime.
3Difficulty of detecting and measuring
If periodic scanning is used to detect security issues in containers, then the detection capability is improved, but the response time to prevent malicious programs increases
Solution Approach 1:
Security verification is performed in advance before containers are executed. Container images are scanned and verified against trusted policies during the build and push phases, and digital signatures are validated before runtime. This preliminary action ensures that malicious programs are detected and blocked before they can execute, improving both detection capability and response time by preventing rather than merely detecting attacks.
4Ease of operation
If selective verification schemes are used in container engines, then the ease of operation is improved, but the reliability of verification decreases as users can easily bypass it
Solution Approach 1:
The system preemptively prevents bypass attempts by embedding verification checks at multiple mandatory stages: during image build, during image push to registries, and before container execution. The trust policy enforcement is integrated into the container runtime itself, making it impossible to bypass verification without breaking the container execution process. This preliminary anti-action maintains both ease of operation (automatic verification) and reliability (cannot be bypassed).
Data Source
AI summary
The system provided in the present application includes a public key infrastructure builder, a container image identity builder, a signature list builder, a container image verifier, a signature list and user certificates loader, and a container program verifier. The method provided in the present application is capable of conveniently authorizing container images and software running in the container, and verifying the container images and programs in the container at the right time, so as to ensure that container images running on the container platform are trusted, and the software running in the container is also trusted, thereby improving the security of the container platform.