Container Inter-Process Communication via Segmented Device Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for inter-container communication in operating-system-level virtualization methods pose significant security vulnerabilities due to the combination of intra-container and inter-container communications.
Innovation Solution
The method involves creating a second device file accessible by the first container to route communications from a requesting process to a target process outside the container, with optional modifications to the access control database and association of security policies for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If sockets and pipes are used for inter-container communication, then communication functionality is achieved, but security vulnerabilities increase
Solution Approach 1:
The patent segments inter-container communication by creating separate device files for different communication paths. Instead of using general-purpose sockets and pipes that combine intra-container and inter-container communications, the system divides communication into distinct channels through dedicated device files, thereby isolating security contexts and reducing vulnerability propagation.
Solution Approach 2:
The patent introduces device files as intermediary objects between containers for communication. These device files act as controlled interfaces that mediate data flow between containers, allowing the host computing system to enforce security policies and access control rules at the interface level, thus reducing direct exposure and security vulnerabilities.
2Device complexity
If a single device file is used for both intra-container and inter-container communication, then device simplicity is maintained, but security boundaries are compromised
Solution Approach 1:
The patent applies segmentation by creating multiple device files to handle different communication scenarios. Instead of using a single device file for all communication purposes, separate device files are created for intra-container and inter-container communications, maintaining clear security boundaries while managing complexity through structured organization.
Solution Approach 2:
The patent implements local quality by assigning different security attributes and access control policies to different device files based on their specific communication purposes. Each device file can have tailored security configurations appropriate to its function, allowing fine-grained security control without requiring complete system-wide complexity.
Data Source
AI summary
The present disclosure provides systems, methods, and computer-readable media for mediating communications between two processes not running in a common container. A request from a requesting process running in a first container to communicate with one or more target processes outside the first container is received, and a device file accessible to the first container is created. The inter-container communication is then routed from the requesting process through the created device file, and on to the target process.