Container Introspection via Custom Function Library Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based computing services face challenges in performing security analyses, such as data-loss-prevention and intrusion detection, due to encrypted communications within application containers, which prevent the operating system and other software outside the container from inspecting the data.
Innovation Solution
Implementing custom functions within a function library to intercept and decrypt data transferred between an application container and an external data source, providing an unencrypted version to external applications for inspection while maintaining encryption for secure transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted communications are used within application containers, then security of data transmission is improved, but the ability of external applications to inspect the data for security analyses deteriorates
Solution Approach 1:
The patent introduces a custom function library as an intermediary component between the application container and external applications. This library includes custom versions of functions that intercept data transfers, provide unencrypted copies to external applications for inspection, and then proceed with the encrypted transfer. The intermediary enables both encrypted communication and external inspection without compromising either function.
2Difficulty of detecting and measuring
If custom functions are implemented to provide unencrypted data copies, then the ability to perform security analyses is improved, but the complexity of the system increases
Solution Approach 1:
The custom function library serves multiple functions simultaneously: it intercepts data transfers, provides unencrypted copies to external applications, maintains encrypted communication channels, and enables security policy enforcement. By consolidating these multiple functions into a single library component, the patent reduces overall system complexity compared to implementing separate mechanisms for each function.
3Difficulty of detecting and measuring
If data is provided in unencrypted form to external applications, then inspection capability is improved, but the security risk during data handling increases
Solution Approach 1:
The custom function library performs preliminary actions by intercepting data at the source and providing unencrypted copies to external applications before the data is transmitted through the encrypted channel. This preliminary provision of inspection capability allows security analyses to be performed on the unencrypted data while the actual transmission remains secure, eliminating the need to handle unencrypted data throughout the entire process.
Data Source
AI summary
The disclosed computer-implemented method for performing application container introspection may include (1) identifying a request issued by an application launched from an application container, (2) determining that the request calls a function that facilitates transferring data between the application container and at least one external data source, and then in response to determining that the request calls the function, (3) directing the request to a function library that includes a custom version of the function that facilitates both (A) transferring, between the application container and the external data source, an encrypted version of the data that is unintelligible to an external application running outside the application container and (B) providing an unencrypted version of the data to the external application to enable the external application to inspect the data. Various other methods, systems, and computer-readable media are also disclosed.