Container IPC Identifier Translation for Security Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Managing security and isolating inter-process communications (IPCs) between containers in a containerized environment is challenging, especially when shared resources and host operating system services are involved, leading to potential data exposure to undesirable processes.

Innovation Solution

A container management service identifies and translates IPC object identifiers, ensuring that IPCs are segregated by generating a second identifier specific to each container, allowing only authorized containers to access IPC objects, thus preventing improper data access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If containers share host operating system services and resources, then resource utilization efficiency is improved, but security isolation between containers deteriorates

Engineering Contradiction:

Improveresource utilization efficiencyVSAvoidsecurity isolation

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent introduces a container management service as an intermediary layer between containers and host operating system services. This service translates IPC object identifiers and manages access requests, allowing containers to share host services while maintaining security isolation through controlled access mechanisms.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If IPC objects are made accessible to multiple containers, then inter-container communication capability is improved, but unauthorized data access risk increases

Engineering Contradiction:

Improveinter-container communication capabilityVSAvoidunauthorized data access risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies local quality by making IPC objects accessible to different containers based on their specific authorization. The container management service determines access permissions on a per-container basis, allowing legitimate inter-container communication while preventing unauthorized access to specific IPC objects.

Inventive Principle:

Principle #3Local quality

3Reliability

If container management enforces strict access control, then security is improved, but system complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The container management service performs multiple functions including identifier translation, access control enforcement, and IPC object management through a single unified mechanism. This multi-functionality reduces overall system complexity compared to implementing separate security mechanisms for each container.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11030025B2Managing inter-process communications in a containerized application environment

Publication Date: 2021.06.08 OMNISSA LLC

AI summary

Described herein are systems, methods, and software to enhance the management of inter-process communications (IPCs) for containers according to an implementation. In one implementation, a container management service executing on a host with a plurality of containers may identify an IPC object generation with a first identifier from one of the containers. Responsive to the request, the service may translate the first identifier into a second identifier, and store the IPC object in a memory system using the second identifier. Once stored, requests may be made from applications in approved containers for the object using the first identifier, and the service may retrieve the IPC object using the second identifier.