Container Image Instantiation with Isolated Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Containers face security challenges when instantiated on multiple devices, as adversaries can tamper with assurance mechanisms, compromising data integrity and provenance, making it difficult to verify the security and origin of container images.
Innovation Solution
Implementing isolated assurance mechanisms where verification information and logs are part of the container image's file system hierarchy, allowing for secure verification and integrity checking outside the container, even when instantiated on remote machines, ensuring that assurance data cannot be tampered with by running services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If containers are instantiated on multiple devices for flexible deployment, then adaptability and deployment flexibility improve, but security and data integrity deteriorate because adversaries can tamper with assurance mechanisms on remote machines
Solution Approach 1:
The patent extracts assurance mechanisms (verification programs, verification information, and logs) from the container image and stores them separately in a read-only location on the host device. This separation allows containers to be instantiated on multiple devices while protecting assurance data from tampering, as the read-only storage prevents adversaries from modifying verification mechanisms on remote machines.
2Ease of operation
If verification information and logs are included in the container image, then ease of verification improves, but security deteriorates because running services inside the container can tamper with assurance data
Solution Approach 1:
The patent extracts verification programs and logs from the container image file system and stores them in a read-only location on the host device. This extraction prevents running services inside the container from tampering with assurance data while maintaining verification convenience, as the host device can still access and use the extracted verification mechanisms.
Solution Approach 2:
The patent implements preliminary anti-action by storing verification information and logs in read-only storage before the container runs. This pre-established protection prevents any subsequent tampering attempts by services inside the container, as the read-only permission is set in advance and cannot be changed by processes running within the container.
3Reliability
If assurance mechanisms are isolated from the container file system, then security against tampering improves, but device complexity increases due to separate storage management
Solution Approach 1:
The patent uses the host device's file system as an intermediary to store verification information and logs in a read-only location. This intermediary approach simplifies storage management compared to completely separate storage systems, as it leverages the existing host file system infrastructure while still providing isolation and protection from container processes.
Data Source
AI summary
Example embodiments relate to instantiating containers. For example, in an embodiment, integrity of a container image may be verified by executing a verification program using verification information associated with the container image. Provenance of the container image may be verified by checking a log associated with the container image. A container may be instantiated from the container image by loading a file system associated with the container image. The file system associated with the container image may be isolated from the verification information and the log.