Container-Based Kernel Driver Updates Without Privileged Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for updating kernel drivers on self-service terminals and POS terminals require privileged access, leading to security risks and inefficiencies, and lack flexibility across varying operating systems and kernel versions.
Innovation Solution
A software container utilizing a Dynamic Kernel Make System (DKMS) within an INIT container dynamically builds and installs target drivers without privileged access, ensuring compatibility and up-to-date drivers across different environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If privileged access is used to install kernel drivers, then driver installation capability is improved, but security is worsened
Solution Approach 1:
The patent introduces a kernel module as an intermediary component that runs with privileged access to facilitate driver installation, while the main container process operates without privileged access. This mediator kernel module handles the secure communication and driver installation operations, allowing the container to gain driver installation capability without requiring the entire container process to have privileged access, thus resolving the security contradiction.
2Productivity
If drivers are pre-built for specific kernels, then installation speed is improved, but adaptability to different kernel versions is worsened
Solution Approach 1:
The patent implements a dynamic driver building mechanism where the kernel module detects the running kernel version and dynamically builds or selects the appropriate driver version. Instead of requiring pre-built drivers for every kernel version, the system adapts to the specific kernel environment and builds the suitable driver on-demand, maintaining both installation efficiency and broad kernel compatibility.
Solution Approach 2:
The system changes the parameter of driver version based on the detected kernel version. The kernel module queries the running kernel and adjusts the driver building parameters accordingly, selecting or compiling the appropriate driver version that matches the kernel. This parameter adaptation allows the system to maintain compatibility across different kernel versions without requiring manual pre-building for each version.
3Ease of operation
If manual driver updates are performed, then control over installation process is improved, but automation level is worsened
Solution Approach 1:
The patent implements a self-service mechanism where the kernel module automatically detects the need for driver updates, queries the appropriate driver version, builds the driver, and installs it without requiring manual intervention. The system monitors the kernel and driver status autonomously, performing the entire driver update lifecycle automatically while maintaining security through the container architecture.
4Object-affected harmful factors
If containers are isolated from kernel access, then security is improved, but driver installation capability is worsened
Solution Approach 1:
The patent segments the driver installation functionality into two separate components: an isolated container process that maintains security through isolation, and a privileged kernel module that handles driver installation operations. The container process communicates with the kernel module through secure interfaces, allowing the container to request driver installation without breaking its isolation boundary. This segmentation enables both security isolation and driver installation capability to coexist.
Data Source
AI summary
At least one software container element contains executable software that is executable on one or more processors of a computing device and which receives, from a kernel of the computing device, first data that is indicative of at least one active driver installed on the kernel, compares the first data with second data that is indicative of at least one predetermined target driver that should be installed on the kernel, and responsive to the comparing, determines if at least one of the predetermined target drivers is not installed on the kernel.