Container Lifecycle Hooks for Decryption Without Key Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container technologies face challenges in protecting sensitive data from unauthorized access, particularly during runtime, as keys used for encryption can be exposed via docker images or disk encryption methods.
Innovation Solution
Implement lifecycle hooks to create isolated containers that decrypt data before application containers are ready for running, using keys managed by a key management device, and encrypt data back before deletion, ensuring data is only in decrypted form temporarily within the container.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in decrypted form in container, then application can access data, but data is exposed to unauthorized users
Solution Approach 1:
Data is pre-decrypted in a temporary container before the application container is ready, and the decrypted data is then mounted into the application container. This preliminary decryption action ensures data is accessible to the application while minimizing the time window for potential exposure.
Solution Approach 2:
A temporary container acts as an intermediary between the encrypted data storage and the application container. This intermediary container performs the decryption operation and then transfers the decrypted data, preventing the application container from directly handling encryption keys and reducing exposure risk.
2Ease of operation
If encryption key is stored in docker image, then decryption is convenient, but key is exposed to unauthorized users
Solution Approach 1:
The encryption key is extracted from the docker image and stored separately in a secure key management system. The temporary container retrieves the key from this external secure storage only when needed for decryption, and the key never resides in the application container or docker image, eliminating the exposure risk while maintaining decryption convenience.
Solution Approach 2:
A key management system serves as an intermediary between the encrypted data and the application. The temporary container acts as a mediator that temporarily holds the key during decryption operations, then immediately discards it, ensuring the key is never stored in the application container or docker image.
3Object-affected harmful factors
If disk encryption is used, then data is protected at rest, but data access performance is reduced
Solution Approach 1:
Data is decrypted in advance in the temporary container before being mounted to the application container. This preliminary decryption action converts encrypted data to decrypted data ahead of time, eliminating the need for real-time decryption during application operations and thus improving data access performance while maintaining protection during storage.
Data Source
AI summary
The present disclosure provides a computer-implemented method, computer system and computer program product for data protection. According to the method, a first container may be created before an application container is ready for running. The first container is configured to: receive a first key from a key management device; obtain first encrypted data for the application container from a storage device; decrypt the first encrypted data using the first key to obtain first decrypted data; and mount the first decrypted data into the application container. The first container may be exited, and then the application container may be switched to ready for running.