Container Memory Security via Trusted Boot and Runtime Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container technologies are vulnerable to administrative access attacks, as decrypted container images are susceptible to snooping by rogue administrators once downloaded to host systems.
Innovation Solution
A system and method that implement a trusted boot sequence to secure the boot process, using a Trusted Processing Module (TPM) for remote attestation to obtain decryption keys, and a runtime decryption component to manage file access and ensure only authorized processes can access encrypted files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If container images are decrypted for runtime access, then container functionality is enabled, but security against administrative access attacks is compromised
Solution Approach 1:
The patent introduces an encrypted file system layer as an intermediary between the container processes and the decrypted container image data. This encrypted file system allows authorized container processes to access decrypted data while preventing unauthorized administrative access, effectively mediating between the need for runtime access and security requirements
Solution Approach 2:
The patent changes the encryption state parameter dynamically - container images are encrypted at rest but automatically decrypted for authorized runtime access by container processes. The encryption status is not fixed but changes based on the operational context and authorization state, allowing both security and functionality
2Ease of operation
If decryption keys are stored on host system, then container decryption is enabled, but keys become vulnerable to rogue administrator snooping
Solution Approach 1:
The encrypted file system acts as an intermediary that holds and manages decryption keys without exposing them to the host operating system or administrators. The keys are stored within the encrypted file system structure and only made available to authorized container processes through controlled mechanisms
Solution Approach 2:
The patent extracts the decryption key storage and management functionality from the host operating system into a separate encrypted file system layer. This separation removes keys from the vulnerable host environment where administrators could access them, placing them in a protected container-managed environment
3Ease of operation
If container memory is accessible for debugging and administration, then system management is facilitated, but security hardening is reduced
Solution Approach 1:
The patent applies different access qualities to different parts of the system - container processes receive full access to decrypted container image data for their operational needs, while administrative access is restricted. Each process type gets the appropriate level of access locally without compromising overall security
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques facilitating security hardening systems that host containers are provided. In one example, a system comprises: a memory that stores computer executable components; and a processor that executes computer executable components stored in the memory. The computer executable components comprise: a boot component performs a portion of a trusted boot sequence to securely boot the system to a defined secure state wherein one or more types of administrative access to a container memory are deactivated. The computer executable components also comprise: a core service component started as a part of the trusted boot sequence and that securely obtains one or more decryption keys for use with the container memory; and a runtime decryption component that uses the one or more decryption keys to perform runtime decryption of one or more files accessed by a container associated with the container memory.