Container Pairing Key Segmentation for Secure Label Assignment

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In virtual environments like containers, securely assigning labels to workloads is challenging due to the rapid instantiation and removal of workloads, which can lead to security risks if not managed properly.

Innovation Solution

A system that includes a container orchestration agent, an enforcement module, and a segmentation server, where the agent instantiates containers with pairing keys as metadata, and the enforcement module validates these keys with the segmentation server to enforce communication rules based on label sets, ensuring secure and automated label assignment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If manual label assignment is used for containers, then label assignment flexibility is improved, but security risk increases

Engineering Contradiction:

Improvelabel assignment flexibilityVSAvoidsecurity risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a segmentation server as an intermediary between container owners and the label assignment process. The server automatically assigns labels based on validated pairing keys, eliminating direct manual assignment while maintaining flexibility through automated policy-based labeling. This mediator prevents unauthorized label assignment and ensures security while preserving adaptability.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The container orchestration agent performs self-service by automatically obtaining pairing keys from the segmentation server and applying them to containers without manual intervention. The system serves itself by automating the label assignment process while maintaining security through cryptographic validation, resolving the contradiction between flexibility and security.

Inventive Principle:

Principle #25Self-service

2Object-affected harmful factors

If automated label assignment is implemented, then security is improved, but system complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoidsystem complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent segments the system into distinct functional components: container orchestration agents for local container management, a segmentation server for centralized policy enforcement, and pairing keys for authentication. This segmentation distributes complexity across independent modules, making the overall system more manageable while improving security through specialized functions.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system changes the parameter of label assignment from manual to automated by introducing pairing keys as a new parameter. Instead of requiring human administrators to assign labels, the system uses cryptographic pairing keys to automatically trigger label assignment, reducing operational complexity while enhancing security through automated validation.

Inventive Principle:

Principle #35Parameter changes

3Object-affected harmful factors

If pairing keys are validated with segmentation server, then unauthorized access is prevented, but processing time increases

Engineering Contradiction:

Improveunauthorized accessVSAvoidprocessing time

Core Design Contradiction:

Object-affected harmful factorsVSLoss of time

Solution Approach 1:

The patent implements preliminary action by having the container orchestration agent obtain and store pairing keys before container instantiation. The validation process occurs automatically during container creation, and pre-established pairing keys enable rapid verification without requiring real-time authentication, thus preventing unauthorized access while minimizing processing delays.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11012310B2Managing containers based on pairing keys in a segmented network environment

Publication Date: 2021.05.18 ILLUMIO INC

AI summary

A container orchestration server stores pairing keys in association with container profiles. A container orchestration agent executing on an operating system instance instantiates a new container according to a particular container profile in response to an instruction from the container orchestration server and stores the pairing key as metadata associated with the container. An enforcement module detects the instantiation of the container and obtains the corresponding pairing key from the container orchestration agent. The enforcement module transmits the pairing key to a segmentation server for validation. If the segmentation server validates the key, the segmentation server determines a label set corresponding to the container profile associated with the pairing key and generates management instructions for the container based on the label set. The management instructions, when enforced by the operating system, controls communications between the container and other workloads in accordance with a segmentation policy.