Container Resource Access Control via Logical Application Context
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software container security models, such as DOCKER's 'Chinese wall' protection, require manual configuration for resource access control, which is inefficient and not scalable for dynamic resource sharing between containers.
Innovation Solution
A host computing device with a container engine and interception engine dynamically controls resource access between software containers based on whether they are part of the same logical software application, allowing seamless encryption and decryption of shared resources without manual policy definition.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual access control policies are configured for container resource sharing, then security control is achieved, but administrative complexity and time consumption increase
Solution Approach 1:
The container platform automatically generates and enforces access control policies based on container identity and logical application relationships. The system self-manages security controls without requiring manual administrator intervention for policy creation and updates, thereby maintaining reliable security while reducing administrative complexity.
Solution Approach 2:
Access control policies are dynamically adjusted based on the logical application relationship between containers. When containers are determined to be part of the same logical application, access is automatically permitted; otherwise, access is denied. This dynamic approach eliminates manual policy configuration while maintaining security.
2Reliability
If manual access control policies are configured for container resource sharing, then security control is achieved, but time consumption for policy management increases
Solution Approach 1:
The system pre-establishes security controls at container creation time by automatically determining logical application relationships. Access control decisions are made in advance based on container identity, eliminating the need for time-consuming manual policy configuration and updates later.
Solution Approach 2:
The container platform automatically manages access control policies without requiring administrator time for policy creation, modification, or maintenance. The system self-service approach to security policy management significantly reduces time consumption while maintaining security control.
3Reliability
If containers are isolated from each other, then security is improved, but resource sharing capability deteriorates
Solution Approach 1:
The system applies different access control characteristics to different container pairs based on their logical application relationships. Containers that are part of the same logical application receive permissive access controls enabling resource sharing, while containers from different logical applications maintain strict isolation. This localized differentiation maintains security while enabling necessary resource sharing.
Solution Approach 2:
The isolation level between containers is dynamically adjusted based on their logical application relationship. The system transitions from default isolation to controlled sharing when containers are determined to be part of the same logical application, thereby balancing security and resource sharing capability dynamically rather than using a static approach.
Data Source
AI summary
An example method of sharing a resource between software containers includes detecting a request from a first software container to access a resource of a different, second software container, an operational state of the second software container being controlled by a container engine running on the host computing device. The method also includes accepting or rejecting the request based on whether the first and second software containers, which each contain a respective software application, are part of a same logical software application. An example host computing device configured to share resources between software containers is also disclosed.