Container Rule Engine for Runtime Permission Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container execution environments lack effective mechanisms to prevent unauthorized access and alteration of execution permissions, allowing attackers to modify program code and gain access to sensitive data, despite signature methods protecting image integrity.
Innovation Solution
A method and system that generate and enforce a container image-specific rule set for execution and resource access, monitoring processes during execution, and initiating measures to prevent unauthorized access or execution if negative results are detected, using a monitoring service and enforcement daemon.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If container instances are allowed to dynamically load executable programs at runtime with appropriate permissions, then flexibility and adaptability of the container system is improved, but security and integrity protection deteriorates as attackers can execute modified program code or gain access to sensitive data
Solution Approach 1:
The patent applies preliminary action by generating and storing a rule set before the container image is loaded. The rule set includes information about executable programs and their parameters that are allowed to run. When the container instance executes, the monitoring service checks against this pre-established rule set to determine whether to permit execution, thus preventing unauthorized code execution before it can cause harm.
Solution Approach 2:
The patent introduces a monitoring service as an intermediary between the container instance's process execution and the actual execution permission. The monitoring service intercepts execution requests, checks them against the rule set, and only permits execution if the process matches an allowed executable program with valid parameters. This intermediary layer blocks unauthorized execution without preventing legitimate container operations.
2Reliability
If signature methods are used to protect container image integrity in the registry, then authenticity and integrity of stored images is improved, but protection against runtime permission alteration deteriorates because instantiation information is created independently and can modify execution permissions
Solution Approach 1:
The patent segments the integrity protection mechanism into two parts: (1) traditional signature methods that protect the container image itself, and (2) a new rule set that separately protects executable program permissions. The rule set is generated from the container image but stored and enforced independently by the monitoring service, allowing permission control to be separated from image integrity verification.
Solution Approach 2:
The patent implements feedback by having the monitoring service continuously monitor process execution in the container instance and compare actual execution requests against the stored rule set. When a process attempts to execute, the monitoring service provides feedback by either permitting or blocking execution based on whether it matches the allowed executables in the rule set, thus enforcing permission control dynamically.
Data Source
Figure 1
Figure 2
AI summary
The invention claims a computer-implemented method for providing a rule set for restricting execution and/or resource access for at least one container instance (IZ) formed from a container image (IM), comprising the following steps: - creating the rule set (REP) before loading the container image and instantiating a container image-specific version of the rule set and storing the container image-specific version in a rule database (DB), - when loading the container image by a container runtime environment (L), loading the container image-specific version of the rule set into a local memory (Ch) of an execution environment for executing the container instance formed from the container image by the container runtime environment.- Before executing the container instance, determine the privileges and resources assigned to the execution environment (A) by the container runtime environment of the container instance to be executed, using a monitoring service (D) running on the execution environment; - During the execution of the container instance, monitor the processes necessary for the execution of the container instance using the determined privileges and resources, as well as the loaded container image-specific version of the rule set; - If the monitoring yields a negative result, initiate a measure to counteract the execution of the aforementioned processes.