Container Security Assertion Document Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods lack reliable assurance for the security of container images and containers in computing environments, as they are often developed across multiple stages by different developers and retrieved from public repositories, making it difficult for host environments to determine if they are securely configured and free from vulnerabilities.
Innovation Solution
A security assertion document is generated for container images by analyzing them against policy rules, which includes security assertions and obligations, allowing for verification of their safety and compliance before execution, separate from the container image itself, and can be used with existing container management technologies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If container images are developed across multiple stages by different developers and retrieved from public repositories, then container development flexibility and collaboration are improved, but security assurance and vulnerability detection deteriorate
Solution Approach 1:
The patent applies preliminary action by generating security assertion documents during the container image build process itself, rather than attempting to assess security after the image is created. The assessment engine analyzes the container image and generates security assertions about vulnerabilities, misconfigurations, and policy compliance before the image is deployed to production environments. This proactive approach ensures security is built-in from the development stage.
Solution Approach 2:
The patent introduces an intermediary security assertion document that mediates between the container image and the deployment decision. This document serves as a trusted intermediary containing pre-assessed security information, allowing deploying systems to make informed decisions without re-analyzing the entire container image. The intermediary document bridges the gap between diverse development environments and consistent security assessment.
2Reliability
If security assessment is performed on container images, then security reliability is improved, but assessment time and deployment speed deteriorate
Solution Approach 1:
The patent performs security assessment in advance during the container image build process, generating security assertion documents that can be stored with the image. When the container is deployed, the pre-generated security assertions are quickly retrieved and evaluated, avoiding time-consuming real-time analysis. This shifts the time investment to the build phase rather than the deployment phase.
Solution Approach 2:
The patent creates a copy of security assessment results in the form of a security assertion document that travels with the container image. Instead of re-performing the entire security analysis during deployment, the system copies the essential security information into a lightweight document that can be quickly validated, significantly reducing assessment time at deployment.
3Reliability
If comprehensive policy rules are applied to assess container images, then security coverage is improved, but assessment complexity and computational resources deteriorate
Solution Approach 1:
The patent segments the security assessment process into distinct phases: build-time assessment that generates security assertions, and deploy-time verification that validates those assertions. The assessment engine divides the analysis into separate components such as vulnerability scanning, misconfiguration detection, and policy compliance checking, allowing each to be performed independently and efficiently.
Solution Approach 2:
The patent applies partial action by focusing security assessment on the most critical aspects during deployment - primarily validating the pre-generated security assertions against deployment policies. Rather than performing a complete re-assessment of all security attributes, the system performs a targeted verification of the essential security properties that matter for the specific deployment context.
Data Source
AI summary
Methods and apparatus are disclosed to generate a security assertion document associated with a container image, and to use the security assertion document to determine whether a container image is suitable for use to assemble a corresponding container for execution in a host environment. In an example method, the generated security assertion document includes a security assertion resulting from an assessed policy rule. In the example method, the security assertion document is separate from the container image such that the generation of the security assertion document does not alter the container image itself. In an example method, the contents of the security assertion document may be analyzed and/or verified in relation to the associated container image in connection with determining whether or not to use the container image to assemble a corresponding container for execution in the example host environment.