Container Security via Page-Level Code Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Container application environments face security risks due to the potential presence of malicious code and misbehavior from untrusted or poorly secured container applications sharing a common host operating system kernel, which can affect other applications and the host OS itself.
Innovation Solution
A protection platform layer that monitors and enforces security policies at a code page level, utilizing a Hardware Assisted Virtual Machine (HVM) enabled platform, ingested database for known code fingerprinting, and trust data database for reputation scoring, allowing real-time identification and remediation of malicious code, including the ability to kill or restrict execution of untrusted code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If container applications share a common host operating system kernel, then resource utilization and ease of deployment are improved, but security risks and vulnerability to malicious code increase
Solution Approach 1:
The patent segments the monolithic host OS kernel into multiple isolated kernel namespaces, each dedicated to a specific container application. This segmentation allows container applications to share the host OS infrastructure while maintaining strict isolation boundaries, preventing malicious code in one container from affecting other containers or the host system. The kernel namespace mechanism divides the kernel's resource management and security contexts into separate, controlled segments.
Solution Approach 2:
The patent introduces a kernel-level intermediary layer that acts as a mediator between container applications and the host OS kernel. This intermediary enforces security policies, validates code execution requests, and controls inter-container communication. The intermediary monitors and filters system calls, preventing malicious code from directly accessing or corrupting the host kernel while allowing legitimate container operations to proceed.
2Reliability
If security policies are enforced at the container application level, then security control is improved, but system complexity and overhead increase
Solution Approach 1:
The patent replaces traditional software-based security enforcement mechanisms with hardware-assisted virtualization features. By utilizing CPU virtualization extensions and hardware-enforced isolation mechanisms, the system achieves strong security controls without requiring complex software security layers. The hardware substrate provides built-in memory protection, process isolation, and execution control, simplifying the overall security architecture while maintaining high reliability.
3Measurement precision
If real-time monitoring of code execution is implemented, then detection of malicious code is improved, but processing overhead and performance impact increase
Solution Approach 1:
The patent implements periodic sampling and event-triggered monitoring instead of continuous real-time monitoring of all code execution. The system periodically checks code pages for known malicious signatures and triggers detailed analysis only when specific events occur, such as unauthorized system calls or anomalous behavior patterns. This periodic action maintains high detection accuracy for malicious code while significantly reducing the average processing overhead during normal operation.
Data Source
AI summary
A plurality of pages of code executing via a container host operating system are monitored. The plurality of pages of code include pages of code from a plurality of container applications configured to utilize the container host operating system. A determination is made that a page of code of the plurality of pages of code violates a security policy configured to apply security within the container host operating system. A container application of the plurality of container applications is identified as a source of the page of code of the plurality of pages of code. The security policy is applied to the container application of the plurality of container applications in response to identifying the container application of the plurality of container applications as the source of the page of code.