Container Filesystem Security Profiles for Runtime Violation Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions are inadequate for detecting vulnerabilities in software container images, as they cannot predict how container images behave during execution and fail to prevent malicious code execution, leading to risks of malware and DDoS attacks.
Innovation Solution
A method and system for securing software containers using security profiles, which involves generating a security profile based on permissible filesystem actions, monitoring runtime operations, and detecting violations to enforce secure execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security solutions are used to scan container images, then basic security scanning is provided, but they cannot detect vulnerabilities related to runtime behavior and filesystem actions
Solution Approach 1:
The system performs preliminary analysis of container images before execution to generate security profiles that predict runtime filesystem actions. This preliminary action captures the container's intended behavior patterns before the container actually runs, enabling the security system to have expectations about what filesystem operations should occur during execution.
Solution Approach 2:
The system continuously monitors runtime filesystem actions and compares them against the pre-generated security profile expectations. When deviations are detected, the system provides feedback by triggering security events or alerts, creating a closed-loop security monitoring system that adapts to actual runtime behavior.
2Ease of operation
If container images are allowed to execute without restrictions, then execution flexibility is maintained, but malicious code execution and security threats cannot be prevented
Solution Approach 1:
The system applies security restrictions locally to specific filesystem actions rather than imposing blanket restrictions on entire container executions. Each filesystem operation is evaluated against the security profile to determine if it should be permitted, allowing legitimate operations to proceed while blocking only the harmful ones.
Solution Approach 2:
The security profile acts as an intermediary layer between the container execution environment and the host filesystem. This mediator translates container requests into security decisions, allowing the system to maintain execution flexibility while preventing malicious actions through the intermediary security layer.
3Reliability
If comprehensive monitoring of container runtime operations is implemented, then security violations can be detected, but system complexity and computational overhead increase
Solution Approach 1:
The system extracts only the critical security-relevant filesystem actions from the container's runtime operations for monitoring. Rather than monitoring all container activities, it focuses specifically on filesystem operations that could indicate security violations, reducing the monitoring burden while maintaining detection effectiveness.
Solution Approach 2:
The security profile is generated in advance before container execution, establishing the baseline of expected filesystem actions. This preliminary action reduces runtime complexity by providing pre-computed security criteria that simplify real-time monitoring decisions during container execution.
Data Source
AI summary
A system and method for securing execution of software containers using security profiles. The method includes exporting a container image to a host device from a container image source, wherein the container image includes resources utilized to execute a corresponding application container; generating a security profile for the container image, wherein the generated security profile indicates at least a list of permissible filesystem actions, wherein each permissible filesystem action is an action performed with respect to at least one filesystem resource; monitoring an operation of a runtime execution of the application container; and detecting a violation of the security profile based on the monitored operation.