Container Service Verification for Secure Deployment Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The deployment of software in data processing systems is prone to risks of compromise due to malicious code and elevated privileges, which can lead to unauthorized interactions with system components.
Innovation Solution
The use of containerized services prepared with integrity, privilege, and security checks, including signed images and metadata verification, along with dynamically generated secrets, to ensure secure deployment and operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If software is deployed to data processing systems, then service functionality is improved, but system security and integrity are worsened due to risks of malicious code and unauthorized privilege escalation
Solution Approach 1:
The patent implements a preparation process that occurs before deployment, where containerized services are analyzed, verified, and signed by a trusted authority. This preliminary action ensures that only verified services with appropriate privileges are deployed, preventing security compromises while maintaining service functionality.
Solution Approach 2:
The patent introduces a trusted authority as an intermediary between service development and deployment. This intermediary verifies service integrity, checks privilege requirements, and signs container images and metadata, creating a trusted chain of custody that prevents malicious code execution while allowing legitimate services to function.
2Reliability
If comprehensive verification and preparation processes are implemented for containerized services, then system security is improved, but deployment complexity and processing time are worsened
Solution Approach 1:
The patent divides the verification process into distinct, modular stages: integrity analysis, privilege requirement determination, and signing. Each stage handles a specific aspect of verification, making the complex process manageable and reusable. The containerized service structure also segments the service itself into isolated units with defined privileges.
Solution Approach 2:
The patent changes the state of container images and metadata from unsigned to signed, and from unverified to verified. This parameter change (adding digital signatures and verification status) provides a clear, automated way to track security state without requiring complex manual review processes at deployment time.
3Object-affected harmful factors
If containerized services are prepared and verified before deployment, then the risk of system compromise is reduced, but deployment time and processing overhead are increased
Solution Approach 1:
The patent performs time-consuming verification, analysis, and signing operations in advance, during a preparation phase before deployment. Once prepared and signed, the containerized services can be deployed quickly without repeated verification, as the signatures provide rapid validation of service integrity and approved privileges.
Solution Approach 2:
The patent creates signed copies of container images and metadata that can be reused across multiple deployments. Once a service is verified and signed, the signed artifact can be deployed to multiple data processing systems without repeating the full verification process, reducing deployment time while maintaining security.
Data Source
AI summary
Methods and systems for managing the operation of data processing systems are disclosed. To manage the operation of the data processing systems, containerized services may be deployed. Once deployed, desired services may be provided. Prior to deployment, images and metadata used in the deployment may be analyzed. The analysis may reduce threats presented by the deployment of the containerized services. During the analysis, the integrity of the images and metadata may be verified, and the privilege of containerized services based on the metadata and images may be reviewed.