Container Lifecycle Management with Session Dilution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing computing systems are susceptible to malicious attacks due to their static nature, and current Moving Target Defense (MTD) techniques are inadequate in dynamically changing network configurations of virtual machines and containers to prevent unauthorized access.

Innovation Solution

Implementing a system that manages the life cycle of containers by creating a container registry for golden containers, assigning new IP and MAC addresses to recreated containers, and maintaining old containers as honeypots after a predefined retention time, thereby employing session dilution and anomaly detection to identify malicious communications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If containers are constantly cycled out with short retention spans to implement MTD strategy, then security against malicious attacks is improved, but existing sessions may be interrupted and service continuity deteriorates

Engineering Contradiction:

ImprovesecurityVSAvoidsession continuity

Core Design Contradiction:

ReliabilityVSDuration of action of moving object

Solution Approach 1:

The system performs preliminary action by introducing a session dilution time period before actually disconnecting the container. During this period, the container is marked for disconnection but existing sessions are allowed to complete. This preliminary warning period resolves the contradiction by preparing the system for the upcoming container lifecycle change while maintaining service continuity for active sessions.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system applies dynamics by making the container lifecycle management adaptive rather than static. The session dilution time creates a dynamic transition period where the container status changes from active to disconnected gradually, allowing sessions to naturally expire or complete. This dynamic approach resolves the contradiction between security (frequent container cycling) and session continuity (allowing existing connections to persist).

Inventive Principle:

Principle #15Dynamics

2Duration of action of moving object

If container retention time is extended to maintain service continuity, then session stability is improved, but the effectiveness of MTD strategy and security against attacks deteriorates

Engineering Contradiction:

Improvesession stabilityVSAvoidsecurity

Core Design Contradiction:

Duration of action of moving objectVSReliability

Solution Approach 1:

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system applies periodic action through the session dilution time mechanism, creating a structured periodic transition in container lifecycle management. Rather than abrupt changes, the system uses this intermediate period to gradually phase out containers, balancing security requirements with service stability.

Inventive Principle:

Principle #19Periodic action

3Object-affected harmful factors

If containers are frequently recreated with new IP and MAC addresses to implement MTD, then uncertainty for attackers is increased, but system complexity and management overhead increases

Engineering Contradiction:

Improveattacker uncertaintyVSAvoidcontainer management complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The system applies self-service by implementing automated container lifecycle management. The resource management system automatically handles container creation, IP/MAC address assignment, session dilution time monitoring, and disconnection without requiring manual intervention. This automation resolves the contradiction by reducing management complexity while maintaining the security benefits of frequent container recreation with new network identifiers.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS11134098B1Container life cycle management with session dilution time

Publication Date: 2021.09.28 EMC IP HLDG CO LLC

AI summary

The life cycle of one or more containers related to one or more containerized applications is managed by determining that a predefined retention time for a first container of a plurality of containers has elapsed; in response to the determining, suspending new session traffic to the first container; and waiting for a predefined session dilution time before terminating the first container and/or changing a role of the first container. In some embodiments, the session dilution time allows existing sessions to complete before the first container is disconnected from a service platform.