Container System Call Whitelist Generation via Static Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In container virtualization environments, existing security solutions fail to identify and restrict system calls for application containers, leaving them vulnerable to 'container escape threats' due to shared OS kernels, which conventional methods do not address effectively.
Innovation Solution
A method and apparatus for generating a system call whitelist for application containers based on machine code or non-machine code, involving binary static analysis or source code analysis to identify required system calls and controlling system calls in real-time using a kernel-space apparatus, interrupting unauthorized calls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If container instances share a single OS kernel to enable fast software development and container virtualization, then resource utilization and deployment efficiency are improved, but security vulnerabilities in the kernel affect all container instances and container escape threats increase
Solution Approach 1:
The patent segments the system call interface by creating separate whitelists for different container instances. Each container has its own allowlist of permitted system calls, which divides the shared kernel's system call interface into isolated, container-specific access control lists. This segmentation allows multiple containers to share the kernel while maintaining individual security boundaries.
Solution Approach 2:
The patent applies local quality by generating customized system call whitelists for each individual container instance based on its specific application requirements. Instead of using a uniform security policy for all containers, the system tailors the system call allowlists to match the actual system calls needed by each application, providing localized security optimization for each container while maintaining shared kernel benefits.
2Reliability
If SECCOMP mechanism is integrated into container runtime to block unnecessary system calls, then attack surface of shared kernel is reduced, but identification of system call whitelist for individual containers becomes required and complex
Solution Approach 1:
The patent performs preliminary action by generating system call whitelists during container image build time or before container runtime. The whitelist generation process is executed in advance, analyzing the application's system call requirements and creating the allowlist before the container actually runs. This preliminary generation simplifies the runtime operation, as the whitelist is already prepared and does not require complex real-time analysis during container execution.
Solution Approach 2:
The patent implements self-service by enabling the system to automatically generate system call whitelists without requiring manual configuration or intervention. The whitelist generation process autonomously analyzes container configurations, identifies required system calls, and creates the allowlists automatically. This self-service capability reduces the complexity burden on users, as the system handles the complex whitelist identification process independently.
3Reliability
If conventional security solutions like vaccine or EDP are used to detect malicious code, then malicious code detection capability is provided, but system call whitelist identification and restriction functionality is not available
Solution Approach 1:
The patent merges multiple security functions into a unified system. It combines malicious code detection capabilities with system call whitelist generation and enforcement functionality. The system integrates SECCOMP-based system call filtering with automatic whitelist generation, creating a comprehensive security solution that provides both malware detection and system call restriction in a single integrated framework, thereby achieving both detection capability and adaptability.
Data Source
AI summary
An apparatus and method for generating a system call whitelist for an application container. The method may include determining whether a container is based on machine code or non-machine code by analyzing the internal configuration of the running container, identifying system calls included in an application through binary static analysis or static analysis of source code selected depending on the determination of whether the container is based on machine code or non-machine code, and generating a whitelist based on the numbers of all of the identified system calls.