Container Task Execution Using Whitelisted Secure Images
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container management platforms like Kubernetes (K8s) lack effective mechanisms to block malicious tasks and enhance security during task execution, potentially compromising privacy data in service party devices.
Innovation Solution
A container-based task execution method that involves creating a container group using a whitelist of secure image files, ensuring only verified executable file information from the image file is used, and rejecting tasks lacking this information to prevent malicious execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a container management platform allows flexible task execution, then task adaptability is improved, but security deteriorates due to potential malicious tasks
Solution Approach 1:
The patent applies preliminary action by establishing a whitelist of secure image files before task execution. The system pre-verify image security and stores approved images in the whitelist, so that when tasks are submitted, only pre-approved images can be executed. This prevents malicious tasks from executing while maintaining flexibility for legitimate task types.
2Object-affected harmful factors
If the system implements strict security verification, then security is improved, but task execution efficiency deteriorates due to verification overhead
Solution Approach 1:
Image security verification is performed in advance during image storage, and approved images are added to the whitelist. During task execution, the system only needs to check whether the image identifier exists in the whitelist, which is a fast operation. This separates the heavy verification work from the task execution path, maintaining both security and efficiency.
Solution Approach 2:
The system uses image identifiers (names or digests) as references instead of storing and verifying complete image contents during task execution. This copying approach allows the system to maintain security through identifier-based verification while avoiding the computational overhead of re-verifying entire images during task submission.
3Ease of operation
If the system uses image identifiers for task execution, then ease of operation is improved, but security deteriorates due to potential unauthorized image execution
Solution Approach 1:
The whitelist acts as an intermediary between the user's task submission and the actual image execution. Users can simply submit task descriptions with image identifiers without needing to understand security mechanisms. The whitelist intermediary automatically verifies whether the specified image is authorized, providing both ease of operation and security protection simultaneously.
Data Source
AI summary
Embodiments of this specification provide a container-based task execution method and apparatus. The method can be performed by a container management platform. When receiving a task description file that is for a to-be-executed task and that is submitted by a user, the container management platform can determine whether a first identifier of a first image file carried in the description file is in a whitelist, where the first identifier can be added to the whitelist when it is determined that specified executable file information included in the first image file is secure; and if the first identifier is in the whitelist, considers that the to-be-executed task is secure, and can execute the to-be-executed task based on a container group created by using the task description file and the specified executable file information included in the first image file.