Container Traffic Enforcement via Image Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Containerized environments face security vulnerabilities due to malicious code in images, which can lead to ATP attacks and DDoS, and existing traffic inspection solutions are intrusive, requiring proxies and agents on each host.
Innovation Solution
A method and system for analyzing container images to determine application types, generating filtering profiles, and filtering malicious traffic without modifying application flows, using a defender container to enforce traffic rules and adapt filtering based on anomalies, allowing secure communication between containers without intrusive measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traffic inspection is implemented using proxies and agents on each host, then security against malicious code is improved, but device complexity and intrusiveness increase
Solution Approach 1:
The patent introduces a network policy enforcement module as an intermediary component that operates at the network layer without requiring application-level proxies or host agents. This module intercepts and enforces network policies on traffic packets directly, providing security inspection through a less intrusive mechanism that maintains reliability while reducing complexity compared to traditional proxy-based solutions
Solution Approach 2:
The patent replaces the mechanical approach of deploying physical proxies and software agents on each host with a virtualized network function that operates in the network namespace. This substitution eliminates the need for complex agent installation and configuration on individual hosts, reducing device complexity while maintaining security effectiveness through centralized policy enforcement
2Reliability
If filtering rules are applied to all traffic, then security against malicious traffic is improved, but productivity and application performance deteriorate
Solution Approach 1:
The patent applies filtering rules selectively based on the characteristics of traffic packets and network policies, rather than uniformly filtering all traffic. The enforcement module evaluates each packet against applicable policies and only applies filtering when necessary, thereby maintaining security against malicious traffic while minimizing performance impact on legitimate application traffic
Solution Approach 2:
The patent implements partial filtering by applying network policy rules only to specific traffic flows that match policy criteria, rather than filtering all traffic exhaustively. This approach provides sufficient security coverage for malicious traffic detection while avoiding the performance degradation that would result from inspecting and filtering every packet regardless of its nature or destination
3Adaptability or versatility
If container images are analyzed to determine application types, then adaptability of filtering profiles is improved, but loss of time in image processing increases
Solution Approach 1:
The patent performs analysis of container images to determine application types during the image build or pull phase, before the containers are deployed and start processing traffic. By conducting this analysis in advance, the system prepares filtering profiles proactively, so that when containers are running, the adaptability benefit is realized without adding time delays to the actual traffic processing operations
Data Source
AI summary
A system and method for traffic enforcement in containerized environments. The method includes analyzing contents of a container image to determine a type of application to be executed by a first container, wherein the first container is a runtime instance of the container image; determining, based on the type of application to be executed by the first container, a filtering profile for the first container, wherein the filtering profile defines a configuration for inspecting and filtering traffic directed to the first container; and filtering, based on the filtering profile, malicious traffic directed to the first container.