Custom Security Type Labels for Multi-Tenant PaaS Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Platform-as-a-Service (PaaS) environments, managing and securing multi-tenant applications across virtual machines is inefficient due to resource wastage and security concerns, as each application requires significant expertise and resources, and existing solutions fail to effectively separate and secure applications from each other and the underlying system.
Innovation Solution
A mechanism is introduced to apply custom security type labels (STLs) to multi-tenant applications, assigning a unique label to each application, which enforces a security policy to prevent harmful access to underlying system resources, utilizing the operating system's security features to ensure separation and protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a separate virtual machine is provisioned for each application deployment, then application isolation and security are improved, but resource utilization deteriorates and cost increases
Solution Approach 1:
The patent segments the virtual machine into multiple containers, where each container hosts a separate application deployment. This segmentation allows applications to be isolated within their own container environments while sharing the underlying VM resources, thus maintaining security and isolation without requiring separate VMs for each application.
Solution Approach 2:
The patent merges multiple application deployments into a single virtual machine by containerizing them. Multiple containers run simultaneously on the same VM, sharing CPU, memory, and storage resources. This combining approach improves resource utilization while maintaining application isolation through container boundaries.
2Reliability
If application expertise and configuration effort are increased to ensure proper setup, then application security and performance are improved, but ease of operation deteriorates
Solution Approach 1:
The patent implements self-service through automated container orchestration that handles application deployment, configuration, and security settings automatically. The system self-manages resource allocation, container lifecycle, and security policies without requiring manual intervention or deep expertise from operators, thus improving ease of operation while maintaining security.
Solution Approach 2:
The patent creates a universal container platform that can host multiple different applications with varying requirements on the same infrastructure. The containerization approach provides a standardized, multi-functional environment that automatically adapts to different application types, eliminating the need for application-specific configuration expertise.
3Reliability
If custom security policies are applied to each application, then security control is improved, but device complexity increases
Solution Approach 1:
The patent introduces container runtime and orchestration layers as intermediaries between the VM and applications. These intermediaries enforce security policies, manage container isolation, and control resource access automatically. By placing the security enforcement logic in the intermediary layer rather than requiring complex configuration for each application, the system achieves fine-grained security control without proportionally increasing management complexity.
Data Source
AI summary
A mechanism for applying security category labels to multi-tenant applications of a node in a PaaS environment is disclosed. A method of embodiments includes receiving, by a virtual machine (VM) executing on a computing device, a custom security type label (STL) and a custom security policy associated with the custom STL, the custom STL and associated custom security policy applied to one or more multi-tenant applications executed by the VM. The method further include receiving a request to initialize an application on the VM, the request identifying the custom STL as an STL to apply to the application, assigning a local UID maintained by the VM to the application, recording a mapping of the assigned local UID to the custom STL, assigning the custom STL to files of the application, and assigning the custom STL to a running process of the application.