Docker Image Protection via Extended Field Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Docker images can be easily duplicated and deployed on unauthorized hosts, compromising the rights of programmers and potentially influencing hardware manufacturers, as existing technologies lack effective protection mechanisms.
Innovation Solution
A method is introduced that modifies the Docker image data structure by adding an extended field, where a protection column is used to determine if an image is protected, and incorrect environmental requirements are written to the original field, which are later replaced with actual requirements by an improved Docker server, preventing unauthorized deployment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Docker image data structure is modified by adding an extended field with protection column, then the Docker image can be protected from unauthorized deployment, but the device complexity increases
Solution Approach 1:
The Docker image data structure is segmented into original fields and an extended field. The extended field contains the protection column and actual environmental requirement, separating protection logic from the core image structure. This allows protection mechanisms to be added without fundamentally altering the existing Docker image format.
Solution Approach 2:
The extended field acts as an intermediary layer between the original Docker image structure and the protection mechanism. It contains the protection column that indicates whether protection is enabled and the actual environmental requirement that serves as the authentic authorization key, mediating between the image and the authorization verification process.
2Reliability
If wrong environmental requirement is written to the original field and replaced by actual requirement during execution, then unauthorized deployment is prevented, but the ease of operation decreases
Solution Approach 1:
The wrong environmental requirement is pre-written into the original field during Docker image creation, and the actual environmental requirement is pre-stored in the extended field. This preliminary setup ensures that unauthorized deployment attempts fail immediately when the Docker server verifies the environmental requirement, while authorized deployments can proceed smoothly after the server retrieves the correct requirement.
Solution Approach 2:
The wrong environmental requirement in the original field, which initially seems harmful by preventing correct deployment, actually serves as a protective measure. It converts the potential harm of deployment failures into a benefit by automatically blocking unauthorized deployments. The Docker server's replacement of this wrong requirement with the actual requirement from the extended field restores functionality for authorized users while maintaining protection.
3Reliability
If Docker server reads extended field only when image is determined as extended image, then the protectiveness is maintained, but the productivity decreases due to additional verification steps
Solution Approach 1:
The Docker server performs a minimal verification action by only reading the protection column in the extended field when the image is identified as an extended image. This partial action approach avoids reading the entire extended field or performing full verification on every Docker image execution, thus maintaining protectiveness while minimizing the impact on execution speed. The server only engages the protection mechanism when necessary.
Data Source
AI summary
A method for executing Docker images under protection used for an improved Docker server and a Docker image having an extended field is disclosed. The method includes: receiving a Docker container creating instruction by the Docker server and obtaining a Docker image corresponding to the instruction; reading a protection column in the extended field of the Docker image; determining whether the Docker image is a protected image according to content of the protection column; obtaining an actual environmental requirement if the Docker image is the protected image, and replacing content of an environment column in an original field of the Docker image with the actual environmental requirement; and executing the Docker image based on the original field with the content-replaced environment column.