Container Startup Security via Kernel eBPF Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional container security techniques fail to protect against malware attacks originating from the kernel space of the operating system, leaving containers vulnerable to unauthorized access and data breaches.
Innovation Solution
Implementing a software mechanism that hooks into the operating system kernel to verify the sequence of components used for starting a container, utilizing a Berkeley Packet Filter (BPF) and eBPF tool to compute and compare hash codes against trusted values, preventing the execution of unauthorized or tampered components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional container security techniques are used, then containers can be executed in a container-based environment, but they remain vulnerable to malware attacks from kernel space
Solution Approach 1:
The patent applies preliminary action by verifying the integrity of container startup components (runtime, decoupling component, image binary) before the container execution process begins. A software mechanism hooks into the operating system kernel to compute hash codes of these components and compare them against trusted values stored in a secure element, preventing malicious components from being executed in the first place
Solution Approach 2:
The patent introduces an intermediary verification layer between the kernel space and user space container execution. A software mechanism acting as an intermediary hooks into the OS kernel and mediates the startup process by verifying component integrity through hash code comparison before allowing containers to execute, thereby blocking malware attacks without preventing legitimate container operations
2Reliability
If a software mechanism hooks into the operating system kernel to verify components, then security against kernel-level threats is enhanced, but system complexity increases
Solution Approach 1:
The patent extracts the security verification functionality from the main container execution flow and implements it as a separate software mechanism that hooks into the OS kernel. This modular approach isolates the complexity of kernel-level verification into a distinct component, allowing the rest of the container system to operate with standard security measures while maintaining enhanced protection
3Reliability
If hash codes are computed and compared for each container startup component, then unauthorized or tampered components are prevented from executing, but the container startup process time increases
Solution Approach 1:
The patent computes and stores hash codes of trusted container startup components (runtime, decoupling component, image binary) in advance in a secure element within the OS kernel. During container startup, only a comparison operation is performed rather than full verification, significantly reducing the time penalty while maintaining security. The preliminary computation of trusted values eliminates the need for repeated heavy verification operations
Solution Approach 2:
The patent replaces traditional mechanical security verification methods with cryptographic hash code comparison. Instead of using complex validation routines or multiple verification layers, the system uses efficient hash code computation and comparison operations that can be performed quickly during container startup, minimizing time loss while providing robust security against tampered components
Data Source
AI summary
Methods, apparatus, and processor-readable storage media for securely executing containers are provided herein. An example computer-implemented method includes, in response to a request to start a container in a container-based environment, where the request initiates an execution of a container startup process in a kernel space of an operating system, generating a set of data corresponding to a sequence of components to be used to start the container in the container-based environment. The method also includes comparing the generated set of data to a set of trusted data for the sequence of components and automatically controlling a start of the container based at least in part on a result of the comparing.