Encrypted Container Images With Attestation and Integrity Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional software containers are susceptible to cybersecurity breaches and are often untrustworthy, posing risks to large-scale deployments, and existing efforts to secure software supply chains are sporadic and chaotic.
Innovation Solution
A system and method for securing software containers using machine-readable configuration data, involving a platform that scans and scores software containers for security threats, generates attestation, and employs immutable file formats and encryption to ensure integrity and trustworthiness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional software containers are used for deployment, then deployment speed and ease are improved, but security and trustworthiness deteriorate
Solution Approach 1:
The patent applies preliminary action by generating cryptographic hashes and digital attestations of container components (binary files, configuration files, source code) before the container is deployed. This pre-deployment verification ensures that any tampering can be detected, thus maintaining security while enabling rapid deployment of verified containers.
Solution Approach 2:
The patent introduces an intermediary verification mechanism that uses cryptographic hashes and digital signatures as mediators between the container components and the deployment system. This intermediary layer verifies the integrity of container components without slowing down the deployment process, thus maintaining both speed and security.
2Reliability
If security tools are added to protect software containers, then security is improved, but complexity and cost increase
Solution Approach 1:
The patent applies self-service by enabling the software container to verify its own integrity through built-in cryptographic hashes and digital attestations. The container components self-verify their authenticity without requiring external security tools, thus improving security while minimizing added complexity.
Solution Approach 2:
The patent changes the fundamental parameter of security verification from external tool-based checking to internal cryptographic self-verification. By embedding cryptographic hashes and digital signatures directly into the container components, the system achieves enhanced security without the complexity of additional external security infrastructure.
3Reliability
If cryptographic verification is implemented for all container components, then integrity is improved, but processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-generating cryptographic hashes and digital attestations during the container build process. This allows the verification to be performed efficiently during deployment without significant processing delays, as the cryptographic verification data is already prepared and ready for quick validation.
Data Source
AI summary
Techniques for data security transactions using software container machine readable configuration data are described, including transmitting a query from a platform to a container registry, receiving a software container image as responsive data transmitted from the container registry to the platform, the software container image being encrypted, using the platform to obtain key material from the software container to decrypt the software container image, a device mapper implemented with the platform being configured to check data integrity of the software container image, and using a container runtime to mount the software container image after being decrypted by a kernel, the platform directing the container runtime and the kernel to decrypt the software container image.