Host-Based File Integrity Agent for Container Path Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing File Integrity Monitoring (FIM) systems are inadequate for container-based systems as they fail to effectively monitor file integrity due to differences in file structures between traditional host-based systems and container-based systems, leading to security vulnerabilities, resource inefficiencies, and scalability issues.
Innovation Solution
A centralized FIM architecture is implemented where a single agent on the host system intercepts and maps system calls from containers to host file paths, constructing correspondences between container and host file paths to monitor file integrity, thereby bridging the semantic gap and providing real-time integrity monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional host-based FIM system is used to monitor container file integrity, then file integrity monitoring can be performed, but the system fails to account for differences in file structures between host-based and container-based systems, leading to monitoring failures
Solution Approach 1:
The patent introduces an intermediary layer that maps container file paths to host file paths. This intermediary mapping mechanism translates container-specific file path references into host file system references, enabling the host-based FIM system to effectively monitor container file integrity despite structural differences between the two environments.
2Reliability
If agents are replicated within each container to monitor file integrity, then monitoring coverage is improved, but resource consumption increases and scalability deteriorates
Solution Approach 1:
The patent implements a universal host-based FIM system that can monitor multiple containers simultaneously through a single agent. The system achieves multi-functionality by maintaining file path mappings for multiple containers and using a unified monitoring mechanism that works across all containers, eliminating the need for separate agents in each container while preserving comprehensive monitoring coverage.
3Reliability
If agents are deployed within containers to monitor file integrity, then real-time monitoring is achieved, but the agent becomes vulnerable to container namespace compromises
Solution Approach 1:
The patent extracts the FIM agent from the container environment and places it on the host system. By taking out the monitoring agent from the potentially compromised container namespace and positioning it on the secure host, the system maintains real-time monitoring capability while eliminating the security vulnerability associated with having agents inside containers that could be compromised along with the container namespace.
Data Source
AI summary
A system for monitoring file integrity in a host computing device having a process and a storage device storing computer executable code. The computer executable code is configured to: provide containers, an agent external to the containers, and a policy file configuring policy for the containers; intercept a system call indicating mounting, and construct a first correspondence between a container file path and a host file path having mounting correspondence; intercept a system call of the container indicating opening of the policy file, and construct a second correspondence between the container file path and the violation of the container file path; aggregate the first and second correspondences to obtain a correspondence between the host file path and the violation; and monitor file integrity of the container by detecting violation of the host file path.