Isolated Containers for User Request Processing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Network servers face security vulnerabilities and resource misuse due to unprivileged child processes, which can lead to privilege escalation, denial of service, and unauthorized access, especially when handling user requests from diverse client devices.

Innovation Solution

Implementing a method to create isolated authentication and user request processing containers for each client device, using a docker engine to manage resources and authenticate requests, thereby isolating potential security threats and limiting resource access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If unprivileged child processes are used to handle user requests, then resource access and processing capability are improved, but security vulnerabilities and privilege escalation risks increase

Engineering Contradiction:

Improverequest processing capabilityVSAvoidsecurity stability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system segments the request processing environment by creating isolated containers for each child process. Each container acts as an independent execution environment that separates the child process from the host system and other processes, allowing resource access while preventing unauthorized privilege escalation and containing potential security breaches within individual containers.

Inventive Principle:

Principle #1Segmentation

2Adaptability or versatility

If multiple client connections are handled simultaneously, then service coverage and user access are improved, but resource contention and system vulnerability increase

Engineering Contradiction:

Improveclient connection capacityVSAvoidresource management complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

Each client connection is assigned to a dedicated container, segmenting the multi-client environment into isolated units. This allows the system to handle multiple client connections simultaneously while maintaining independent resource management for each client, preventing resource contention and limiting the spread of vulnerabilities across different client sessions.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The container acts as an intermediary layer between the child process and the host system resources. It mediates resource access by providing controlled interfaces to CPU, memory, storage, and network resources, enabling multiple clients to access system resources simultaneously without direct conflict while simplifying resource management through standardized allocation policies.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11368459B2Providing isolated containers for user request processing

Publication Date: 2022.06.21 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Methods, computer program products, and/or systems are provided that can perform the following operations: receiving a connection request from a first user device; creating an authentication container for the first user device; authenticating the first user device using the authentication container; in response to authentication for the first user device being successful, creating a first user request processing container for the first user device; and processing user requests received from the first user device using the first user request processing container.