Local Enforcement Agent for Container Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The micro-service architecture's reliance on untrusted, publicly downloaded container-based micro-services introduces security threats due to developers' lack of familiarity with internal operations, making it difficult to detect and address internal security threats within containerized applications.
Innovation Solution
A distributed enforcement system is implemented using local enforcement agents on container-hosting computing devices, which operate as intra-application communication proxies to analyze intra-application API calls for compliance with security policies, providing man-in-the-middle protection and enforcing security rules to detect and prevent internal security threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If container-based micro-services are used for scalability and modularity, then application deployment flexibility and scalability are improved, but internal security threats increase due to untrusted publicly downloaded containers
Solution Approach 1:
The patent introduces an enforcement agent as an intermediary component that sits between containers and monitors their intercommunication. This agent acts as a mediator that enforces security policies on API calls between containers, allowing the system to maintain deployment flexibility while adding a security layer that detects and prevents internal threats without requiring developers to understand container internals
2Reliability
If security policies are enforced on inter-container traffic, then security level is improved, but system complexity increases due to distributed enforcement infrastructure
Solution Approach 1:
The patent segments the security enforcement function into individual enforcement agents that are distributed across different hosts. Each host runs its own enforcement agent that monitors traffic locally, dividing the overall security enforcement task into manageable segments. This segmentation reduces centralization complexity while maintaining comprehensive security coverage across the container ecosystem
3Measurement precision
If local enforcement agents are deployed on each container-hosting device, then security monitoring capability is improved, but resource consumption increases
Solution Approach 1:
The enforcement agents are designed to be lightweight and self-contained, running autonomously on each host to monitor local container traffic. Each agent serves its own host's security needs independently, enabling precise local monitoring while avoiding the overhead of centralized monitoring infrastructure. The agents consume minimal resources by focusing only on intercontainer API call monitoring rather than full system monitoring
Data Source
AI summary
A computing device running a local enforcement agent is configured to instantiate at least one application container at the computing device, where the at least one application container is part of a containerized application. The computing device is also configured to associate the local enforcement agent with the least one application container so that the local enforcement agent operates as an intra-application communication proxy for the least one application container. The local enforcement agent receives an intra-application Application Programming Interface (API) call that is sent to the at least one application container from a second application container that is part of the containerized application. The local enforcement agent is configured to analyze the intra-application API call for compliance with one or more security policies associated with the at least one container.