Secure Application Build and Deploy via Task Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud environments face security vulnerabilities that allow unauthorized access and data breaches due to shared resources among virtual machines, leading to potential denial of service, data leakage, and financial damage.
Innovation Solution
A method involving a sequence of build and deploy tasks that utilize encryption key pairs to isolate and secure the building and deployment process, where each task input and output are encrypted with distinct host and system key pairs, ensuring secure execution within a trusted execution environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If physical resources are shared by virtual machines in cloud environments, then resource utilization and accessibility are improved, but security vulnerabilities increase allowing unauthorized access and data breaches
Solution Approach 1:
The patent segments the build and deploy process into discrete tasks executed in isolated containers. Each task runs in its own secure environment with limited access to underlying physical resources, preventing unauthorized access while maintaining resource sharing capabilities. The build process is divided into multiple sequential tasks that operate in controlled isolation.
Solution Approach 2:
The patent introduces trusted execution environments (TEEs) and secure containers as intermediary layers between the virtual machines and the build/deploy processes. These intermediaries act as secure mediators that allow resource access while enforcing security policies, preventing direct access to physical resources and eliminating security vulnerabilities associated with shared infrastructure.
2Reliability
If encryption is applied to task inputs and outputs, then data security is improved, but processing complexity increases
Solution Approach 1:
The patent applies encryption to task inputs and outputs as a preliminary action before data processing occurs. By pre-encrypting data at the boundaries of each task, the system ensures data security without requiring complex encryption operations during the actual processing phase, thus reducing processing complexity while maintaining high security standards.
Data Source
AI summary
The present disclosure relates to a method for deploying an application in an execution environment using a first and second sets of key pairs. The method comprises: creating a sequence of tasks comprising build tasks followed by a deploy task. The tasks are configured to receive a task input for performing the tasks. The task input comprises a contribution input and an output of a task preceding at least one of the build tasks. The contribution input comprises secrets. The output of the build tasks is encrypted with a respective encryption key of the first set of key pairs, wherein the contribution input of a task subsequent to the first task is encrypted with a respective encryption key of the second set of keys. The tasks may be executed in the execution environment using unencrypted content of the task inputs.