Secure Software Containers With Embedded Security Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software containers lack robust security mechanisms to ensure the integrity and authenticity of applications and services, making them vulnerable to tampering and unauthorized access.
Innovation Solution
Incorporating a security token system that generates a unique signature for each software container, which is embedded within the container and validated upon launch, along with an identity and time-to-live value, to ensure only authorized applications can execute and access services, thereby preventing unauthorized access and tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If software containers are used to provide execution efficiency and isolation, then productivity and resource utilization are improved, but security mechanisms are insufficient making containers vulnerable to tampering and unauthorized access
Solution Approach 1:
The patent applies preliminary action by generating and embedding a security token containing a digital signature into the software container during container creation, before the container is executed. This pre-established security mechanism allows the container to be automatically validated upon launch, preventing unauthorized or tampered containers from executing while maintaining execution efficiency.
Solution Approach 2:
The patent introduces a security token as an intermediary element between the container management system and the container execution environment. This token acts as a mediator that carries authentication information and enables secure verification without requiring complex security infrastructure, thus enhancing security while preserving the lightweight nature of container execution.
2Reliability
If traditional virtualization layers are used to provide security isolation, then security is improved, but execution efficiency is reduced
Solution Approach 1:
The patent extracts the essential security verification function from traditional virtualization layers and implements it directly within the container execution flow using embedded security tokens. This extraction allows security isolation to be maintained without requiring a full virtualization overhead, enabling containers to execute efficiently while still providing robust security verification.
3Reliability
If security verification mechanisms are added to software containers, then security is improved, but device complexity increases
Solution Approach 1:
The patent changes the security verification approach from complex continuous monitoring to a simplified parameter-based validation using digital signatures embedded in security tokens. This parameter change reduces system complexity by transforming security from a process-intensive function into a straightforward cryptographic verification of pre-computed signature parameters.
Data Source
AI summary
A computer system that comprises a processor, a non-transitory memory, and a system application stored in the non-transitory memory. When executed by the processor, the application receives a request to create a software container, creates the container, generates a signature of the container, creates a container security token that comprises the signature and embeds the container security token in the container, and returns the container with the embedded container security token. The application receives a request to launch an application in the container, determines a confirmation signature of the container provided by the application launch request, compares the confirmation signature to the signature of the container security token in the container, determines that the confirmation signature and the signature of the container security token in the software container match, and responsive to determining the signatures match launches the application in the software container provided by the application launch request.