Security Module Injection for Container Communication

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing microservice-based architectures face inefficiencies in implementing secure communication between software containers, requiring cumbersome modifications to enable encrypted communication.

Innovation Solution

A method is introduced where a security module is injected into software container images, configuring it to forward all communication through the security module, with credentials and container specifications managed in distributed repositories like blockchain databases for secure and transparent communication.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security module is injected into container images to enable secure communication, then communication security is improved, but device complexity increases

Engineering Contradiction:
Improvecommunication securityVSAvoidcontainer architecture complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

A security module is introduced as an intermediary component between external entities and container modules. This module handles all incoming and outgoing communications, performing encryption and decryption operations. The security module acts as a mediator that isolates the original container modules from security concerns, allowing them to communicate securely without modifying their code. The module forwards authenticated and decrypted messages to the appropriate container services while maintaining the original container architecture intact.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If communication is encrypted between containers, then security is improved, but ease of operation deteriorates due to cumbersome modifications required

Engineering Contradiction:
Improveencrypted communicationVSAvoiddeployment simplicity
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

Security credentials (public and private keys) are generated and configured in advance during the container image building process. The security module is pre-configured with the container's public key and credential information before deployment. When the container is deployed, the security module automatically establishes secure communication channels using these pre-configured credentials, eliminating the need for runtime configuration or manual key exchange procedures.

Inventive Principle:
Principle #10Preliminary action

3Reliability

If security module forwards all communication, then communication security is improved, but use of energy increases due to encryption and decryption operations

Engineering Contradiction:
Improvecommunication securityVSAvoidprocessing energy
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The security module implements selective encryption and decryption based on the specific communication requirements of each container service. Not all communication channels require the same level of security processing - the module identifies which communications need encryption and which can use more efficient transmission methods. This localized approach to security processing reduces overall energy consumption while maintaining security where absolutely necessary.

Inventive Principle:
Principle #3Local quality

Data Source

PatentUS11044340B2Security for a software container
Publication Date: 2021.06.22 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)
  • US11044340B2 patent drawing
  • US11044340B2 patent drawing
  • US11044340B2 patent drawing

AI summary

It is presented a method performed in a deployment server being configured to deploy a software container. The method comprises the steps of: receiving a trigger to deploy a software container; obtaining an image intended for the software container comprising a set of at least one module; injecting a security module in the image; obtaining a container specification of the image; configuring the security module to forward incoming communication to the set of at least one module in accordance with the obtained container specification; modifying the container specification such that the at least one service is accessed externally only via the security module and that all outgoing communication, from the set of at least one module, is directed via the security module; publishing the modified container specification in a service discovery repository; and deploying the software container on at least one execution server.