Serverless Container Ephemeral Data Stripping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional server-based systems for stripping sensitive data from files face security challenges and inefficiencies, particularly in scalability and resource management, leading to risks of unauthorized access and high costs due to idle capacity during variable workloads.
Innovation Solution
Implementing a serverless architecture that uses cloud compute services to generate ephemeral container instances for immediate data processing, stripping sensitive data from files upon receipt, and terminating these instances after processing to ensure secure and efficient data handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional server-based systems are used to strip sensitive data from files, then data processing can be performed continuously, but security risks increase due to persistent memory blocks and file pointers that may be accessed by unauthorized users
Solution Approach 1:
The patent implements ephemeral containers that are created temporarily to process sensitive files and then automatically destroyed. These containers exist only for the duration needed to strip sensitive data from a file, leaving no persistent memory blocks or file pointers that could be exploited by unauthorized users. This disposable approach eliminates the security vulnerability inherent in traditional persistent server systems.
Solution Approach 2:
The system dynamically creates and destroys container instances based on the presence of sensitive files. When a sensitive file is detected, a container is instantiated; when processing is complete, the container is destroyed. This dynamic behavior adapts the system's resource footprint to actual processing needs, maintaining security while enabling continuous operation.
2Productivity
If dedicated servers are allocated to process sensitive data continuously, then real-time data stripping can be achieved, but resource inefficiency and high costs occur due to idle capacity during variable workloads
Solution Approach 1:
The system uses dynamic container instantiation that activates only when sensitive files are present in the input queue. During periods of high workload, multiple containers can be created simultaneously to maintain real-time processing. During low-workload periods, containers are destroyed, eliminating idle capacity and associated energy consumption and costs.
Solution Approach 2:
The ephemeral container architecture provides a universal solution that can handle variable workloads without requiring dedicated persistent servers. The same container image and processing logic are reused across multiple transient instances, enabling the system to scale resources up or down based on actual demand while maintaining consistent processing capabilities.
3Productivity
If traditional servers process large quantities of sensitive data, then high throughput can be achieved, but security risks increase as a single server becomes a high-value target for compromise
Solution Approach 1:
The patent segments the data processing function across multiple ephemeral container instances rather than concentrating it on a single persistent server. Each container processes a portion of the workload and then is destroyed, distributing both the throughput capacity and the security risk. Even if one container is compromised (which is unlikely given its transient nature), the overall system maintains integrity through other concurrent containers.
Solution Approach 2:
By using disposable container instances instead of a valuable persistent server, the system achieves high throughput through parallel processing of multiple short-lived containers while minimizing the security risk associated with any single processing unit. The transient nature of each container makes them poor targets for compromise compared to a persistent server holding sensitive data.
4Ease of operation
If file pointers and memory blocks persist through data stripping processes, then data can be routed between end users, but unauthorized access becomes possible by following the chain of file pointers back to original sensitive files
Solution Approach 1:
The ephemeral container is destroyed immediately after processing, which automatically eliminates all file pointers and memory blocks associated with that container's processing of sensitive data. This ensures that even if routing functionality is implemented, there is no persistent chain of pointers that unauthorized users could follow, as the container holding those references ceases to exist.
Solution Approach 2:
The system performs preliminary destruction of the container and its associated data structures before any potential unauthorized access could occur. By destroying the container immediately after processing rather than maintaining it for later access, the system proactively eliminates the security vulnerability of persistent file pointers while still enabling data routing during the brief processing window.
Data Source
Figure 1
Figure 2~4
Figure 5A~5B
AI summary
A system including one or more memory units containing instructions and one or more processors configured to execute the instructions to perform operations comprising: generating or selecting a container instance upon identifying that a file comprises sensitive data; generating, via the container instance, a stripped file from the file, where the stripped file includes data of the file without the sensitive data from the file; and terminating the container instance such that terminating the container instance deletes the file.