Shared Service Container for Secure Inter-Process Communication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In container-based environments, inter-process communication issues arise, particularly in container-managed applications, where the container may maliciously access resources, and decision-making about access control is based on an application descriptor, leading to potential security vulnerabilities.

Innovation Solution

A system with a shared service container providing common services across processes, utilizing a single service discovery API for both application and shared services, allowing secure and transparent access to services through a pluggable interface and service discovery API, ensuring that applications can access services without relying solely on container decisions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If inter-process communication is used in container-based environments, then services can be shared across processes, but security vulnerabilities arise from malicious container access to resources

Engineering Contradiction:

Improveservice sharing capabilityVSAvoidmalicious container access

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a service registry as an intermediary component that mediates all service access requests between containers and services. Instead of allowing direct inter-process communication, containers must register their service requirements with the service registry, which then orchestrates secure access through controlled interfaces. This intermediary layer prevents malicious containers from directly accessing resources while maintaining legitimate service sharing capabilities.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The service registry implements feedback mechanisms by monitoring and tracking service access requests, container identities, and access patterns. This feedback loop enables the system to detect suspicious behavior, enforce access policies dynamically, and provide audit trails for security monitoring. The feedback system allows the container management system to respond to potential security threats while maintaining efficient service sharing.

Inventive Principle:

Principle #23Feedback

2Extent of automation

If container access control is based on application descriptor, then access decisions can be made automatically, but security vulnerabilities arise from insufficient access control granularity

Engineering Contradiction:

Improveautomatic access decisionVSAvoidaccess control security

Core Design Contradiction:

Extent of automationVSReliability

Solution Approach 1:

The patent transforms the access control mechanism from static application descriptor-based decisions to dynamic parameter-driven control. The service registry evaluates multiple parameters including container identity, service type, access requirements, and security policies to make access decisions. This parameter-based approach maintains automation while significantly improving security granularity by considering multiple factors beyond the basic application descriptor.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The access control system transitions from static descriptor-based rules to dynamic policy evaluation. Access decisions are made in real-time based on current system state, container credentials, and security policies. The service registry dynamically adjusts access permissions based on verified container identities and service requirements, providing both automation and enhanced security reliability.

Inventive Principle:

Principle #15Dynamics

3Reliability

If separate processes are used for container-managed applications, then process isolation is achieved, but communication overhead increases between processes

Engineering Contradiction:

Improveprocess isolationVSAvoidcommunication overhead

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The service registry serves multiple functions simultaneously: it acts as a service discovery mechanism, an access control gateway, a communication coordinator, and a security monitoring point. By consolidating these functions into a single universal component, the patent reduces the number of separate communication interfaces needed between processes, thereby maintaining process isolation while minimizing communication overhead.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS7877091B2Method and system for executing a container managed application on a processing device

Publication Date: 2011.01.25 MALIKIE INNOVATIONS LTD

AI summary

There is provided a system for executing a container-managed application in a processing device, the system comprising a shared service container providing at least one common service for the processing device, executed in at least one process and at least one container-managed application, each comprising an application executed in a given process and accessing at least one service of the application and the at least one common service using a single service discovery API.