Thread-Level Access Control for Socket Descriptors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Scaled-out, distributed applications in data centers are vulnerable to breaches and data theft due to inadequate protection of East-West communication flows, where malware can inject applets into application code through data sockets, and existing behavior-based analysis methods are not deterministic and generate false positives, reducing performance.
Innovation Solution
A system that monitors application instances, detects unregistered application threads, and quarantines them by consulting a registration index, using Application and Data Protection Layer (ADPL) libraries to control access to socket descriptors and enforce security policies, ensuring only registered threads can communicate securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior-based analysis is used to detect application exceptions, then application protection is provided, but false positives increase and performance decreases
Solution Approach 1:
The patent applies preliminary action by registering application threads in advance with the security appliance before execution. The registration process occurs during application initialization, where the security appliance stores thread identifiers and their associated application instances. This pre-registration enables deterministic verification during runtime without requiring complex behavior analysis, thus maintaining high application performance while providing reliable protection against unauthorized threads.
2Reliability
If security appliances are deployed to protect data centers, then security perimeter is established, but East-West communication remains vulnerable
Solution Approach 1:
The patent applies segmentation by extending security protection from the network level to the individual thread level. Instead of treating entire applications or network segments as units, the security appliance evaluates and controls each application thread independently. This granular segmentation allows the system to identify and block unauthorized threads (such as injected malware) while permitting legitimate threads to communicate freely, thereby protecting against East-West communication vulnerabilities without compromising overall system performance.
3Productivity
If clear data communication is used between applications, then communication efficiency is maintained, but data breaches become possible
Solution Approach 1:
The patent applies the intermediary principle by introducing a security appliance that acts as a mediator between application threads and the network communication infrastructure. The security appliance intercepts and evaluates thread identifiers associated with communication attempts, verifying whether threads are registered and authorized. This intermediary layer enables clear data communication to proceed efficiently for authorized threads while blocking unauthorized access attempts, thus maintaining communication efficiency without exposing the system to data breaches.
Data Source
AI summary
In one embodiment, a system includes a processing circuit and logic integrated with and/or executable by the processing circuit. The logic causes the processing circuit to monitor a plurality of application instances operating on a first host. The logic also causes the processing circuit to detect that a first application thread has been called by a first application instance operating on the first host and determine whether the first application thread is registered to be called by the first application instance on the first host by consulting a registration index. Moreover, the logic causes the processing circuit to quarantine the first application thread in response to a determination that the first application thread is not registered to be called by the first application instance on the first host.