Systems and methods for containerized data security

• US 9,805,206 B2
• Filed: 01/30/2017
• Issued: 10/31/2017
• Est. Priority Date: 03/10/2015
• Status: Active Grant

• Current Assignee: Polyverse Corporation
• Original Assignee: Polyverse Corporation
• Inventors: Gounares, Alexander G.
• Primary Examiner(s): Zoubair, Noura
• Application Number:
  US15/419,920
• Publication Number:
  US 20170140158A1
• Time in Patent Office: 274 Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

Provided herein are systems and methods useful in facilitating containerized data security. The system may include a data store, a computer processing unit, a network interface, and memory. The memory may contain executable instructions for causing the system to perform a containerized data security method including obtaining a first external communication from a source external to the system; associating the first external communication with the first container; authenticating the first external communication with respect to the first container; providing the first external communication to an unencrypted instance of the first container in the memory; obtaining a first responsive communication from the unencrypted instance of the first container; and providing the first responsive communication to the source external to the system.

Claims

1. A system useful in facilitating containerized data security, the system comprising:

a data store containing at least a plurality of N encrypted containers each having a respective virtual middle-tier server and virtual data store, including a first virtual middle-tier server and a first virtual data store in a first container of said N encrypted containers, said first container including data associated with a unit of interest to the system and encrypted instructions corresponding to at least one application hosted by said first virtual middle-tier server;

a computer processing unit;

a network interface in data communication with said computer processing unit and said data store; and

memory in data communication with said computer processing unit and containing executable instructions for causing said computer processing unit to perform a containerized data security method including;

(a) obtaining a first external communication from a source external to the system;

(b) associating said first external communication with said first container;

(c) authenticating a login attempt via said first external communication with respect to said first container and obtaining a decryption key from said source external to the system;

(d) after creating an unencrypted instance of said first container using said decryption key from said source external to the system and after establishing an encrypted communication channel between said unencrypted instance of said first container and said source external to the system, providing said first external communication to said unencrypted instance of said first container in said memory;

(e) obtaining a first responsive communication from said unencrypted instance of said first container;

(f) providing said first responsive communication to said source external to the system via said encrypted communication channel between said unencrypted instance of said first container and said source external to the system; and

(g) according to a traffic monitoring protocol, discarding some or all middle-tier applications each having a respective version instantiated in said unencrypted instance of said first container and replacing said discarded applications with new randomized instantiations of the same applications each having a version that is different from its respective version, causing a failure of attacks that may have succeeded in compromising code inside said unencrypted instance of said first container as a conditional response to determining that tracked traffic to or from said unencrypted instance of said first container has diverged from legitimate traffic patterns.

2. The system of claim 1, wherein step (b) of said containerized data security method includes:

obtaining an encrypted version of said first container from said data store;

decrypting encrypted version of said first container; and

instantiating said unencrypted instance of said first container in said memory.

3. The system of claim 2, wherein said containerized data security method further includes using information contained in said first external communication to identify a decryption key associated with said first container.

4. The system of claim 1, wherein said first container includes only data associated with a first unit of interest to the system and said containerized data security method further includes:

(a) obtaining a second external communication from said source external to the system;

(b) associating said second external communication with said first container;

(c) determining said second external communication is associated with a second unit of interest to the system; and

(d) flagging said source external to the system as a security risk.

5. The system of claim 1, wherein said containerized data security method further includes, subsequent to step (e):

encrypting said unencrypted instance of said first container, thereby creating a new encrypted version of said first container; and

providing said new encrypted version of said first container to said data store.

6. The system of claim 1, wherein said first container includes a virtual middle tier server and a virtual data center.

7. The system of claim 1, wherein said first container is a private container.

8. The system of claim 1, wherein said first container is a shared container.

9. The system of claim 1, wherein said first container is a public container.