METHOD AND APPARATUS FOR APPLYING APPLICATION CONTEXT SECURITY CONTROLS FOR SOFTWARE CONTAINERS

• US 20190095614A1
• Filed: 11/26/2018
• Published: 03/28/2019
• Est. Priority Date: 05/18/2015
• Status: Active Grant

• Current Assignee: Aqua Security Software, Ltd.
• Original Assignee: Aqua Security Software, Ltd.
• Inventors: Gerebe, Amir
• Granted Patent: US 11,100,216 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

An example method of sharing a resource between software containers includes detecting a request from a first software container to access a resource of a different, second software container, an operational state of the second software container being controlled by a container engine running on the host computing device. The method also includes accepting or rejecting the request based on whether the first and second software containers, which each contain a respective software application, are part of a same logical software application. An example host computing device configured to share resources between software containers is also disclosed.

Claims

1. A method of sharing a resource between software containers, the method implemented by a host computing device and comprising:

detecting a request from a first software container to access a resource of a different, second software container, an operational state of the second software container being controlled by a container engine running on the host computing device; and

accepting or rejecting the request based on whether the first and second software containers, which each contain a respective software application, are part of a same logical software application.

2. The method of claim 1, wherein:

detecting the request comprises intercepting the request before the request is delivered to the second software container;

accepting the request comprises delivering the request to the second software container; and

rejecting the request comprises rejecting the request without delivering the request to the second software container.

3. The method of claim 1, wherein said accepting or rejecting comprises:

determining whether the first and second software containers are part of a same logical software application; and

accepting the request based on the first and second software containers being part of the same logical software application.

4. The method of claim 3, wherein the determining is performed by a third software container that is different from the first and second software containers.

5. The method of claim 3, wherein the determining is based on one or more of:

a runtime parameter included in a request to start the second software container;

an application registry;

an environment variable accessible to the container engine; and

a file in the second software container.

6. The method of claim 3, wherein said accepting or rejecting comprises:

determining whether the requested resource is marked as shared for the first software container by an entry in a security registry; and

based on the first and second software containers being part of different logical software applications;

accepting the request based on the requested resource being marked as shared for the first software container by an entry in the security registry; and

rejecting the request based on the requested resource not being marked as shared for the first software container.

7. The method of claim 1, wherein an operational state of the first software container is controlled by a container engine running on a computing device that is different from the host computing device.

8. The method of claim 1, comprising:

accepting the request to access a resource in the second software container based on the request being received from the second software container.

9. The method of claim 1, wherein said accepting or rejecting the request is further based on whether the first software container is digitally signed.

10. The method of claim 1, wherein the host computing device is a first host computing device, the method comprising:

detecting an outgoing request from the second software container to access a resource of a third software container that is different from the first and second software containers and whose operational state is controlled by a container engine running on a second host computing device that is different from the first host computing device; and

either rejecting the outgoing request at the first host computing device or transmitting the outgoing request to the second host computing device based on whether the second and third software containers, which each contain a respective software application, are part of a same logical software application.

11. The method of claim 10, wherein said either rejecting the outgoing request at the first host computing device or transmitting the outgoing request to the second host computing device is further based on at least one of:

whether the requested resource is marked as shared for the second software container by an entry in a security registry; and

whether the second software container is digitally signed.

12. The method of claim 1, comprising:

in response to the requested resource being an encrypted file in the second software container and the request being one to open the file, decrypting the encrypted file prior to providing the file to the first software container; and

in response to the requested resource being an encrypted file in the second software container and the request being one to write data to the file, receiving the data from the first software container in unencrypted form and encrypting the data prior to saving it in the encrypted file in the second software container.

13. A host computing device comprising:

memory configured to store a second software container; and

processing circuitry operatively connected to the memory and configured to;

detect a request from a first software container that is different from the second software container to access a resource of the second software container; and

accept or reject the request based on whether the first and second software containers, which each contain a respective software application, are part of a same logical software application.

14. The host computing device of claim 13, wherein:

to detect the request, the processing circuitry is configured to intercept the request before the request is delivered to the second software container;

to accept the request, the processing circuitry is configured to deliver the request to the second software container; and

to reject the request, the processing circuitry is configured to prevent delivery of the request to the second software container.

15. The host computing device of claim 13, wherein the processing circuitry is configured to:

determine whether the first and second software containers are part of a same logical software application; and

accept the request based on the first and second software containers being part of the same logical software application.

16. The host computing device of claim 15, wherein the determination is performed by a third software container that is different from the first and second software containers.

17. The host computing device of claim 15, wherein the determination is performed based on one or more of:

a runtime parameter included in a request to start the second software container;

an application registry;

an environment variable accessible to the container engine; and

a file in the second software container.

18. The host computing device of claim 15, wherein the processing circuitry is configured to:

determine whether the requested resource is marked as shared for the first software container; and

based on the first and second software containers being part of different logical software applications;

accept the request based on the requested resource being marked as shared for the first software container by an entry in a security registry; and

reject the request based on the requested resource not being marked as shared for the first software container.

19. The host computing device of claim 13, wherein an operational state of the second software container is controlled by a container engine running on the host computing device, and an operational state of the first software container is controlled by a container engine running on a computing device that is different from the host computing device.

20. The host computing device of claim 13, wherein the processing circuitry is configured to accept the request to access a resource in the second software container based on the request being received from the second software container.

21. The host computing device of claim 13, wherein the processing circuitry is configured to accept or reject the request based on whether the first software container is digitally signed.

22. The host computing device of claim 13, wherein the host computing device is a first host computing device, and the processing circuitry is configured to:

detect an outgoing request from the second software container to access a resource of a third software container that is different from the first and second software containers and whose operational state is controlled by a container engine running on a second host computing device that is different from the first host computing device; and

either reject the outgoing request or transmit the outgoing request to the second host computing device based on whether the second and third software containers, which each contain a respective software application, are part of a same logical software application.

23. The host computing device of claim 22, wherein the processing circuitry is configured to base the rejection or acceptance of the outgoing request on at least one of:

whether the requested resource is marked as shared for the second software container by an entry in a security registry; and

whether the second software container is digitally signed.

24. The host computing device of claim 13, wherein:

based on the requested resource being an encrypted file in the second software container and the request being one to open the file, the processing circuitry is configured to decrypt the encrypted file prior to providing the file to the first software container; and

based on the requested resource being an encrypted file in the second software container and the request being one to write data to the file, the processing circuitry is configured to receive the data from the first software container in unencrypted form and encrypt the data prior to saving it in the encrypted file in the second software container.