Policy management in software container computing environments

Patent metadata

Field	Value
Publication number	US-10154065-B1
Application number	US-201615273261-A
Country	US
Kind code	B1
Filing date	Sep 22, 2016
Priority date	Sep 22, 2016
Publication date	Dec 11, 2018
Grant date	Dec 11, 2018

Abstract

A system for managing computer security policies includes a policy management system that provides computer security policies to container host machines. The policy management system retrieves images of software containers from an image registry and generates computer security policies that are specific for each image. A container host machine informs the policy management system when an image is pulled from the image registry into the container host machine. The policy management system identifies a computer security policy that is applicable to the image and provides the computer security policy to the container host machine. The container host machine can also locally identify the applicable computer security policy from among computer security policies that are received from the policy management system. The container host machine enforces the computer security policy and other currently existing computer security policies.

First claim

What is claimed is:

1. A computer-implemented method comprising:
retrieving an image of a software container from an image registry;
scanning the image to identify a rule that is specific to the image;
creating a computer security policy for the image, the computer security policy including the rule, the computer security policy dictating permissible operations of an application program that is containerized in the image;
retrieving the image into a container host machine that is configured to host the application program that is containerized in the image;
retrieving the computer security policy into the container host machine;
identifying the computer security policy as specific to the image; and
enforcing the computer security policy in the container host machine.

2. The method of claim 1 , wherein retrieving the computer security policy into the container host machine comprises:
sending a notification to a policy management system that the image is present in the container host machine;
in response to receiving the notification, providing the computer security policy from the policy management system to the container host machine over a computer network.

3. The method of claim 2 , further comprising:
the container host machine merging the computer security policy with a pre-existing computer security policy to generate a merged computer security policy; and
enforcing the merged computer security policy in the container host machine.

4. The method of claim 2 , further comprising:
scanning the image in the policy management system to identify the rule that is specific to the image;
creating the computer security policy for the image that includes the rule in the policy management system; and
storing the computer security policy rule in the policy management system.

5. The method of claim 4 , further comprising:
scanning the image in the policy management system to identify a layer of the image.

6. The method of claim 1 , wherein retrieving the computer security policy into the container host machine comprises:
receiving a plurality of computer security policies in the container host machine; and
in the container host machine, identifying the computer security policy from among the plurality of computer security policies as specific to the image.

7. The method of claim 1 , wherein the application program that is containerized in the image accesses a port in the container host machine, and wherein the rule governs access to the port and indicates a condition on when the rule applies.

8. A system for managing computer security policies, the system comprising:
a policy management system comprising a memory and a processor, the memory of the policy management system storing instructions that when executed by the processor of the policy management system cause the policy management system to perform the steps of: retrieving an image of a software container from an image registry, scanning the image to identify a rule that is specific to the image, creating a computer security policy that includes the rule that is specific to the image, receiving a notification that the image has been pulled into a container host machine, identifying the computer security policy as being specific to the image, and providing the computer security policy to the container host machine in response to receiving the notification, wherein the computer security policy dictates permissible operations of an application program that is containerized in the image; and
a container host machine comprising a memory and a processor, the memory of the container host machine storing instructions that when executed by the processor of the container host machine cause the container host machine to perform the steps of: retrieving the image from the image registry, hosting the application program that is containerized in the image, sending the policy management system the notification that the image is in the container host machine, receiving the computer security policy from the policy management system after sending the notification, and enforcing the computer security policy in the container host machine.

9. The system of claim 8 , wherein the image registry and the container host machine are in an enterprise network.

10. The system of claim 9 , wherein the policy management system is off-premise outside the enterprise network.

11. The system of claim 9 , wherein the instructions stored in the memory of the container host machine, when executed by the processor of the container host machine, cause the container host machine to perform the steps of: merging the computer security policy with a pre-existing computer security policy to generate a merged computer security policy, and enforcing the merged computer security policy in the container host machine.

12. The system of claim 8 , wherein the application program that is containerized in the image accesses a port in the container host machine, and wherein the rule governs access to the port and indicates a condition on when the rule applies.

13. A system for managing computer security policies, the system comprising:
a policy management system comprising a memory and a processor, the memory of the policy management system storing instructions that when executed by the processor of the policy management system cause the policy management system to perform the steps of: retrieving an image of a software container from an image registry, scanning the image to identify a rule that is specific to the image, creating a computer security policy that includes the rule that is specific to the image, and providing the computer security policy to a container host machine without waiting for the container host machine to notify the policy management system that the image is present in the container host machine, wherein the computer security policy dictates permissible operations of an application program that is containerized in the image; and
a container host machine comprising a memory and a processor, the memory of the container host machine storing instructions that when executed by the processor of the container host machine cause the container host machine to perform the steps of: receiving the computer security policy from the policy management system, retrieving the image from the image registry, hosting the application program that is containerized in the image, identifying the computer security policy as applicable to the image, and enforcing the computer security policy in the container host machine.

14. The system of claim 13 , wherein the image registry and the container host machine are in an enterprise network.

15. The system of claim 14 , wherein the policy management system if off-premise outside the enterprise network.

16. The system of claim 13 , wherein the instructions stored in the memory of the container host machine, when executed by the processor of the container host machine, cause the container host machine to perform the steps of: merging the computer security policy with another computer security policy to generate a merged computer security policy, and enforcing the merged computer security policy in the container host machine.

17. The system of claim 13 , wherein the application program that is containerized in the image accesses a port in the container host machine, and wherein the rule governs access to the port and indicates a condition on when the rule applies.

Assignees

• Trend Micro Inc

Inventors

• Buchler Marek
• Boyce Kevin

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title