Security for a software container

Patent metadata

Field	Value
Publication number	US-11044340-B2
Application number	US-201716481991-A
Country	US
Kind code	B2
Filing date	Jan 31, 2017
Priority date	Jan 31, 2017
Publication date	Jun 22, 2021
Grant date	Jun 22, 2021

Abstract

It is presented a method performed in a deployment server being configured to deploy a software container. The method comprises the steps of: receiving a trigger to deploy a software container; obtaining an image intended for the software container comprising a set of at least one module; injecting a security module in the image; obtaining a container specification of the image; configuring the security module to forward incoming communication to the set of at least one module in accordance with the obtained container specification; modifying the container specification such that the at least one service is accessed externally only via the security module and that all outgoing communication, from the set of at least one module, is directed via the security module; publishing the modified container specification in a service discovery repository; and deploying the software container on at least one execution server.

First claim

The invention claimed is:

1. A method performed in a deployment server, the deployment server being configured to deploy a software container, the method comprising the steps of:
receiving a trigger to deploy a software container;
obtaining an image intended for the software container, the image comprising a set of at least one module;
injecting a security module in the image;
obtaining a container specification of the image, the container specification comprising information of at least one service exposed by the set of at least one module;
configuring the security module to forward incoming communication to the set of at least one module in accordance with the obtained container specification;
modifying the container specification such that the at least one service is accessed externally only via the security module and that all outgoing communication, from the set of at least one module, is directed via the security module;
publishing the modified container specification in a service discovery repository; and
deploying the software container on at least one execution server.

2. The method of claim 1 , further comprising the steps of:
obtaining an identifier of the image;
creating a credential for the image, the credential comprising a public key and a private key;
publishing the public key in a distributed security repository; and
providing the private key to the security module.

3. The method of claim 2 , wherein the step of creating a credential is performed in the security module and wherein the method further comprises the steps of:
providing an access token to the security module for enabling access to the distributed security repository.

4. The method of claim 2 , further comprising the steps of:
adding the identifier of the image to a container group of the distributed security repository; and
providing an identifier of the container group to the security module.

5. The method of claim 2 , wherein the distributed security repository is a blockchain database.

6. The method of claim 1 , wherein the service discovery repository is a distributed peer-to-peer service discovery repository.

7. A deployment server being configured to deploy a software container, the deployment server comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause the deployment server to:
receive a trigger to deploy a software container;
obtain an image intended for the software container comprising a set of at least one module;
inject a security module in the image;
obtain a container specification of the image, the container specification comprising information of at least one service exposed by the set of at least one module;
configure the security module to forward incoming communication to the set of at least one module in accordance with the obtained container specification;
modify the container specification such that the at least one service is accessed externally only via the security module and that all outgoing communication, from the set of at least one module, is directed via the security module;
publish the modified container specification in a service discovery repository; and
deploy the software container on at least one execution server.

8. The deployment server of claim 7 , further comprising instructions that, when executed by the processor, cause the deployment server to:
obtain an identifier of the image;
create a credential for the image, the credential comprising a public key and a private key;
publish the public key in a distributed security repository; and
provide the private key to the security module.

9. The deployment server of claim 8 , wherein the instructions to create a credential are performed in the security module and wherein the deployment server further comprise instructions that, when executed by the processor, cause the deployment server to:
provide an access token to the security module for enabling access to the distributed security repository.

10. The deployment server of claim 8 , further comprising instructions that, when executed by the processor, cause the deployment server to:
add the identifier of the image to a container group of the distributed security repository; and
provide an identifier of the container group to the security module.

11. The deployment server of claim 8 , wherein the distributed security repository is a blockchain database.

12. The deployment server of claim 7 , wherein the service discovery repository is a distributed peer-to-peer service discovery repository.

13. A method for establishing a connection between a local software container of a local execution server and a remote software container of a remote execution server, the method being performed in the local software container of the local execution server and comprising the steps of:
receiving a request from the remote software container to establish a connection between the remote software container and the local software container, the request comprising an identifier of the remote software container;
obtaining a public key of the remote software container from a distributed security repository using the identifier of the remote software container;
validating the request using the public key of the remote software container;
when the request is found to be valid, obtaining container group data from the distributed security repository, and
proceeding with connection establishment when both the remote software container and the local software container belong to the same container group.

14. The method of claim 13 , wherein the request comprises an identifier of a container group to which the remote software container belongs.

15. The method of claim 13 , wherein the step of validating comprises validating the request by validating a signature of the request using a digital signature of the request.

16. The method of claim 13 , wherein the distributed security repository is a blockchain database.

17. An execution server for establishing a connection between a local software container of the execution server, being a local execution server, and a remote software container of a remote execution server, the local execution server comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause the local execution server to:
receive a request from the remote software container to establish a connection between the remote software container and the local software container, the request comprising an identifier of the remote software container;
obtain a public key of the remote software container from a distributed security repository using the identifier of the remote software container;
validate the request using the public key of the remote software container; and
when the request is found to be valid, obtain container group data from the distributed security repository, and
proceeding with connection establishment when both the remote software container and the local software container belong to the same container group.

18. The execution server of claim 17 , wherein the request comprises an identifier of a container group to which the remote software container belongs.

19. The execution server of claim 17 , wherein the step of validating comprises validating the request by validating a signature of the request using a digital signature of the request.

20. The execution server of claim 17 , wherein the distributed security repository is a blockchain database.

Assignees

• Ericsson Telefon Ab L M

Inventors

• Kristiansson Johan
• Bergström Daniel
• Lundberg Jonas
• Sandgren Nicklas

Classifications

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L67/34 Primary

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04L67/104

  Peer-to-peer [P2P] networks · CPC title