Providing isolated containers for user request processing

Patent metadata

Field	Value
Publication number	US-11368459-B2
Application number	US-202017037953-A
Country	US
Kind code	B2
Filing date	Sep 30, 2020
Priority date	Sep 30, 2020
Publication date	Jun 21, 2022
Grant date	Jun 21, 2022

Abstract

Methods, computer program products, and/or systems are provided that can perform the following operations: receiving a connection request from a first user device; creating an authentication container for the first user device; authenticating the first user device using the authentication container; in response to authentication for the first user device being successful, creating a first user request processing container for the first user device; and processing user requests received from the first user device using the first user request processing container.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving a connection request from a first user device and a second user device;
creating an authentication container for the first user device and an authentication container for the second user device;
creating an authentication forwarding process shared among the authentication container for the first user device and the authentication container for the second user device;
mapping, by the authentication forwarding process, an authentication request with an identifier associated with the authentication container for the first user device;
authenticating the first user device using the authentication container for the first user device;
forwarding, by the authentication forwarding process, the authentication request from the authentication container for the first user device to the first user device;
in response to authentication for the first user device being successful, creating a first user request processing container for the first user device and a user request forwarding process;
wherein access restricted resources assigned to the first user request processing container are not assigned to a second user request processing container created for the second user device, and where the second user device cannot access the access restricted resources;
providing to the user request forwarding process, an identifier associated with the first user request processing container;
mapping, by the user request forwarding process, user requests containing the identifier associated with the first user request processing container;
delivering, by the user request forwarding process, user requests from the first device to the first user request processing container; and
processing the user requests delivered by the first user request forwarding process using the first user request processing container.

2. The computer-implemented method of claim 1 , wherein the first user request processing container is dedicated to the first user device.

3. The computer-implemented method of claim 1 , further comprising:
mapping, by the authentication forwarding process, authentication requests with identifiers associated with the authentication container for the second user device to the authentication container for the second user device; and
forwarding, by the authentication forwarding process, the authentication requests from the authentication container for the second user device to the second user device.

4. The computer-implemented method of claim 3 , further comprising:
in response to authentication for the second user device being successful, creating a second user request processing container;
providing to the user request forwarding process, an identifier associated with the second user request processing container; and
mapping, by the user request forwarding process, user requests containing the identifier associated with the second user request processing container.

5. The computer-implemented method of claim 4 , further comprising:
delivering, by the user request forwarding process, user requests from the second device to the second user request processing container; and
processing the user requests delivered by the second user request forwarding process using the second user request processing container.

6. The computer-implemented method of claim 1 , wherein authenticating the first user device using the authentication container further comprises:
receiving an authentication response from the first user device using the authentication forwarding process; and
providing the authentication response to the authentication container for the first user device based on the identifier associated with the authentication container for the first user device.

7. The computer-implemented method of claim 1 , wherein computing resources assigned to the first user request processing container are determined based on features of the first user device.

8. The computer-implemented method of claim 1 , wherein responses for the user requests containing the identifier associated with the first user request processing container are provided in an unprivileged process inside the first user request processing container established to process the user requests.

9. The computer-implemented method of claim 1 , wherein the user request forwarding process is an unprivileged process.

10. A computer system, comprising:
one or more processors; and
a computer-readable memory coupled to the processors, the computer-readable memory including instructions that when executed by the processors perform operations of:
receiving a connection request from a first user device and a second user device; creating an authentication container for the first user device and an authentication container for the second user device;
creating an authentication forwarding process shared among the authentication container for the first user device and the authentication container for the second user device;
mapping, by the authentication forwarding process, an authentication request with an identifier associated with the authentication container for the first user device;
authenticating the first user device using the authentication container for the first user device;
forwarding, by the authentication forwarding process, the authentication request from the authentication container for the first user device to the first user device;
in response to authentication for the first user device being successful, creating a first user request processing container for the first user device and a user request forwarding process;
wherein access restricted resources assigned to the first user request processing container are not assigned to a second user request processing container created for the second user device, and where the second device cannot access the access restricted resource;
providing to the user request forwarding process, an identifier associated with the first user request processing container;
mapping, by the user request forwarding process, user requests containing the identifier associated with the first user request processing container;
delivering, by the user request forwarding process, user requests from the first device to the first user request processing container; and processing the user requests delivered by the first user request forwarding process using the first user request processing container.

11. The computer system of claim 10 , wherein the first user request processing container is dedicated to the first user device.

12. The computer system of claim 10 , wherein the operations further comprise:
mapping, by the authentication forwarding process, authentication requests with identifiers associated with the authentication container for the second user device to the authentication container for the second user device; and
forwarding, by the authentication forwarding process, the authentication requests from the authentication container for the second user device to the second user device.

13. The computer system of claim 12 , wherein the operations further comprise:
in response to authentication for the second user device being successful, creating a second user request processing container;
providing to the user request forwarding process, an identifier associated with the second user request processing container; and
mapping, by the user request forwarding process, user requests containing the identifier associated with the second user request processing container.

14. The computer system of claim 13 , wherein processing user requests received from the first us

Assignees

• IBM

Inventors

• Wang Heng
• Chen xiao ling
• Liu Chen Guang
• Ye Wen Qi Wq
• Tan Fei
• Lu Lu
• Li Jing
• Pei Qing Yu

Classifications

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F9/547

  Remote procedure calls [RPC]; Web services · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title