Techniques for securing execution environments by quarantining software containers

Patent metadata

Field	Value
Publication number	US-11625489-B2
Application number	US-202117174994-A
Country	US
Kind code	B2
Filing date	Feb 12, 2021
Priority date	Oct 1, 2015
Publication date	Apr 11, 2023
Grant date	Apr 11, 2023

Abstract

A system and method for securing execution environments by quarantining software containers. A method includes: determining, based on configuration data for an application stored in the application software container, at least one intended behavior of the application when executed by the application software container; monitoring execution of the application software container in a first execution environment, wherein the monitoring further comprises comparing the execution of the application software container to the at least one intended behavior; detecting an unauthorized action by the application software container when the execution of the application software container is anomalous as compared to the at least one intended behavior; and quarantining the application software container by migrating the application software container from the first execution environment to a second execution environment when the unauthorized action is detected.

First claim

What is claimed is:

1. A method for securing execution environments by quarantining software containers, the method comprising:
detecting, by a first application software container in a first execution environment, instantiation of a second application software container in the first execution environment;
determining, based on configuration data for each application of the second application software container, intended behavior of each application when executed by the second application software container;
quarantining the second application software container to a second execution environment based on detecting instantiation of the second application software container;
monitoring, by a third application software container in the second execution environment, execution of the second application software container in the second execution environment, wherein the monitoring comprises comparing the execution of the second application software container to the intended behavior and determining whether the second application software container interacts with a dummy container in the second execution environment, wherein the dummy container is a software application container configured to trap attempted interaction by the second application software container with another application software container in the second execution environment; and
detecting an unauthorized action based on determining that the second application software container interacted with the dummy container; and

generating a detection event based on detecting the unauthorized action.

2. The method of claim 1 , wherein quarantining the application software container further comprises:
creating the second execution environment, wherein creating the second execution environment comprises launching an operating system kernel, instantiating a virtual machine via the operating system kernel, and instantiating the dummy container and the third application software container in the virtual machine of the second execution environment.

3. The method of claim 2 , further comprising:
migrating the second application software container back to the first execution environment when no vulnerability is detected within a predetermined period of time.

4. The method of claim 3 , further comprising:
deleting the second execution environment when the second application software container is migrated back to the first execution environment.

5. The method of claim 1 , wherein monitoring execution of the second application software container comprises the third application software container intercepting communications into and out of the second application software container.

6. The method of claim 1 , wherein detecting instantiation of the second application software container comprises detecting a system call by a fourth application software container in the first execution environment.

7. The method of claim 1 , further comprising the first application software container detecting each application in an image of the second application software container and locating the configuration data for each detected application.

8. A non-transitory computer readable medium having stored thereon an application software container image comprising instructions to:
detect, by a first application software container launched in a first execution environment based on the application software container image, instantiation of a second application software container in the first execution environment;
determine, based on configuration data for each application of the second application software container, intended behavior of each application when executed by the second application software container;
quarantine the second application software container to a second execution environment based on detecting instantiation of the second application software container;
monitor, by a third application software container launched in the second execution environment based on the application software container image, execution of the second application software container in the second execution environment, wherein the instructions to monitor comprise instructions to compare the execution of the second application software container to the intended behavior and determine whether the second application software container interacts with a dummy container in the second execution environment, wherein the dummy container is a software application container configured to trap attempted interaction by the second application software container with another application software container in the second execution environment; and
detecting an unauthorized action based on determining that the second application software container interacted with the dummy container; and
generate a detection event based on detecting the unauthorized action.

9. The non-transitory computer readable medium of claim 8 , wherein the instructions to quarantine the second application software container comprise instructions to create the second execution environment, wherein the instructions to create the second execution environment comprise instructions to launch an operating system (OS) kernel, instantiate a virtual machine (VM) via the OS kernel; and instantiate the dummy container and the third application software container.

10. The non-transitory computer readable medium of claim 9 , wherein the application software container image further comprises instructions to migrate the second application software container back to the first execution environment when no vulnerability is detected within a predetermined period of time.

11. The non-transitory computer readable medium of claim 10 , wherein the application software container image further comprises instructions to delete the second execution environment when the second application software container is migrated back to the first execution environment.

12. The non-transitory computer readable medium of claim 8 , wherein the instructions to monitor execution of the second application software container comprise instructions to intercept communications into and out of the second application software container.

13. The non-transitory computer readable medium of claim 8 , wherein the instructions to detect instantiation of the second application software container comprise instructions to detect a system call by a fourth application software container in the first execution environment.

14. The non-transitory computer readable medium of claim 8 , wherein the application software container image further comprises instructions to detect each application in an image of the second application software container and locate the configuration data for each detected application.

15. A system comprising:
processing circuitry; and
memory having stored therein an application software container image comprising instructions executable by the processing circuitry to cause the system to,
detect, by a first application software container launched in a first execution environment based on the application software container image, instantiation of a second application software container in the first execution environment;
determine, based on configuration data for each application of the second application software container, intended behavior of each application when executed by the second application software container;
quarantine the second application software container to a second execution environment based on detecting instantiation of the second application software container;
monitor, by a third application software container launched in the second execution environ

Assignees

• Twistlock Ltd

Inventors

• Morello John
• Stopel Dima
• Levin Liron

Classifications

• G06F9/44505

  Configuring for program initiating, e.g. using registry, configuration files · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title