Verification of Containers by Host Computing System

Patent metadata

Field	Value
Publication number	US-2025258692-A1
Application number	US-202218854835-A
Country	US
Kind code	A1
Filing date	Oct 28, 2022
Priority date	May 26, 2022
Publication date	Aug 14, 2025
Grant date	—

Abstract

Embodiments include methods for a software integrity tool of a host computing system configured with a runtime environment arranged to execute containers that include applications. Such methods include, based on an identifier of a container instantiated in the runtime environment, obtaining a container locator tag associated with the container and performing measurements on a filesystem associated with the container. Such methods include sending, to an attestation verification system (AVS), a representation of the container locator tag and a result of the measurements. Other embodiments include complementary methods for the container and for the AVS, as well as host computing systems configured to perform such methods.

First claim

1 .- 40 . (canceled)

41 . A method for a software integrity tool of a host computing system configured with a runtime environment arranged to execute containers that include applications, the method comprising:
based on an identifier of a container instantiated in the runtime environment, obtaining a container locator tag associated with the container and performing measurements on a filesystem associated with the container; and sending, to an attestation verification system (AVS), a representation of the container locator tag and a result of the measurements.

42 . The method of claim 41 , further comprising:
monitoring for one or more events or patterns indicating that a container has been instantiated in the runtime environment; and in response to detecting the one or more events or patterns, obtaining the identifier of the container that has been instantiated.

43 . The method of claim 42 , wherein monitoring for the one or more events is performed using an eBPF probe.

44 . The method of claim 41 , wherein performing measurements on the filesystem comprises computing a digest of one or more files stored in the filesystem associated with the container, wherein the digest is the result of the measurements sent to the AVS.

45 . The method of claim 44 , wherein performing measurements on the filesystem further comprises selecting the one or more files on which to compute the digest, wherein the selection is according to a digest policy of the host computing system.

46 . The method of claim 41 , wherein the identifier associated with the container is a process identifier (PID) and the filesystem associated with the container has a pathname that includes the PID.

47 . The method of claim 41 , wherein the representation of the container locator tag is one of the following: the container locator tag, or a digest of the container locator tag.

48 . The method of claim 41 , wherein one or more of the following applies:
the container locator tag is a random string; and the container locator tag is obtained from a predefined location in the filesystem associated with the container.

49 . The method of claim 41 , further comprising digitally signing the representation of the container locator tag and the result of the measurements before sending to the AVS, wherein the digitally signing is based on key material that is accessible to the host computing system but is not accessible to containers configured to execute in the runtime environment.

50 . A method for a container that includes an application, the container being configured to execute in a runtime environment of a host computing system, the method comprising:
in response to the container being instantiated in the runtime environment, generating a container locator tag and storing the container locator tag in association with the container; subsequently receiving, from an attestation verification system (AVS), an attestation result indicating whether the AVS verified a filesystem associated with the container based on measurements performed by a software integrity tool of the host computing system; and when the attestation result indicates that the AVS verified the filesystem associated with the container, preparing the application for execution in the runtime environment.

51 . The method of claim 50 , wherein the container also includes an attest client that generates and stores the container locator tag and receives the attestation result.

52 . The method of claim 50 , further comprising performing one or more of the following when the attestation result indicates that the AVS did not verify the filesystem associated with the container: error handling, and refraining from preparing the application for execution in the runtime environment.

53 . The method of claim 50 , wherein one or more of the following applies:
the container locator tag is a random string; and the container locator tag is stored in a predefined location in the filesystem associated with the container.

54 . The method of claim 53 , further comprising sending a representation of the container locator tag to the AVS, wherein the attestation result is based on the representation of the container locator tag.

55 . The method of claim 54 , wherein the representation of the container locator tag sent to the AVS is one of the following: the container locator tag, or a digest of the container locator tag.

56 . The method of claim 50 , wherein the measurement results include a digest of one or more files stored in the filesystem associated with the container.

57 . The method of claim 46 , wherein the one or more files, on which the digest is based, are selected according to a digest policy of the host computing system.

58 . A method for an attestation verification system (AVS) associated with a host computing system configured with a runtime environment arranged to execute containers that include applications, the method comprising:
receiving the following from a software integrity tool of the host computing system:
a representation of a container locator tag for a container instantiated in the runtime environment, and
results of measurements performed by the software integrity tool on a filesystem associated with the container;
based on detecting a match between the representation of the container locator tag and a previously received representation of the container locator tag, performing a verification of the filesystem associated with the container based on the results of the measurements; sending, to the container, an attestation result indicating whether the AVS verified the filesystem associated with the container.

59 . The method of claim 58 , wherein performing the verification comprises:
comparing the results of the measurements with one or more known-good or reference values associated with the container; and verifying the filesystem only when there is a match or correspondence between the results of the measurements and the one or more known-good or reference values.

60 . The method of claim 58 , wherein the previously received representation was received from an attest client included in the container.

61 . The method of claim 58 , wherein one or more of the following applies:
the container locator tag is a random string; and the container locator tag is stored in a predefined location in the filesystem associated with the container.

62 . The method of claim 58 , wherein both the representation and the previously received representation are one of the following: the container locator tag, or a digest of the container locator tag.

63 . The method of claim 58 , wherein:
the representation of the container locator tag and the result of the measurements are digitally signed by the software integrity tool; and performing the verification comprises verifying the digital signing based on key material that is accessible to the host computing system but is not accessible to containers configured to execute in the runtime environment.

64 . A host computing system configured with a runtime environment arranged to execute containers that include applications, the host computing system comprising:
memory storing computer-executable software code for a software integrity tool and for the runtime environment; and processing circuitry configured to execute the software code, wherein execution of the software code configures the host computing system to:

Assignees

• Ericsson Telefon Ab L M

Inventors

• Normann Henrik
• Pålsson Lina
• Eriksson Mikael
• Smeets Bernard
• Preda Stere
• Migault Daniel

Classifications

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• G06F2009/45591

  Monitoring or debugging support · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title