JP7368476B2 - セキュア・コンテナの作成および実行 - Google Patents

セキュア・コンテナの作成および実行 Download PDF

Info

Publication number
JP7368476B2
JP7368476B2 JP2021537931A JP2021537931A JP7368476B2 JP 7368476 B2 JP7368476 B2 JP 7368476B2 JP 2021537931 A JP2021537931 A JP 2021537931A JP 2021537931 A JP2021537931 A JP 2021537931A JP 7368476 B2 JP7368476 B2 JP 7368476B2
Authority
JP
Japan
Prior art keywords
layer
secure
software container
encrypted
container
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
JP2021537931A
Other languages
English (en)
Japanese (ja)
Other versions
JP2022520703A (ja
JP2022520703A5 (https=
JPWO2020161577A5 (https=
Inventor
バッヒャー、ウッツ
ブエントゲン、ラインハルト
モルジャン、ピーター
フランク、ヤーノシュ
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
International Business Machines Corp
Original Assignee
International Business Machines Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by International Business Machines Corp filed Critical International Business Machines Corp
Publication of JP2022520703A publication Critical patent/JP2022520703A/ja
Publication of JP2022520703A5 publication Critical patent/JP2022520703A5/ja
Publication of JPWO2020161577A5 publication Critical patent/JPWO2020161577A5/ja
Application granted granted Critical
Publication of JP7368476B2 publication Critical patent/JP7368476B2/ja
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/11—File system administration, e.g. details of archiving or snapshots
    • G06F16/116—Details of conversion of file system types or formats
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45583—Memory management, e.g. access or allocation
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2107—File encryption
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/61—Installation
    • G06F8/63—Image based installation; Cloning; Build to order

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)
  • Stored Programmes (AREA)
JP2021537931A 2019-02-06 2020-01-31 セキュア・コンテナの作成および実行 Active JP7368476B2 (ja)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
EP19155755.2 2019-02-06
EP19155755 2019-02-06
PCT/IB2020/050789 WO2020161577A1 (en) 2019-02-06 2020-01-31 Creation and execution of secure containers

Publications (4)

Publication Number Publication Date
JP2022520703A JP2022520703A (ja) 2022-04-01
JP2022520703A5 JP2022520703A5 (https=) 2022-06-22
JPWO2020161577A5 JPWO2020161577A5 (https=) 2022-06-22
JP7368476B2 true JP7368476B2 (ja) 2023-10-24

Family

ID=65351936

Family Applications (1)

Application Number Title Priority Date Filing Date
JP2021537931A Active JP7368476B2 (ja) 2019-02-06 2020-01-31 セキュア・コンテナの作成および実行

Country Status (6)

Country Link
US (1) US11475138B2 (https=)
JP (1) JP7368476B2 (https=)
CN (1) CN113383330B (https=)
DE (1) DE112020000694T5 (https=)
GB (1) GB2594225B (https=)
WO (1) WO2020161577A1 (https=)

Families Citing this family (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102223141B1 (ko) * 2019-02-12 2021-03-04 성균관대학교산학협력단 컨테이너 환경에서의 스토리지 드라이버의 동작 방법 및 스토리지 드라이버 장치
US11062022B1 (en) * 2019-05-01 2021-07-13 Intuit Inc. Container packaging device
US10901704B1 (en) * 2020-07-19 2021-01-26 Xmodn Security, Llc Computer-aided design, simulation, and code generation for cryptography
US11455405B2 (en) * 2020-08-07 2022-09-27 EMC IP Holding Company LLC Optimizing docker image encryption—tradeoff between performance and protection level
US11675913B2 (en) * 2020-09-18 2023-06-13 EMC IP Holding Company LLC Optimizing container image encryption
US11455429B2 (en) * 2020-12-03 2022-09-27 International Business Machines Corporation Container-based cryptography hardware security module management
US11874926B2 (en) * 2020-12-07 2024-01-16 Hewlett Packard Enterprise Development Lp Measuring containers
CN113296887B (zh) * 2021-03-31 2023-12-08 阿里巴巴（中国）有限公司 安全容器启动的方法以及装置
CN113391880B (zh) * 2021-06-21 2023-04-07 超越科技股份有限公司 一种分层双重哈希验证的可信镜像传输方法
US12056512B2 (en) 2021-06-25 2024-08-06 Microsoft Technology Licensing, Llc Secure computing mechanism
CN113569232A (zh) * 2021-08-13 2021-10-29 中国光大银行股份有限公司 容器的可信度量方法、装置及数据系统
CN114329442B (zh) * 2021-12-27 2025-12-23 奇安信科技集团股份有限公司 安全防护方法及装置
US20230315678A1 (en) * 2022-03-29 2023-10-05 International Business Machines Corporation Storage driver for managing a multiple layer file system on the cloud
CN114780139B (zh) * 2022-04-01 2025-07-01 上海安势信息技术有限公司 一种镜像成分的分析方法、系统及存储介质
US20220335139A1 (en) * 2022-05-30 2022-10-20 Intel Corporation Method and apparatus for improved container image deployment
US12242879B2 (en) * 2022-07-06 2025-03-04 International Business Machines Corporation Protecting container images and runtime data
CN115344854A (zh) * 2022-07-26 2022-11-15 厦门服云信息科技有限公司 一种容器内监控其他容器文件的方法、终端设备及介质
US12608237B2 (en) * 2022-11-23 2026-04-21 Red Hat, Inc. Detecting and migrating a rogue user application to avoid functional safety interference
US12189572B1 (en) * 2023-01-10 2025-01-07 Palantir Technologies Inc. Streamlining processing and transport of artifacts in air-gapped networks
US12321473B2 (en) * 2023-05-19 2025-06-03 Red Hat, Inc. On-demand encrypted container image download
US12314124B2 (en) 2023-07-12 2025-05-27 Bank Of America Corporation System and method for resolving a system alarm
US12242363B2 (en) 2023-07-12 2025-03-04 Bank Of America Corporation System and method for securing resolution of a system alarm
EP4506843A1 (en) * 2023-08-08 2025-02-12 Intel Corporation Methods and apparatus for container deployment in a network-constrained environment
US12579296B2 (en) * 2024-06-11 2026-03-17 Sylabs IP Holdings, LLC, Series G Data security transactions using software container machine readable configuration data

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170177860A1 (en) 2015-12-18 2017-06-22 Amazon Technologies, Inc. Software container registry container image deployment
JP2017130192A (ja) 2015-12-24 2017-07-27 インテル コーポレイション クラウドデータセンターにおけるアプリケーションコンテナの信頼できるデプロイ

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5129082A (en) * 1990-03-27 1992-07-07 Sun Microsystems, Inc. Method and apparatus for searching database component files to retrieve information from modified files
CN101847184A (zh) 2009-12-16 2010-09-29 深圳市虹安信息技术有限公司 采用加密沙箱的文件加密方法
US9176677B1 (en) * 2010-09-28 2015-11-03 Emc Corporation Virtual provisioning space reservation
US8412945B2 (en) 2011-08-09 2013-04-02 CloudPassage, Inc. Systems and methods for implementing security in a cloud computing environment
US9740583B1 (en) * 2012-09-24 2017-08-22 Amazon Technologies, Inc. Layered keys for storage volumes
US9652631B2 (en) * 2014-05-05 2017-05-16 Microsoft Technology Licensing, Llc Secure transport of encrypted virtual machines with continuous owner access
CN105069353B (zh) * 2015-08-11 2017-10-24 武汉大学 一种基于Docker的可信容器安全加固方法
US20170130192A1 (en) * 2015-11-09 2017-05-11 Organovo, Inc. Methods for tissue fabrication
US10460124B2 (en) * 2016-06-20 2019-10-29 Netapp, Inc. Per-volume tenant encryption and external key manager
EP3267351A1 (en) 2016-07-07 2018-01-10 Gemalto Sa Method for securely managing a docker image
US10554690B2 (en) 2016-11-10 2020-02-04 International Business Machines Corporation Security policy inclusion with container deployment
US10572226B2 (en) 2016-12-21 2020-02-25 Aon Global Operations Ltd (Singapore Branch) Methods, systems, and portal using software containers for accelerating aspects of data analytics application development and deployment
CN107729020B (zh) * 2017-10-11 2020-08-28 北京航空航天大学 一种实现大规模容器快速部署的方法
US10997283B2 (en) * 2018-01-08 2021-05-04 Aqua Security Software, Ltd. System for securing software containers with encryption and embedded agent
CN109190386B (zh) * 2018-04-04 2021-11-12 中国电子科技网络信息安全有限公司 基于Device Mapper的容器镜像分层加密存储方法

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170177860A1 (en) 2015-12-18 2017-06-22 Amazon Technologies, Inc. Software container registry container image deployment
JP2017130192A (ja) 2015-12-24 2017-07-27 インテル コーポレイション クラウドデータセンターにおけるアプリケーションコンテナの信頼できるデプロイ

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
佐藤 寛文，ＯｖｅｒｌａｙＦＳを用いたコンテナに対するサービス妨害攻撃の防止，コンピュータセキュリティシンポジウム２０１８論文集，一般社団法人情報処理学会，2018年10月25日，pp.38-45
西島 剛，はじめてのＤｏｃｋｅｒ，初版，株式会社工学社，2016年04月25日，pp.7-10, 20-23, 25-26, 34-37, 68-70

Also Published As

Publication number Publication date
US11475138B2 (en) 2022-10-18
GB202112113D0 (en) 2021-10-06
JP2022520703A (ja) 2022-04-01
GB2594225B (en) 2022-03-02
CN113383330A (zh) 2021-09-10
CN113383330B (zh) 2025-05-09
GB2594225A (en) 2021-10-20
US20200250319A1 (en) 2020-08-06
WO2020161577A1 (en) 2020-08-13
DE112020000694T5 (de) 2021-10-21

Similar Documents

Publication Publication Date Title
JP7368476B2 (ja) セキュア・コンテナの作成および実行
US11159518B2 (en) Container independent secure file system for security application containers
JP7546675B2 (ja) セキュア・ゲストへのセキュリティ・モジュールのセキュア・オブジェクトのバインディング
US9397832B2 (en) Shared data encryption and confidentiality
JP7388802B2 (ja) セキュアなオペレーティング・システム・イメージのインクリメンタル復号および完全性検証
US9779032B2 (en) Protecting storage from unauthorized access
US11755721B2 (en) Trusted workload execution
US11093272B2 (en) Virtual machine allocation and migration between hardware devices by destroying and generating enclaves using transmitted datafiles and cryptographic keys
US11829495B2 (en) Confidential data provided to a secure guest via metadata
CA3217891A1 (en) Storing diagnostic state of secure virtual machines
US9772954B2 (en) Protecting contents of storage
KR20140088962A (ko) 클라우드 환경에서의 데이터 저장 시스템 및 방법
US11201730B2 (en) Generating a protected key for selective use
US11645092B1 (en) Building and deploying an application
JP7764105B2 (ja) データ・エンジンのためのセキュアなイングレス及びエグレス
US11372983B2 (en) Employing a protected key in performing operations
US12608217B2 (en) Data-at-rest protection for virtual machines
Brescia et al. End-To-End Confidentiality with Sev-Snp Leveraging in-Memory Storage

Legal Events

Date Code Title Description
RD04 Notification of resignation of power of attorney

Free format text: JAPANESE INTERMEDIATE CODE: A7424

Effective date: 20220512

A521 Request for written amendment filed

Free format text: JAPANESE INTERMEDIATE CODE: A523

Effective date: 20220613

A621 Written request for application examination

Free format text: JAPANESE INTERMEDIATE CODE: A621

Effective date: 20220622

A977 Report on retrieval

Free format text: JAPANESE INTERMEDIATE CODE: A971007

Effective date: 20230428

A131 Notification of reasons for refusal

Free format text: JAPANESE INTERMEDIATE CODE: A131

Effective date: 20230509

A521 Request for written amendment filed

Free format text: JAPANESE INTERMEDIATE CODE: A523

Effective date: 20230803

TRDD Decision of grant or rejection written
A01 Written decision to grant a patent or to grant a registration (utility model)

Free format text: JAPANESE INTERMEDIATE CODE: A01

Effective date: 20230926

A61 First payment of annual fees (during grant procedure)

Free format text: JAPANESE INTERMEDIATE CODE: A61

Effective date: 20231012

R150 Certificate of patent or registration of utility model

Ref document number: 7368476

Country of ref document: JP

Free format text: JAPANESE INTERMEDIATE CODE: R150