KR20220163608A - Method and system for runtime security profile update of containers - Google Patents

Abstract

Disclosed are a method and system for updating a runtime security profile of a container. The method for updating the security profile performed by a container security system according to one embodiment may comprise: a step of tracking container instance information and system call generated from a container instance; a step of generating a new security profile comprising the tracked container instance information and system call; and a step of updating a security profile referenced by the container instance to the generated security profile at a runtime of the container instance. Therefore, the present invention is capable of improving a container security.

Description

Method and system for updating runtime security profile of container {METHOD AND SYSTEM FOR RUNTIME SECURITY PROFILE UPDATE OF CONTAINERS}

The description below is about container security technologies used in cloud platforms.

Recently, there are many types of services that utilize cloud computing environments that can access and use computing resources such as CPU, memory, and storage from individuals to external and cloud providers to access and use them from anywhere. Because it is easy to pay for what you use without purchasing computing resources or expand in real time according to service load, companies using cloud computing environments are also increasing. Most cloud providers adopt and use a container platform with high portability, deployability, and efficiency to provide scalability of these clouds. Unlike virtual machines, which are highly virtualized from the host, containers share a large portion of the kernel with the host. Some independence and security are provided by using some virtualization technologies (eg, namespace, cgroup), but security is inevitably weaker than that of virtual machines. The container platform provides SECCOMP (Secure Computing Mode), and by creating a security profile for this, system calls that can access the kernel can be limited and security can be improved.

The conventional technology extracts all system calls callable from a corresponding container instance by performing static analysis on all internal codes and libraries, and creates a security profile. However, even though a library is included, not all functions within that library may be called. Some functions were needed, so a library containing the functions was added, but there are also functions that are not called. There are also parts of the internal code that are not called by the container instance during runtime. Therefore, the security profile created using the conventional technique includes more system calls than system calls required for a container instance. System calls that are not actually used by the container instance, but are added to the security profile and allowed to be called, can increase the capabilities of malicious code, which increases the possibility of attack. In addition, problems may occur in container execution because system calls occurring in dynamically executed codes are not processed at runtime.

Another conventional technique creates a security profile by dynamically analyzing and recording system calls generated through execution of a container instance. In the case of the above technique, it is necessary to generate input value combinations for paths and cases in which container instances are executed, but it is practically impossible to create perfect input value combinations. The security profile generated through such an incomplete experiment may lack the system calls required to run the container instance. Therefore, problems may occur in the execution of container instances, and there is a limitation that continuous operation cannot be performed.

SECCOMP (Secure Computing Mode) cannot be changed or removed after the security profile is applied once. Because of these limitations, it is impossible to flexibly adjust the security profile according to the runtime situation of the container instance.

In order to reduce the capabilities of malicious code, it is necessary to create a minimized security profile suitable for container instances by recording only system calls that are actually necessary at runtime. In addition, availability must be guaranteed so that problems do not occur in the execution of container instances due to system calls generated from dynamically executed code.

It is possible to provide a method and system for guaranteeing the availability of container instance execution by providing a minimized security profile suitable for a container instance, but correcting and updating the security profile at runtime of the container instance based on the situation of the container instance.

A method for updating a security profile performed by a container security system includes tracking container instance information and system calls generated in a container instance; generating a new security profile including the tracked container instance information and a system call; and updating a security profile referred to by the container instance to the created security profile at runtime of the container instance.

The tracking may include recording container information related to the creation of the container instance and system call information related to the system call in an internal storage space.

The tracking may include recording execution information of a container called through a container instance creation event occurring in a container platform in an internal storage space.

The tracking may include recording system call information related to a system call called by using a system call handler inside a kernel generated in a container platform in an internal storage space and a shared buffer.

The tracking may include classifying system call information related to system calls recorded in the shared buffer according to containers of the internal storage space, and storing the system call information related to the classified system calls. .

The tracking may include recording matching information generated by matching system call information recorded in the shared buffer with execution information of a called container in an internal storage space.

The creating step compares and analyzes the security profile applied to the container instance and the system calls recorded in the internal storage space to obtain a result of deriving system calls to be added and deleted, and to the container instance based on the obtained result. It may include generating a new security profile of a secure computing mode (SECCOMP) configured in a form that can be applied.

A computer program stored in a computer readable recording medium to execute a method for updating a security profile performed by a container security system includes: tracing container instance information and system calls generated in container instances; generating a new security profile including the tracked container instance information and a system call; and updating a security profile referred to by the container instance to the created security profile at runtime of the container instance.

The container security system includes at least one processor configured to execute computer readable instructions included in memory, and the at least one processor tracks container instance information and system calls generated in container instances, and the traced A new security profile including container instance information and a system call may be created, and a security profile referred to by the container instance may be updated to the created security profile at runtime of the container instance.

The at least one processor may record container information related to the creation of the container instance and system call information related to the system call in an internal storage space.

The at least one processor may record execution information of a container called through a container instance creation event occurring in a container platform in an internal storage space.

The at least one processor may record system call information related to a system call called by using a system call handler inside a kernel generated in a container platform in an internal storage space and a shared buffer.

The at least one processor may classify system call information related to system calls recorded in the shared buffer according to containers of the internal storage space, and store the system call information related to the classified system calls.

The at least one processor may record matching information generated by matching system call information recorded in the shared buffer with execution information of a called container in an internal storage space.

The at least one processor obtains a result of deriving system calls to be added and deleted by comparing and analyzing a security profile applied to the container instance and a system call recorded in an internal storage space, and based on the obtained result, the container instance A new security profile of secure computing mode (SECCOMP) configured in a form that can be applied to an instance can be created.

By resolving the limitation of the secure computing mode (SECCOMP), which cannot update the execution time, it is possible to provide a minimized security profile suitable for container instances and at the same time ensure availability so that problems do not occur in the operation of container instances.

It can be applied without changing the existing container platform and kernel, and it can improve container security by applying an optimized security profile without interfering with operation.

1 is a diagram for explaining the configuration and operation of a container security system according to an embodiment.
2 is a diagram for explaining the operation of a trace agent of a container security system according to an embodiment.
3 is a diagram for explaining the operation of a profile tailor of a container security system according to an embodiment.
4 is a diagram for explaining an operation of a container manager of a container security system according to an embodiment.
5 is a flowchart illustrating a method for updating a security profile in a container security system according to an embodiment.

Hereinafter, an embodiment will be described in detail with reference to the accompanying drawings.

In the embodiment, the limitations of not being able to create a minimized security profile suitable for each container instance and updating the security profile at runtime are overcome, and the security profile is maintained so as not to interfere with the operation of the container instance while maintaining the minimized security profile. An operation of correcting and updating at runtime will be described.

In detail, in order to create a security profile in a container instance, information on the container instance and called system calls must be traced. Called system call information is obtained by using the system call handler hook existing inside the kernel that handles system calls, container information generated from the container platform is imported and recorded, and based on the recorded information, information necessary for operation is obtained. A new security profile can be created including system calls. If the container instance refers to it, after replacing the security profile with a new security profile, the container organization platform's container update function can be used to create a container instance with the new security profile applied and replace the existing instance to maintain the operational flow. Therefore, it can be used without changing the existing container platform or kernel.

1 is a diagram for explaining the configuration and operation of a container security system according to an embodiment.

The container security system 100 includes a trace agent (Trace Agent 110) that tracks system calls generated by container instances and container creation, and a Profile Tailor (120) that corrects SECCOMP (Secure Computing Mode) security profiles. and a container manager 130 that updates the corrected security profile at runtime. The trace agent 110 includes a container trace agent 111 and a system call trace A system call trace agent (112) may be included.

The container security system 100 may perform a tracking process of tracing and recording container creation and system calls, and a dynamic profile creation and update process of creating and updating a security profile.

During the tracking process, the container security system 100 may record information about container instance creation events occurring in the container platform and record system calls called using system call handler hooks inside the kernel.

In the process of creating and updating, the container security system 100 may create a new profile based on the recorded information and update it by applying it to a new container instance.

The trace agent 110 may include a container trace agent 111 that records the creation of a container instance and a system call trace agent 112 that records the system.

As the container trace agent 111 receives a container instance creation event generated from the container platform 150, the container execution information related to which container is running is stored in an internal storage space (eg, For example, it can be recorded in a trace map (141) (2). At this time, the system call may be generated in the container instance and processed by each system call processor inside the kernel 140 . A hook at the entrance of each system call handler inserted for debugging is used to check which system call was called before the system call is processed through system call tracking (3), and system call and system call are stored in a shared buffer between user spaces. Related system call information may be recorded (4).

The system call trace agent 112 may classify the system call information according to the container of the internal storage space (trace map 141) using the system call information recorded in the shared buffer, and classify the system call information into the internal storage space ( may be stored in the trace map 141 (5). For example, the system call trace agent 112 may classify system call information based on container conditions or criteria set for the container.

The profile tailor 120 compares and analyzes the existing security profile applied to the container instance with system calls recorded in the internal storage space to derive system calls to be added or deleted. At this time, the system calls recorded in the internal storage space can be imported and compared and analyzed with the existing security profile.

The profile tailor 120 may refer to information recorded in the internal storage space in order to create a new security profile using the requested container system call information (6). The profile tailor 120 may generate a new secure computing mode (SECCOMP) security profile by encoding the security profile in a form that can be applied to the container instance based on the result of the comparative analysis (7).

The container manager 130 may replace an existing security profile existing in the activation profile path with a new security profile created by the profile tailor 120 . In other words, the container manager 130 may update the existing security profile to a new security profile created by the profile tailor 120 (8).

The container manager 130 may create a new container instance to which a new security profile is applied by performing an update function of the container organization platform. After that, requests generated by the existing container instance are handled by the new container instance, and the existing container instance is terminated.

2 is a diagram for explaining the operation of a trace agent of a container security system according to an embodiment.

Referring to FIG. 2, a process of recording container information and system call information in the internal storage space in the trace agent will be described. In this case, the internal storage space is shown as a trace map in FIG. 2 and may be a database for storing data.

The container trace agent 111 may receive container creation information generated in the container platform. In other words, container creation events can be invoked on the container platform. The container trace agent 111 may receive a container creation event called from the container platform. The container trace agent 111 may register container information using container generation information received from the container platform.

The system call trace agent 112 may extract system call information recorded by the system call monitor from a shared buffer. The system call trace agent 112 may receive system call information extracted from a shared buffer, match the received system call information with called container information, and record matching information in an internal storage space (trace map). .

3 is a diagram for explaining the operation of a profile tailor of a container security system according to an embodiment.

The profile tailor can compare and analyze the security profile applied to the container instance and the system calls recorded in the internal storage space to obtain a result of deriving system calls to be added or deleted. At this time, the security profile applied to the container instance and system calls recorded in the internal storage space can be analyzed by the Syscall List Generator. In addition, a security profile may be created by referring to an administrator blocked system call list and a container system call list. The profile tailor may create a new security profile of a computing mode (SECCOMP) that can be applied to a container instance based on the obtained result.

The profile tailor can create a new security profile based on the container recorded in the internal storage space, the existing security profile, and the called system call information.

4 is a diagram for explaining an operation of a container manager of a container security system according to an embodiment.

Referring to FIG. 4 , a driving process of updating a container by applying a newly created security profile is shown. A Profile Enforcer can replace an existing security profile by placing a new security profile in the Active Profile Repository. A container controller can run a container that refers to a new security profile by updating the container at runtime. At this time, requests that have previously occurred in the container are converted to the updated container and processed, so that the service can be continuously operated without interruption.

5 is a flowchart illustrating a method for updating a security profile in a container security system according to an embodiment.

In step 510, the container security system may track container instance information and system calls generated in the container instance. The container security system may record container information related to the creation of container instances and system call information related to system calls in an internal storage space. The container security system can record the execution information of the container called through the container instance creation event occurring in the container platform in the internal storage space. The container security system can record system call information related to a system call called using a system call handler inside the kernel generated in the container platform in an internal storage space and a shared buffer. The container security system may classify system call information related to system calls recorded in a shared buffer according to containers of an internal storage space, and store system call information related to the classified system calls. The container security system may record matching information generated by matching system call information recorded in the shared buffer with execution information of the called container in an internal storage space.

In step 520, the container security system may create a new security profile including tracked container instance information and system calls. The container security system compares and analyzes the system calls recorded in the internal storage with the security profile applied to the container instance, obtains the result of deriving system calls to be added and deleted, and based on the obtained result, it can be applied to the container instance. A new security profile of secure computing mode (SECCOMP) configured in the form can be created.

In step 530, the container security system may update the security profile referenced by the container instance to the generated security profile at runtime of the container instance. Alternatively, the container security system may update the security profile referenced by the container instance to the created security profile during container running time.

The devices described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. A processing device may run an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art will understand that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it can include. For example, a processing device may include a plurality of processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. The device can be commanded. Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. can be embodied in Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler.

As described above, although the embodiments have been described with limited examples and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

Claims (15)

A method for updating a security profile performed by a container security system,
Tracing container instance information and system calls generated in container instances;
generating a new security profile including the tracked container instance information and a system call; and
Updating a security profile referred to by the container instance to the generated security profile at runtime of the container instance.
A method for updating a security profile comprising a. According to claim 1,
The tracking step is
Recording container information related to the creation of the container instance and system call information related to the system call in an internal storage space
A method for updating a security profile comprising a. According to claim 2,
The tracking step is
Recording the execution information of the container called through the container instance creation event occurring in the container platform to the internal storage space
A method for updating a security profile comprising a. According to claim 3,
The tracking step is
Recording system call information related to a system call called using a system call handler inside the kernel generated in the container platform in an internal storage space and a shared buffer
A method for updating a security profile comprising a. According to claim 4,
The tracking step is
classifying system call information related to system calls recorded in the shared buffer according to containers of the internal storage space, and storing system call information related to the classified system calls;
A method for updating a security profile comprising a. According to claim 4,
The tracking step is
Recording matching information generated by matching system call information recorded in the shared buffer with execution information of the called container in an internal storage space
A method for updating a security profile comprising a. According to claim 2,
The generating step is
The security profile applied to the container instance and the system calls recorded in the internal storage are compared and analyzed to obtain a result of deriving system calls to be added and deleted, and based on the obtained result, in a form that can be applied to the container instance. Steps to create a new security profile for the configured secure computing mode (SECCOMP)
A method for updating a security profile comprising a. A computer program stored in a computer readable recording medium for executing a method for updating a security profile performed by a container security system,
Tracing container instance information and system calls generated in container instances;
generating a new security profile including the tracked container instance information and a system call; and
Updating a security profile referenced by the container instance with the generated security profile at runtime of the container instance.
A computer program stored on a computer readable recording medium to execute a method for updating a security profile comprising a. In the container security system,
at least one processor configured to execute computer readable instructions contained in memory;
including,
The at least one processor,
Traces container instance information and system calls generated by container instances,
Create a new security profile including the tracked container instance information and system call;
Updating the security profile referenced by the container instance with the generated security profile at runtime of the container instance.
A container security system, characterized in that. According to claim 9,
The at least one processor,
Recording container information related to the creation of the container instance and system call information related to the system call in an internal storage space
A container security system, characterized in that. According to claim 10,
The at least one processor,
Records the execution information of the container called through the container instance creation event that occurs in the container platform to the internal storage space.
A container security system, characterized in that. According to claim 11,
The at least one processor,
System call information related to system calls called using the system call handler inside the kernel generated in the container platform is recorded in the internal storage space and shared buffer.
A container security system, characterized in that. According to claim 12,
The at least one processor,
classifying system call information related to the system calls recorded in the shared buffer according to the container of the internal storage space, and storing the system call information related to the classified system calls;
A container security system, characterized in that. According to claim 12,
The at least one processor,
Recording the matching information generated by matching the system call information recorded in the shared buffer with the execution information of the called container in an internal storage space
A container security system, characterized in that. According to claim 9,
The at least one processor,
The security profile applied to the container instance and the system calls recorded in the internal storage are compared and analyzed to obtain a result of deriving system calls to be added and deleted, and based on the obtained result, in a form that can be applied to the container instance. Create a new security profile for the configured secure computing mode (SECCOMP).
A container security system, characterized in that.

Images