Back to results
US 12,754,998 B2Granted
Managing runtime operation privileges of privileged containers in real time
AssigneeInternational Business Machines Corporation
InventorsYu Zui You, Zhan Peng Huo, Xiao Ling Chen, Heng Wang
Life of this patent
Estimating the term…
Abstract
Managing container privileges is provided. It is determined whether a result of comparing a request for an operation privilege to perform a privileged operation by a privileged container against privilege approval rules is an approval of the request. In response to determining that the result of comparing the request for the operation privilege to perform the privileged operation by the privileged container against the privilege approval rules is the approval of the request, the operation privilege is granted to the privileged container to perform the privileged operation. The privileged operation is performed using the privileged container.
Claims18
A method for dynamically managing container privileges in real time, the method comprising:
- detecting a request for an operation privilege to perform a privileged operation by a privileged container based on analyzing container activity logs corresponding to the privileged container running on a computer;
- sending the request for the operation privilege to perform the privileged operation by the privileged container and associated information that includes user, operation, system impact, and risk level to a machine learning model for analysis and learning;
- sending the request for the operation privilege to perform the privileged operation by the privileged container and the associated information that includes the user, the operation, the system impact, and the risk level to a privilege rule management module for approval;
- comparing the request for the operation privilege to perform the privileged operation by the privileged container against privilege approval rules using the privilege rule management module;
- determining whether a result of comparing the request for the operation privilege to perform the privileged operation by the privileged container against the privilege approval rules is an approval of the request;
- responsive to determining that the result of comparing the request for the operation privilege to perform the privileged operation by the privileged container against the privilege approval rules is the approval of the request, granting the operation privilege to the privileged container to perform the privileged operation;
- and
- performing the privileged operation using the privileged container.
5 more elements
A computer system for dynamically managing container privileges in real time, the computer system comprising:
- a processor set;
- one or more computer-readable storage media;
- and
- program instructions stored on the one or more computer-readable storage media to cause the processor set to perform operations comprising:
- detecting a request for an operation privilege to perform a privileged operation by a privileged container based on analyzing container activity logs corresponding to the privileged container running on the computer system;
- sending the request for the operation privilege to perform the privileged operation by the privileged container and associated information that includes user, operation, system impact, and risk level to a machine learning model for analysis and learning;
- sending the request for the operation privilege to perform the privileged operation by the privileged container and the associated information that includes the user, the operation, the system impact, and the risk level to a privilege rule management module for approval;
- comparing the request for the operation privilege to perform the privileged operation by the privileged container against privilege approval rules using the privilege rule management module;
- determining whether a result of comparing the request for the operation privilege to perform the privileged operation by the privileged container against the privilege approval rules is an approval of the request;
- responsive to determining that the result of comparing the request for the operation privilege to perform the privileged operation by the privileged container against the privilege approval rules is the approval of the request, granting the operation privilege to the privileged container to perform the privileged operation;
- and
- performing the privileged operation using the privileged container.
9 more elements
A computer program product for dynamically managing container privileges in real time, the computer program product comprising:
- one or more computer-readable storage media;
- and
- program instructions stored on the one or more computer-readable storage media to perform operations comprising:
- detecting a request for an operation privilege to perform a privileged operation by a privileged container based on analyzing container activity logs corresponding to the privileged container running on a computer;
- sending the request for the operation privilege to perform the privileged operation by the privileged container and associated information that includes user, operation, system impact, and risk level to a machine learning model for analysis and learning;
- sending the request for the operation privilege to perform the privileged operation by the privileged container and the associated information that includes the user, the operation, the system impact, and the risk level to a privilege rule management module for approval;
- comparing the request for the operation privilege to perform the privileged operation by the privileged container against privilege approval rules using the privilege rule management module;
- determining whether a result of comparing the request for the operation privilege to perform the privileged operation by the privileged container against the privilege approval rules is an approval of the request;
- responsive to determining that the result of comparing the request for the operation privilege to perform the privileged operation by the privileged container against the privilege approval rules is the approval of the request, granting the operation privilege to the privileged container to perform the privileged operation;
- and
- performing the privileged operation using the privileged container.
8 more elements
Dependencies are inferred from the claim text.