Identification and Recovery of Vulnerable Containers
AssigneeInternational Business Machines Corporation
InventorsRafael Camarda Silva Folco, Breno H. Leitao, Desnes A. Nunes do Rosario
Life of this patent
Estimating the term…
Abstract
The present embodiments relate to security in a virtualized operating system environment with an active host based Intrusion Detection System (IDS). More specifically, the IDS identifies any infected container operating on the shared kernel and remedies the infected container. In an operating system virtualization, one or more containers are started in virtual memory utilizing the same operating system kernel. When a container starts any resource not specified in the container configuration is shared with the host operating system. The shared IDS provides security of the namespaces of all containers operating on the shared kernel.
Claims22
A computer system comprising:
- a processing unit in communication with a memory;
- and
- a host operating system in communication with the processing unit having a shared kernel to provide security in a virtualized operating system environment, the shared kernel comprising:
- a management unit installed in the shared kernel, the management unit to determine at least two software containers utilizing the shared kernel of the host operating system, each container having a unique namespace;
- and
- an infection detection system (IDS) installed in the shared kernel, the IDS to:
- scan a memory page in virtual memory utilized by a container process;
- detect an infection of at least one scanned page;
- identify at least one of the containers as an infected container utilizing the detected infection and identify an infection type;
- and
- remedy the identified infected container local to the kernel.
A computer program product for providing security in a virtualized operating system environment, the computer program product comprising a computer readable storage device having program code embodied therewith, the program code executable by a processor to:
- determine at least two software containers utilizing a shared kernel of a host operating system, each container having a unique namespace;
- store a process of at least one container as a memory page in virtual memory;
- and
- configure an infection detection system on the shared kernel of the host operating system, the infection detection system including program code to:
- scan the page in the virtual memory;
- detect an infection, including compare the scanned page to at least one prior version of the scanned page;
- identify at least one of the containers as an infected container utilizing the detected infection and identify an infection type;
- and
- remedy the identified infected container local to the kernel.
A method comprising:
- determining at least two software containers utilizing a shared kernel of a host operating system, each container having a unique namespace;
- storing a process of at least one container as a memory page in virtual memory;
- an infection detection system installed on the shared kernel scanning the page in the virtual memory utilized by at least one of the container, and detecting an infection,
- identifying at least one of the containers as an infected container utilizing the detected infection;
- identifying an infection type of the infected container;
- and
- remedying the identified infected container local to the shared kernel.
(canceled)
(canceled)
Dependencies are inferred from the claim text.