Runtime Patching Methods For Achieving Cyber Deception In Software Applications
AssigneeDynatrace LLC
InventorsMario KAHLHOFER, Patrick KERN
Life of this patent
Estimating the term…
Abstract
Tightly coupling cyber deception with software applications is promising in the lab but poses significant technical challenges in production systems. Because security measures are usually the responsibility of a system operator, access is typically limited to built software artifacts rather than their source code. This limitation makes it particularly challenging to deploy cyber deception techniques at application runtime and without full control over the software development lifecycle.
Claims19
A computer-implemented method for implementing cyber deception in a container orchestration system, comprising:
- installing a deception manager on a cluster of a container orchestration system;
- configuring a storage medium on the cluster of the container orchestration system;
- registering, by the deception manager, the deception manager with a control plane of the container orchestration system;
- receiving, by the deception manager, a request to deploy a given application on the cluster from the control plane of the container orchestration system;
- and
- sending, by the deception manager, a modified deployment manifest for the given application to the control plane of the container orchestration system, where the modified deployment manifest references a particular shared library in the storage medium and the particular shared library is loaded first by an operating system running the container orchestration system.
A non-transitory computer-readable medium having computer-executable instructions that, upon execution of the instructions by a processor of a computer, cause the computer to
- register a deception manager with a control plane of a container orchestration system;
- receive a request to deploy a given application on the cluster from the control plane of the container orchestration system;
- send a modified deployment manifest for the given application from the deception manager to the control plane of the container orchestration system, where the modified deployment manifest references a particular shared library in the storage medium and the particular shared library is loaded first by an operating system running the container orchestration system;
- and
- execute a hook residing in the particular shared library, where the hook implements a cyber deception method.
Dependencies are inferred from the claim text.