Granted Patent B1

US 9,729,579 · App. 14/697,016 · Granted Aug 8, 2017

Abstract

Claims (69)

1. A computer-implemented method for increasing security on computing systems that launch application containers, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

authenticating, via a policy-enforcement proxy computing system, an application container programmed to facilitate launching at least one application on a host computing system by verifying that the application container meets a certain trustworthiness threshold;

intercepting, via the policy-enforcement proxy computing system, a command to perform a deployment action on the host computing system in connection with the authenticated application container;

determining, via the policy-enforcement proxy computing system, that the deployment action in connection with the authenticated application container potentially violates a security policy for the host computing system that defines a whitelist of application containers allowed to deploy on the host computing system; and

in response to determining that the deployment action potentially violates the security policy, preventing the potential violation of the security policy by modifying, via the policy-enforcement proxy computing system, the command to perform the deployment action.

2. The method of claim 1 , wherein verifying that the application container meets the certain trustworthiness threshold comprises at least one of:

confirming an identity of the application container; and

confirming an integrity level of the application container by:

identifying a version of the application container; and

ensuring that the version of the application container has been digitally signed through a code signing process.

3. The method of claim 1 , wherein intercepting the command to perform the deployment action comprises receiving, at the policy-enforcement proxy computing system, the command from an application deployer authorized to modify deployment of the application.

4. The method of claim 3 , wherein the application deployer authorized to modify deployment of the application comprises at least one of:

a user of the application launched by the application container;

an administrator of the host computing system; and

application management software.

5. The method of claim 1 , wherein the security policy comprises a set of rules that define at least one of:

permissions for resources used by whitelisted application containers on the host computing system; and

configurations of whitelisted application containers allowed to deploy concurrently on the host computing system.

6. The method of claim 5 , wherein determining that the deployment action potentially violates the security policy comprises at least one of:

determining, based at least in part on the whitelist of application containers, that a privilege level of the authenticated application container prohibits access to a resource on the host computing system; and

determining that a configuration of the authenticated application container with existing application containers deployed on the host computing system is prohibited in the security policy.

7. The method of claim 6 , wherein the resource on the host computing system comprises at least one of:

data residing on a file system of the host computing system;

software running on the host computing system;

hardware incorporated into the host computing system; and

a network connection of the host computing system.

8. The method of claim 1 , wherein modifying the command to prevent the potential violation of the security policy comprises:

identifying a different deployment action that does not violate the security policy.

9. The method of claim 8 , wherein the different deployment action comprises at least one of:

transferring the application container to a different host computing system that does not violate the security policy;

modifying access to the host computing system based at least in part on the security policy; and

canceling the command to perform the deployment action.

10. The method of claim 1 , further comprising forwarding the modified command from the policy-enforcing proxy computing system to an application-container management process on the host computing system in accordance with the security policy.

11. The method of claim 10 , wherein the policy-enforcing proxy computing system comprises a software implementation designed to mimic the application programming interface of the application-container management process on the host computing system.

12. A system for increasing security on computing systems that launch application containers, the system comprising:

an authentication module, stored in memory of a policy-enforcement proxy computing system, that authenticates an application container that facilitates launching at least one application on a host computing system by verifying that the application container meets a certain trustworthiness threshold;

an interception module, stored in memory of the policy-enforcement proxy computing system, that intercepts a command to perform a deployment action on the host computing system in connection with the authenticated application container;

a determination module, stored in memory of the policy-enforcement proxy computing system, that determines that the deployment action in connection with the authenticated application container potentially violates a security policy applied for the host computing system that defines a whitelist of application containers allowed to deploy on the host computing system;

a modification module, stored in memory of the policy-enforcement proxy computing system, that prevents the potential violation of the security policy by modifying the command to perform the deployment action in response to determining that the deployment action potentially violates the security policy; and

at least one processor that executes the authentication module, the interception module, the determination module, and the modification module.

13. The system of claim 12 , wherein verifying that the application container meets the certain trustworthiness threshold comprises at least one of:

confirming an identity of the application container; and

confirming an integrity level of the application container by:

identifying a version of the application container; and

ensuring that the version of the application container has been digitally signed through a code signing process.

14. The system of claim 12 , wherein the interception module intercepts the command to perform the deployment action by receiving, at the policy-enforcement proxy computing system, the command from an application deployer authorized to modify deployment of the application.

15. The system of claim 14 , wherein the application deployer authorized to modify deployment of the application comprises at least one of:

a user of the application launched by the application container;

an administrator of the host computing system; and

application management software.

16. The system of claim 12 , wherein the security policy comprises a set of rules that define at least one of:

permissions for resources used by whitelisted application containers on the host computing system; and

configurations of whitelisted application containers allowed to deploy concurrently on the host computing system.

17. The system of claim 16 , wherein the determination module determines that the deployment action potentially violates the security policy by at least one of:

determining, based at least in part on the whitelist of application containers, that a privilege level of the authenticated application container prohibits access to a resource on the host computing system; and

determining that a configuration of the authenticated application container with existing application containers deployed on the host computing system is prohibited in the security policy.

18. The system of claim 17 , wherein the resource on the host computing system comprises at least one of:

data residing on a file system of the host computing system;

software running on the host computing system;

hardware incorporated into the host computing system; and

a network connection of the host computing system.

19. The system of claim 12 , wherein the modification module modifies the command to prevent the potential violation of the security policy by:

identifying a different deployment action that does not violate the security policy; and

adding the different deployment action to the command.

20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

authenticate, via a policy-enforcement proxy computing system, an application container that facilitates launching at least one application on a host computing system by verifying that the application container meets a certain trustworthiness threshold;

intercept, via the policy-enforcement proxy computing system, a command to perform a deployment action on the host computing system in connection with the authenticated application container;

determine, via the policy-enforcement proxy computing system, that the deployment action in connection with the authenticated application container potentially violates a security policy for the host computing system that defines a whitelist of application containers allowed to deploy on the host computing system; and

in response to determining that the deployment action potentially violates the security policy, prevent the potential violation of the security policy by modifying, via the policy-enforcement proxy computing system, the command to perform the deployment action.

Assignments (6)