System for securing software containers with encryption and embedded agent

1. A computer-implemented method of providing security for a software container, comprising:

a first computing device receiving a request to instantiate a software container image as a software container, the software container image having a container ID, the software container image including a software application layer that is encrypted and includes a software application, and a separate security agent layer that includes a security agent;

based on the request, the first computing device utilizing the security agent to decrypt the software application layer, create a second cryptographic fingerprint based on the decrypted software application layer, and transmit the second cryptographic fingerprint and the container ID to a security server which is separate from the first computing device;

the security server receiving a first cryptographic fingerprint during a first time period occurring prior to the request, and receiving the second cryptographic fingerprint during a second time period that is subsequent to the first time period;

the security server comparing the second cryptographic fingerprint to the first cryptographic fingerprint;

based on the comparing indicating that the first and second cryptographic fingerprints match, the security server determining a security policy for the software application based on the container ID and an application type of the software application, and transmitting an indication of the security policy to the first computing device;

based on the indication, the first computing device utilizing the security agent and the security policy to control runtime operation of the software application.

2. The computer-implemented method of claim 1 , comprising:

based on the first and second cryptographic fingerprints not matching, the security server transmitting a notification that the first and second cryptographic fingerprints do not match to the first computing device; and

the first computing device utilizing the security agent to prevent launch of the software application in response thereto.

3. The computer-implemented method of claim 2 , wherein the first computing device utilizing the security agent to control runtime operation of the software application comprises the first computing device:

implementing operating system hooks that are configured to intercept requests from the software application, wherein the operating system hooks are implemented prior to the first computing device launching the software application; and

controlling, from within the software container, whether intercepted requests of the software application are granted based on the security policy.

4. The computer-implemented method of claim 3 , wherein the operating system hooks are configured to detect one or more of:

file system access requested by the software application;

processes requested by the software application; and

network access requested by the software application.

5. The computer-implemented method of claim 3 , wherein the indication of the security policy includes the security policy, the method comprising:

the first computing device transmitting a security notification from the security agent to the security server based on the software application attempting an action that violates the security policy; and

the security server maintaining a log of security notifications received for the software application.

6. The computer-implemented method of claim 1 , comprising:

the security server selecting a default security policy of the application type for the software application based on a specific security policy for the software application not being accessible by the security server.

7. A system comprising:

a security server; and

a first computing device comprising a first processor and configured to:

receive a request to instantiate a software container image as a software container, the software container image having a container ID, the software container image including a software application layer that is encrypted and includes a software application, and a separate security agent layer that includes a security agent; and

based on the request, utilizing the security agent to decrypt the software application layer, create a second cryptographic fingerprint based on the decrypted software application layer, and transmit the second cryptographic fingerprint and the container ID to a security server which is separate from the first computing device;

wherein the security server is configured to:

receive a first cryptographic fingerprint during a first time period occurring prior to the request, and receive the second cryptographic fingerprint during a second time period that is subsequent to the first time period;

compare the second cryptographic fingerprint to the first cryptographic fingerprint; and

based on the comparison indicating that the first and second cryptographic signatures match, determine a security policy for the software application based on the container ID and an application type of the software application, and transmit an indication of the security policy to the first computing device;

the first computing device configured to, based on the indication, utilize the security agent and the security policy to control runtime operation of the software application.

8. The system of claim 7 , wherein:

the security server is configured to, based on the first and second cryptographic signatures not matching, transmit an notification that the first and second cryptographic signatures do not match to the first computing device; and

the first computing device is configured to utilize the security agent to

prevent launch of the software application in response thereto.

9. The system of claim 8 , wherein to control runtime operation of the software application, the first computing device is configured to operate the security agent to:

implement operating system hooks that intercept requests from the software application, wherein the operating system hooks are implemented prior to launch of the software application; and

control, from within the software container, whether intercepted requests of the software application are granted based on the security policy.

10. The system of claim 9 , wherein the operating system hooks are configured to detect one or more of:

file system access requested by the software application;

processes requested by the software application; and

network access requested by the software application.

11. The system device of claim 8 , wherein the security server is configured to:

select a default security policy of the application type for the software application based on a specific security policy for the software application not being accessible by the security server.