System and method for recovering a node in a cloud infastructure after an intrusion

1. A method for recovering a computing device after an intrusion, the method comprising:

deploying, by a minimalistic Operating System (OS) running on the computing device having a processor and a memory, a master container, wherein the deploying of the master container comprising:

creating and starting the master container from a container image,

providing, to the master container, access to a storage area network (SAN) volume,

providing, to the master container, read-only access to a Distributed Configuration Management (DCM) module domain, the domain where a configuration of the computing device is stored, and

invoking an Intrusion Detection Module (IDM) to start detecting intrusions into the master container; and

upon receiving a notification from the IDM about an intrusion into the master container, re-deploying, by the minimalistic OS, the master container from the container image, wherein the re-deployed master container acts as a default runtime environment on the computing device;

wherein the re-deploying of the master container comprises:

destroying the master container;

creating and starting a new master container from the container image; and

providing to the newly created master container a read-only access to the DCM module.

2. The method of claim 1 , wherein the computing device act as a compute node in a cluster, wherein the cluster comprises: a plurality of compute nodes, a storage area network, wherein the DCM is a cluster management module for keeping configurations of compute nodes, and the IDM is a cluster management module for detecting when a compute node is compromised.

3. The method of claim 1 , wherein the re-deploying of the master container further comprises:

providing to the newly created master container access to the SAN volume; and

invoking the IDM to start detecting intrusions into the newly created master container.

4. The method of claim 1 , wherein the container image includes at least one of: software needed for the computing device to operate, information about needed persistent volume, and information about a corresponding DCM sub-domain.

5. The method of claim 1 , wherein the minimalistic OS includes: a container management software, and any number of software modules for responsible communicating between the minimalistic OS and the SAN, the DCM and the IDM.

6. The method of claim 1 , wherein the SAN is accessed via a network storage driver of the minimalistic OS of the computing device, and the software module for communicating with the IDM comprises a module for a notification subscription to the IDM, wherein the IDM provides notifications to the minimalistic OS in accordance with a notification subscription by the minimalistic OS of the respective computing device.

7. The method of claim 1 , wherein the configuration of the computing device stored in the DCM includes at least one of: network configuration files, storage configuration files, user configuration files, and security credentials of the computing device, wherein the security credentials include at least one of: a token, a key, and a password.

8. The method of claim 1 , wherein the master container is the only container running on the computing device.

9. The method of claim 1 , wherein the IDM comprises a crontab monitor or an artificial intelligence (AI) based system, and the DCM comprises a Network File System (NFS) share or an eted system.

10. The method of claim 1 , wherein the SAN and the DCM are accessible to the computing device only via a private network.

11. The method of claim 1 , further comprising at least one of:

the master container is not allowed to perform any changes in the configuration of the computing device stored on the DCM, or

the master container has only read-only access to the DCM, or

the minimalistic OS has a read-write access to the DCM, or

changes to the configuration of the computing device are performed only from a private network, wherein the private network is inaccessible from a public network, or

the DCM is inaccessible from the public network.

12. The method of claim 1 , wherein the re-deploying of the master container further comprises taking a snapshot of the master container currently in use to allow for analysis of the intrusion.

13. The method of claim 1 , wherein the providing, to the master container, access to the SAN volume and to the DCM domain comprises:

determining a SAN volume and a DCM domain based on the configuration of the computing device; and

granting, to the started master container, access to the determined SAN volume and DCM domain.

14. The method of claim 1 , wherein a virtual machine may be used instead of the container.

15. The method of claim 1 , wherein the master container is configured to store data needed by a user of the computing device in a respective volume of the SAN, wherein the stored data includes at least one of: databases of the user, files of the user, and logs.

16. A system for recovering a computing device after an intrusion, the system comprising:

a hardware processor of the computing device executing a minimalistic Operating System (OS) configured to:

deploy a master container by: creating and starting the master container from a container image, providing, to the master container, access to a storage area network (SAN) volume, providing, to the master container, read-only access to a Distributed Configuration Management (DCM) module domain, the domain where a configuration of the computing device is stored, and invoking an Intrusion Detection Module (IDM) to start detecting intrusions into the master container; and

upon receiving a notification from the IDM about an intrusion into the master container, re-deploy the master container from the container image, wherein the re-deployed master container acts as a default runtime environment on the computing device;

wherein the re-deploying of the master container comprises:

destroying the master container:

creating and starting a new master container from the container image; and

providing to the newly created master container a read-only access to the DCM module.

17. The system of claim 16 , wherein the re-deploying the master container further comprises:

providing to the newly created master container access to the SAN volume;

invoking the IDM to start detecting intrusions into the newly created master container.

18. The system of claim 16 , wherein:

the master container is not allowed to perform any changes in the configuration of the computing device stored on the DCM,

the master container has only read-only access to the DCM,

the minimalistic OS has a read-write access to the DCM,

changes to the configuration of the computing device are performed only from a private network, wherein the private network is inaccessible from a public network, and

the DCM is inaccessible from the public network.

19. A non-transitory computer readable medium storing thereon computer executable instructions for recovering a computing device after an intrusion, including instructions for:

by a minimalistic Operating System (OS) running on the computing device having a processor and a memory, deploying a master container by:

creating and starting the master container from a container image,

providing, to the master container, access to a storage area network (SAN) volume,

providing, to the master container, read-only access to a Distributed Configuration Management (DCM) module domain, the domain where a configuration of the computing device is stored, and

invoking an Intrusion Detection Module (IDM) to start detecting intrusions into the master container; and

upon receiving a notification from the IDM about an intrusion into the master container, by the minimalistic OS, re-deploying, the master container from the container image, wherein the re-deployed master container acts as a default runtime environment on the computing device;

wherein the re-deploying of the master container comprises:

destroying the master container:

creating and starting a new master container from the container image; and

providing to the newly created master container a read-only access to the DCM module.

20. The non-transitory computer readable medium of claim 19 , the instructions for re-deploying of the master container includes instructions for:

providing to the newly created master container access to the SAN volume; and

invoking the IDM to start detecting intrusions into the newly created master container.