Patent ID: 11966466
Assignee: CHECK POINT SERVERLESS SECURITY LTD.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A protection system for providing runtime security to a task including a workload container, the protection system comprising:
a backend system including a computer processor and a non-transitory computer readable medium storing computer executable instructions, wherein in response to executing the computer executable instructions the computer processor of the backend system is configured to:
modify the task to include a sidecar as a container;
modify the task to include a shared volume comprising memory accessible to the sidecar and the workload container;
modify the task such that the sidecar is executed before the workload container, wherein the sidecar includes:
agent binaries associated with multiple operating systems and including agent hooks, wherein each of the agent binaries is associated with one or more target operating systems of the multiple operating systems; and
a guard loader executable on all of the multiple operating systems and configured to identify an operating system of the workload container; and
a node including a computer processor and a non-transitory computer readable medium storing computer executable instructions, wherein in response to executing the computer executable instructions the computer processor of the node is configured to:
execute operations of the sidecar including:
loading the guard loader into the shared volume; and
copying the agent binaries into the shared volume as an agent binary library;
execute the guard loader loaded into the shared volume to identify the operating system of the workload container;
activate in the shared volume as an activated agent binary the agent binary associated with the identified operating system of the workload container;
bind loader hooks to the activated agent binary, such that the workload container requesting a process associated with one of the loader hooks results in a call to the activated agent binary for the requested process; and
execute operations of the workload container, such that the activated agent binary receives the call from the workload container and the received call includes the requested process;
wherein upon receiving the call including the requested process, the computer processor of the node is configured to execute the activated agent binary by:
comparing the requested process to a policy to determine if the requested process is approved or denied;
when the requested process is approved, passing the requested process to one of the agent hooks identified by the activated agent binary as being associated with the requested process; and
when the requested process is denied, not passing the requested process to one of the agent hooks identified by the activated binary as being associated with the requested process.