Patent ID: 11966466
Assignee: CHECK POINT SERVERLESS SECURITY LTD.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 10:
11. A computer executed method for providing runtime security to a task including a workload container executed by a computer processor of a node using a backend system including a computer processor, the method comprising:
modifying the task to include a sidecar as a container using the backend system;
modifying the task using the backend system to include a shared volume comprising memory accessible to the sidecar and the workload container;
modifying the task using the backend system such that the sidecar is executed before the workload container, wherein the sidecar includes:
agent binaries associated with multiple operating systems and including agent hooks, wherein each of the agent binaries is associated with one or more target operating systems of the multiple operating systems; and
a guard loader executable on all of the multiple operating systems and including an operating system identifier configured to identify an operating system of the workload container;
loading the guard loader into the shared volume using the sidecar;
copying the agent binaries into the shared volume as an agent binary library using the sidecar;
executing the guard loader using the node to identify the operating system of the workload container and to activate in the shared volume the agent binary associated with the identified operating system of the workload container from the agent binary library in the shared volume;
binding loader hooks to the activated agent binary using the activated agent binary, such that the workload container requesting a process associated with one of the loader hooks results in a call to the activated agent binary for the requested process;
executing operations of the workload container using the node, such that the activated agent binary receives the call from the workload container and the received call includes the requested process;
upon receiving the call including the requested process, using the node to execute the activated agent binary by:
comparing the requested process to a policy to determine if the requested process is approved or denied;
when the requested process is approved, passing the requested process to one of the agent hooks identified by the activated agent binary as being associated with the requested process; and
when the requested process is denied, not passing the requested process to one of the agent hooks.