.png){kind=icon}
返回
Condo: Enhancing Container Isolation Through Kernel Permission Data Protection
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2024.3411915.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Container technology is widely adopted due to its features such as light weight and ease of rapid deployment. However, as an OS-level virtualization mechanism, container isolation relies on the kernel's security mechanisms and the kernel permission data (usually non-control flow data) used by these mechanisms. None of the existing mitigation schemes for non-control flow data attacks provide an effective and practical solution to container security since they either trigger too much overhead, have limited effectiveness over attacks launched in specific ways, or can only be used to protect some specific kernel data. In addition, none of them accurately identify the kernel data associated with container isolation. In this paper, we provide a solution called Condo that enhances container isolation by protecting the associated kernel permission data. We first present a generic non-control flow kernel data protection mechanism that protects different types of kernel data uniformly with low overhead and is not limited by attack methods or data types. We then demystify the models of various kernel access control mechanisms in the container environment, and identify the subject and object permission data that are critical to container isolation. Finally, we provide a solution named Condo to enhance container isolation, which is completely transparent to the existing container ecosystem, including containerized applications and container management/orchestration tools such as Docker. Experimental results show that Condo can effectively reduce the compromises of container isolation due to memory corruption attacks with an acceptable overhead.
Keyword:
Containers
Kernel
Codes
Security
Access control
Linux
Virtualization
Container
isolation
data integrity
trusted execution environment
期刊
IF:
8
论文数:
5.3K
被引数:
2.3W
机构
引用论文
Facile preparation of in situ coated Ti3C2Tx/Ni0.5Zn0.5Fe2O4composites and their electromagnetic performance原位涂层Ti3C2Tx/Ni0.5Zn0.5Fe2O4 复合材料及其电磁性能.png)
RSC Advances
OAAI
RSC AdvancesIF0
OAAI分享收藏Stochastic static fault slip inversion from geodetic data with non-negativity and bound constraints具有非负性和约束约束的大地测量数据的随机静态断层滑动反演OAAI
OAAI分享收藏
查看更多内容