Description
OS-level virtualization systems generally provide weaker isolation mechanisms compared
to hardware virtualization systems. In particular, the shared kernel contains
assets like longterm secrets, for example encryption keys, which are used by the containers
on top of the system. Attackers, who are capable of bypassing the isolation
and protection mechanisms provided by the container virtualization system therefore
are able to extract these secrets.
This work provides two design approaches for OS-level virtualization systems which
allow to protect these kernel assets using the strong protection guarantees provided
by the hardware assisted TEE implementation Intel SGX.
A PoC implementation of one of the proposed solution designs to protect the container
encryption keys in trust|me is provided. This implementation is tested and
evaluated regarding performance. Furthermore, the implementation is discussed regarding
its security capabilities exemplary for the generic designs.
|
Thesis topic in co-operation with the Fraunhofer Institute for Applied and Integrated Security AISEC, Garching