A Study on the Security Implications of Information Leakages in Container Clouds

Abstract

Container technology provides a lightweight operating system level virtual hosting environment. Its emergence profoundly changes the development and deployment paradigms of multi-tier distributed applications. However, due to the incomplete implementation of system resource isolation mechanisms in the Linux kernel, some security concerns still exist for multiple containers sharing an operating system kernel on a multi-tenancy container-based cloud service. In this paper, we first present the information leakage channels we discovered that are accessible within containers. Such channels expose a spectrum of system-wide host information to containers without proper resource partitioning. By exploiting such leaked host information, it becomes much easier for malicious adversaries (acting as tenants in a container cloud) to launch attacks that might impact the reliability of cloud services. We demonstrate that the information leakage channels could be exploited to infer private data, detect and verify co-residence, build covert channels, and launch more advanced cloud-based attacks. We discuss the root causes of the containers' information leakage and propose a two-stage defense approach. As demonstrated in the evaluation, our defense is effective and incurs trivial performance overhead.

Container Security: Issues, Challenges, and the Road Ahead

“…Gao et al [39] studied information leakage channels within containers (this study was expanded later in [40]). They address channels that could leak host information and allow adversaries to launch advanced attacks against the cloud service provider.…”

A Review on Challenges in Cloud Computing Security and Recent Researchs

“…Çalışmada [43], bulut güvenliğini ve kaynakların otomatik ölçeklenebilirliğin i sağlamak için izolasyon ağaçlarının kullanıldığı optimize edilmiş bir anomali tespiti yaklaşımından ve entropi tabanlı uyarlanabilir Krill sürü optimizasyonundan faydalanmıştır. Çok müşteriye hizmet veren bulut konteyner hizmetlerindeki Linux çekirdeği kaynaklı yaşanabilecek veri sızıntısı ele alındığı çalışmada [44], yaşanabilecek veri sızıntıları ve daha geniş kapsamlı s aldırıların önlenmesi maksadıyla iki kademeli bir savunma mekanizmas ı sunulmuştur. Bulut güvenliğinin sağlanması kapsamında donanım tabanlı güvenlik çözümlerinin ele alındığ ı çalışmada [45] Intel TXT, ARM TrustZone, AMD SEV ve Intel SGX teknolojileri incelenerek güvenlik ve fonksiyonellik gibi ana başlıklar altında karşılaştırılmışlard ır.…”

Security and privacy for 6G: A survey on prospective technologies and challenges

“…In container-based systems, for security protection, an extensive security service such as Docker Trusted Registry will scan container images in advance to detect potential injections and then enforce access policies accordingly. However, according to [203], [204], the imperfection of resource isolation mechanism and shared kernel in multi-tenancy container-based systems can be the potential source of meltdown and spectre attacks that may lead to information leakage of co-resident containers. The authors of [203] introduced ContainerGuard, a non-intrusive variational autoencoders-based method to collect performance events data of processes to detect the attacks.…”