DockerPolicyModules: Mandatory Access Control for Docker containers

Bacis, Enrico; Mutti, Simone; Capelli, Steven; Paraboschi, Stefano

doi:10.1109/cns.2015.7346917

Cited by 32 publications

(19 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Trustable containers can also utilise inter-container protection mechanisms to improve security, e.g. the approach proposed in [27] protects containers from other malicious containers on the same host. Co-hosting a malicious Virtual Machine (VM) on the same physical host as the intended target VM has been a traditional approach adopted in cloud systems in the past.…”

Section: Definitionmentioning

confidence: 99%

Tracking GDPR Compliance in Cloud-Based Service Delivery

Barati

Rana

2022

IEEE Trans. Serv. Comput.

View full text Add to dashboard Cite

The European General Data Protection Regulation (GDPR) has had a far-reaching impact on data privacy and compliance for cloud providers. GDPR influences access to, storage, processing and transmission of personal data, requiring these operations to be verified by a cloud user through explicit consent prior to execution. GDPR rules implemented for such operations can be ambiguous and often open to interpretation, making manual verification a time consuming and error prone process for cloud providers. An encoding of GDPR rules is described, with each operation carried out using these rules recorded into a Blockchain for auditing purposes. Specifically, this work shows how some GDPR rules can appear as opcodes in smart contracts to verify the operations of providers on user data in a transparent and automatic way. An abstract model is designed to demonstrate how cloud providers can access and deploy such smart contracts through a Blockchain-based virtual machine. A case study is used to demonstrate how this approach can be used in practice. The case study uses a collection of design patterns and smart contracts to verify provider operations, including read, write, execution and transfer on user data. Validation is undertaken by deploying the smart contracts in a Blockchain test network to investigate the execution costs of GDPR compliance checking.

show abstract

Section: Definitionmentioning

confidence: 99%

Tracking GDPR Compliance in Cloud-Based Service Delivery

Barati

Rana

2022

IEEE Trans. Serv. Comput.

View full text Add to dashboard Cite

show abstract

“…To keep the security, we have three major solutions: isolation, host hardening, network security, and jail [20]- [22]. In these solutions, isolation is a common solution to enhance the container security [21], [23], [24]. Managers can apply the identifiers to realize the isolation, e.g.…”

Section: B Dockermentioning

confidence: 99%

“…Managers can apply the identifiers to realize the isolation, e.g. containers' namespaces, groups and mandatory access control [24]. Moreover, Bacis et al [24] propose a docker file configuration to Security-Enhanced Linux policy, so that the container security can be improved.…”

Section: B Dockermentioning

confidence: 99%

An Implementation of Scalable High Throughput Data Platform for Logging Semiconductor Testing Results

2019

View full text Add to dashboard Cite

Unlike graded data of common semiconductor test results storing in relational databases, log data in the standard test data format (STDF) contain millions of test data entries. In a semiconductor packaging and testing factory, a semiconductor wafer or integrated circuit tests generate thousands of STDF files each day; therefore, how to store these massive databases is a crucial topic. Different products correspond to different test items and STDF content; if a relational database is used to store all forms of data, the practical operation becomes challenging. This paper used a NoSQL document-oriented database collocated with a Docker container to build a system, named the scalable STDF data (SSD) framework, for storing semiconductor test data. According to semiconductor test operations, the SSD framework first converts STDF files into an open standard format for data transmission and subsequently transfers them to the database. The use of NoSQL databases allows for flexibility of specifications of STDF content, and a Docker container exhibits features such as rapid deployment and high scalability. The SSD framework meets the requirements of semiconductor testing for throughput, latency, and parallel experimental projects; possesses excellent execution efficiency; and provides flexible data storage services in a semiconductor testing environment where processing a large quantity of data is required. From our simulation results, the major performance of the proposed system depends on the hardware properties. The higher hardware distribution degree provides better performance. Docker container provides more connections and the scalability of storage, but higher software distribution contributes limited performance enhancement. INDEX TERMS Flexible data storage, scalable STDF data, semiconductor testing, standard test data format.

show abstract

“…Estes trabalhos apresentam métodos que auxiliam na avaliação de risco de aspectos de segurança [21,19] e desafios quantoà privacidade, governança e conformidade [20]. Entretanto, contemplam superficialmente mecanismos para reforçar a política de controle do gerenciamento de contêineres, imagens e acesso aos recursos do núcleo [22,23,3,24]. Assim, os principais guias e trabalhos específicos, relacionados a segurança para contêineres e que servem de base para este trabalho são: (i) [25], contemplando recomendações, mecanismos de segurança, ataques, ameaças e métodos para garantir a segurança do uso de contêineres no ambiente de produção; (ii) [24], apresentando informações conceituais e estratégias para garantir a segurança na execução de contêineres; e (iii) [26], discutindo boas práticas, vulnerabilidades, riscos relacionados e proposta de soluções.…”

Section: Seguranç a No Uso De Contêineresunclassified

A Taxonomy of container security on computational clouds: concerns and solutions

Panizzon

Battisti

Koslovski

et al. 2019

RITA

View full text Add to dashboard Cite

VirtualizationincloudcomputinghasbeenusedincombinationwithenvironmentsPlatformas a Service (PaaS) and Infrastructure as a Service (IaaS) in order to provide performance, isolation, and scalability. However, containers and virtual machines (VMs) are susceptible to the vulnerabilities present in the core of operating system as well as container solutions, which are a risk for information and service operation of all entities sharing a same host. The safety recommendation guides aims to mitigate the security in this scenario, but the selection of containerization solutions taking into account security requirements is a complex task. Thus, we propose a security taxonomy focused on containers to cloud computing in order to assist the classification and evaluation containers security mechanisms and solutions.

show abstract

DockerPolicyModules: Mandatory Access Control for Docker containers

Cited by 32 publications

References 2 publications

Tracking GDPR Compliance in Cloud-Based Service Delivery

Tracking GDPR Compliance in Cloud-Based Service Delivery

An Implementation of Scalable High Throughput Data Platform for Logging Semiconductor Testing Results

A Taxonomy of container security on computational clouds: concerns and solutions

Contact Info

Product

Resources

About