SCONE: Secure linux containers with Intel SGX
Arnautov S, Trach B, Gregor F, Knauth T, Martin A, Priebe C, Lind J, Muthukumaran D, O'Keeffe D, Stillwell ML, Goltzsche D, Eyers D, Pietzuch P, Fetzer C, Kapitza R (2016)
Publication Type: Conference contribution
Publication year: 2016
Publisher: USENIX Association
Pages Range: 689-703
Conference Proceedings Title: Proceedings of the 12th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2016
Event location: Savannah, GA, USA
ISBN: 9781931971331
Abstract
In multi-tenant environments, Linux containers managed by Docker or Kubernetes have a lower resource footprint, faster startup times, and higher I/O performance compared to virtual machines (VMs) on hypervisors. Yet their weaker isolation guarantees, enforced through software kernel mechanisms, make it easier for attackers to compromise the confidentiality and integrity of application data within containers. We describe SCONE, a secure container mechanism for Docker that uses the SGX trusted execution support of Intel CPUs to protect container processes from outside attacks. The design of SCONE leads to (i) a small trusted computing base (TCB) and (ii) a low performance overhead: SCONE offers a secure C standard library interface that transparently encrypts/decrypts I/O data; to reduce the performance impact of thread synchronization and system calls within SGX enclaves, SCONE supports user-level threading and asynchronous system calls. Our evaluation shows that it protects unmodified applications with SGX, achieving 0.6×-1.2× of native throughput.
Authors with CRIS profile
Involved external institutions
Imperial College London / The Imperial College of Science, Technology and Medicine
United Kingdom (GB)
Technische Universität Braunschweig
Germany (DE)
Technische Universität Dresden
Germany (DE)
University of Otago
New Zealand (NZ)
United Kingdom (GB)
Technische Universität Braunschweig
Germany (DE)
Technische Universität Dresden
Germany (DE)
University of Otago
New Zealand (NZ)
How to cite
APA:
Arnautov, S., Trach, B., Gregor, F., Knauth, T., Martin, A., Priebe, C.,... Kapitza, R. (2016). SCONE: Secure linux containers with Intel SGX. In Proceedings of the 12th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2016 (pp. 689-703). Savannah, GA, USA: USENIX Association.
MLA:
Arnautov, Sergei, et al. "SCONE: Secure linux containers with Intel SGX." Proceedings of the 12th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2016, Savannah, GA, USA USENIX Association, 2016. 689-703.
BibTeX: Download