IRUS Total

SCONE: secure Linux containers with Intel SGX

File Description SizeFormat 
osdi16-arnautov.pdfAccepted version653.91 kBAdobe PDFView/Open
Title: SCONE: secure Linux containers with Intel SGX
Authors: Pietzuch, PR
Arnautov, S
Trach, B
Gregor, F
Knauth, T
Martin, A
Priebe, C
Lind, J
Muthukumaran, D
O'Keeffe, D
Stillwell, M
Goltzsche, D
Eyers, D
Rüdiger, K
Fetzer, C
Item Type: Conference Paper
Abstract: In multi-tenant environments, Linux containers managed by Docker or Kubernetes have a lower resource footprint, faster startup times, and higher I/O performance com- pared to virtual machines (VMs) on hypervisors. Yet their weaker isolation guarantees, enforced through soft- ware kernel mechanisms, make it easier for attackers to compromise the confidentiality and integrity of applica- tion data within containers. We describe SCONE, a secure container mechanism for Docker that uses the SGX trusted execution support of Intel CPUs to protect container processes from out- side attacks. The design of SCONE leads to (i) a small trusted computing base (TCB) and (ii) a low performance overhead: SCONE offers a secure C standard library in- terface that transparently encrypts/decrypts I/O data; to reduce the performance impact of thread synchronization and system calls within SGX enclaves, SCONE supports user-level threading and asynchronous system calls. Our evaluation shows that it protects unmodified applications with SGX, achieving 0.6✓–1.2✓ of native throughput.
Issue Date: 2-Nov-2016
Date of Acceptance: 5-Oct-2016
URI: http://hdl.handle.net/10044/1/42263
ISBN: 9781931971331
Publisher: USENIX
Start Page: 689
End Page: 703
Journal / Book Title: 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI), 2016
Copyright Statement: This paper is embargoed until publication.
Sponsor/Funder: Commission of the European Communities
Funder's Grant Number: 645011
Conference Name: 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI), 2016
Publication Status: Published online
Start Date: 2016-11-02
Finish Date: 2016-11-04
Conference Place: Savannah, GA, USA
Online Publication Date: 2016-11-02
Appears in Collections:Computing
Faculty of Engineering