Jessie Frazelle on SCONE: Secure Linux Containers with Intel SGX

New York - October 9, 2017

Description

Containers are the latest infrastructure trend. In 2016, the SCONE paper was written and presented at the USENIX Symposium on Operating Systems Design and Implementation. It outlined how to use Intel Secure Enclaves to guard containers against attack. Containers are built on the kernel primitives cgroups and namespaces with additional LSM (Linux Security Module) layers on top, such as AppArmor, SELinux, and seccomp. Intel SGX protects code from modification by using protected areas of memory known as enclaves. With containers and adoption of cloud on the rise, this paper continues to be on the cutting edge of what is to come. Some cloud providers are now starting to expose hardware specific features like GPU and SGX, which would make running containers with Intel's SGX trusted execution a reality in the cloud. With Intel's SGX, you can have a container's process shielded from access by other programs. We'll explore how realistic this is today and in the future as well as what benefits this would have to the security of containers.

Bio

Jessie Frazelle works with Linux and Containers at Microsoft. She loves all things involving Linux namespaces and cgroups and is probably most well known for running desktop applications in containers. Jessie has been a maintainer of Docker and a contributor to RunC, Kubernetes, Linux, and Golang, among other projects, maintained the AppArmor, Seccomp, and SELinux bits in Docker, and is quite familiar with locking down containers.

Audio

Slides

TwoSigma The New York Chapter would like to thank TwoSigma for helping to make this meetup possible.