Abhishek Gupta, Architect, Intel Data Center Group
As enterprises extend their offering in premise private cloud and public cloud, one of the biggest challenges they face is the loss of control and lack of trust. Recent security breaches have left cloud users worried about the privacy and security of their applications and data. How can enterprises trust the cloud platforms where their workloads are running and how can they be sure that the applications running in the cloud are indeed the ones they wanted to run. Is there any way to know if sensitive workloads are placed on a machine which may contain malware? Is there any way to know that the application itself did not get infected?
To solve the above challenges and drive the enterprise movement to clouds, technologies like hardware-rooted Trusted Boot and Trusted Pools – both supported through Intel Trusted Execution Technology – have emerged into the mainstream to give cloud users the assurance that virtual machines (VMs) and workloads are launching on servers that have demonstrated boot time integrity.
Recently, Linux containers are emerging as a promising complement to VMs in data centers since they are fast, lightweight, and low-overhead, both at runtime and during launch. Some recent efforts by companies like Docker and Rocket are enabling mass enterprise movement to containers by providing the ability to package any application with all its dependencies, storing the containerized application images to private/public repositories, and using a layered or union file system to easily launch containers from existing images and incrementally create and store new images.
However, for LXC/Docker containers, security continues to be a bottleneck, with a number of unanswered questions. Can the container platform (including the management engine e.g. Docker daemon) be trusted? Can containerized application images be trusted? Can there be a single control plan which can be used to manage and deploy both VMs and containers? Recently, Intel has been working to address the above problems by extending the proved hardware rooted trust primitives from VMs to containers. Furthermore, through plugins to Docker and OpenStack Nova scheduler, Intel has demonstrated trusted and transparent deployment of VMs and containers from the same OpenStack cloud controller.
At the upcoming OpenStack Summit in Tokyo, Intel architects will give the community a preview of this technology, called Intel® Cloud Integrity Technology 3.0, and discuss how Intel is: * Extending the trusted boot and trusted compute pools (as was done for VMs) to Docker containers, so that the boot integrity of the Docker platform can be asserted,
Adding support for container image confidentiality and integrity protection, and
Supporting extensions to the OpenStack Scheduler for trusted pools for Docker containers so VMs or containers can be launched transparently on trusted pools, similar to what was done to support placement and migration of VMs onto trusted servers