A Docker-based trusted container security hardening method

Abstract

The invention discloses a security reinforcement method for a credible container based on Docker used for performing security reinforcement on a Docker container system, and realizes the credible container based on the Docker, as well is applied to a server cluster based on the Docker. The credible container based on the Docker comprises a container program Docker, a container credible measurement module, a progress monitoring module and a network communication monitoring module, wherein the container credible measurement module comprises a credible booting sub-module and a file measurement sub-module. The reinforcement method focuses on the credibility of the Docker container; a credible computing and integrity measurement technology is matched with a real-time monitoring module to reinforce the container system based on the Docker, so that the container and a mirror image are prevented from tampering; and meanwhile, a network communication behavior of the container is limited, and an inner progress of the container is monitored, so as to realize the security reinforced credible container.

Description

technical field [0001] The invention belongs to the technical field of the Internet, and in particular relates to a Docker-based trusted container security reinforcement method. Background technique [0002] As the most popular lightweight virtualization technology nowadays, Docker is bringing a disruptive technological revolution to the industry. As the application scale of Docker technology becomes larger and wider, the security problems exposed by it are also It seems to be becoming more and more serious, such as imperfect isolation mechanism, excessive concentration of privileges, chaotic sharing mechanism, etc. These security risks have become key factors hindering the development of Docker. From the various security issues that have been discovered in Docker, it can be seen that both Docker images and containers have the risk of being tampered with. At the same time, incomplete isolation allows unauthorized communication between containers. The Docker system and even ...

AI Technical Summary

Problems solved by technology

[0006] (3) In 2014, Daniel Walsh and others proposed to use the access control system to strengthen Docker security. Taking the SElinux system developed by RedHat as an example, the system puts a unique label on each container when it is created. In other words, all operations between hosts and objects with different labels are prohibited, which greatly improves the isolation of Docker containers, but this method still does not care about Docker Security inside containers, Docker containers and images still face the possibility of tampering

Images