Docker platform dynamic protection method based on trusted computing

Abstract

The invention discloses a Docker platform dynamic protection method based on trusted computing, and the method comprises the steps: firstly carrying out the initialization of a system, and completingthe initialization of a vPCR module and a measurement agent module; secondly, enabling a user to request a Docker platform to generate a container, and generating a vPCR instance corresponding to thecontainer in the container generation process; thirdly, enabling the user to request the platform to verify the dynamic integrity of the specific container through a remote verification module in theverification system; furthermore, enabling a measurement agent module in the target system to execute a measurement process according to the request, expand and store a measurement value into a security module consisting of the vPCR module and the TPM, and record a corresponding measurement log; then, enabling the target system to return integrity evidences to the verification system; and finally,enabling the verification system to judge the integrity state of the target system according to the integrity evidence of the target system. According to the method, the measurement process is executed while an original process execution result is not affected, and it is guaranteed that the dynamic integrity of the container is not damaged.

Description

technical field [0001] The invention relates to a dynamic protection method for a Docker platform based on trusted computing, and belongs to the field of dynamic integrity verification of trusted computing. Background technique [0002] With the continuous development and wide application of cloud computing technology, virtualization technology has become more and more important. Compared with traditional virtualization technology, container-based virtualization technology is more lightweight and flexible, and has less impact on system performance, so it is favored by more and more users and manufacturers. Docker technology is a kind of container technology, which currently occupies a dominant position in the container market and has become the de facto standard of container technology. Therefore, the security protection of the Docker platform has important research significance and practical value. In the Docker platform, the low isolation of containers and the constructio...

AI Technical Summary

Problems solved by technology

[0006] In a container-based virtualization environment, traditional trusted computing implementation methods are either complex and cause unnecessary performance loss, or cannot store the metrics of each container in isolation to provide confidentiality

In addition, traditional trusted computing implementation methods only focus on the static integrity of the platform, and cannot guarantee the dynamic integrity of services running on the platform.

Therefore, the existing trusted computing implementation methods are difficult to be directly applied to container-based virtualization environments.

Images