Container Data Credential Encryption via Trusted Execution Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Open-source container systems lack effective security measures for protecting sensitive data, as workload images can be accessed directly by containers without security checkpoints, and data is not adequately encrypted, deterring users from storing data on worker hosts.
Innovation Solution
A system that generates a key pair, encrypts data credentials with a public key, and stores the encrypted secret in a cluster, deploying workloads on a trusted execution environment where the data can be decrypted using a private key, ensuring secure storage and access within a pod trusted execution environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data credentials are stored in plain text in the cluster, then ease of access is improved, but data security deteriorates
Solution Approach 1:
The system performs preliminary encryption of data credentials using public key cryptography before storing them in the cluster. The private key is securely stored in the trusted execution environment (TEE) in advance, enabling secure decryption when needed. This preliminary security measure allows data to be accessed efficiently while maintaining security throughout storage and retrieval operations.
2Object-affected harmful factors
If data is encrypted for security, then data security is improved, but access complexity increases
Solution Approach 1:
The trusted execution environment (TEE) acts as an intermediary between the encrypted data credentials stored in the cluster and the applications needing access. The TEE securely holds the private key and performs decryption operations within its protected boundary, shielding applications from the complexity of cryptographic operations while maintaining security. This intermediary approach simplifies the access interface for applications while preserving strong security guarantees.
3Productivity
If workloads can directly access container images on worker hosts, then productivity is improved, but security deteriorates
Solution Approach 1:
The system segments the access control mechanism by introducing a TEE-based security layer that separates authentication and decryption functions from the main workload execution path. Container images are pulled and stored in the TEE, which then provides controlled access to workloads. This segmentation enables fast workload execution while preventing unauthorized access to container images, as the TEE enforces security policies independently from the workload runtime.
Data Source
AI summary
A system may include a memory and a processor in communication with the memory. The processor may be configured to perform operations that include generating a key pair and encrypting a data credential with a public key to make a data credential secret. The operations may further include storing the data credential secret in a cluster on a host and deploying a workload on the cluster. The operations may also include establishing an empty bundle in the host and generating a pod trusted execution environment.