Secure Docker Hardware Access via Segmented Device Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge is to ensure isolation of hardware resources on a physical device while allowing multiple secure dockers to share and use these resources, without affecting each other's access.
Innovation Solution
A device access method and system are implemented, where a first communication module and a first device node are created within the secure docker, and a second communication module and a second device node are created in the server. Access operation information from an application program in the secure docker is transferred through these modules and nodes, allowing the secure docker to access hardware resources while maintaining isolation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If secure dockers share hardware resources of a physical device, then resource utilization is improved, but hardware access isolation between different secure dockers deteriorates
Solution Approach 1:
The patent segments hardware resources by creating separate device nodes for different secure dockers. Each secure docker is assigned its own device node (e.g., /dev/vga0 for docker1, /dev/vga1 for docker2), which divides the shared physical hardware into isolated access paths. This segmentation enables multiple dockers to utilize the same physical device simultaneously while maintaining access isolation through distinct device node interfaces.
2Reliability
If secure dockers are isolated from the host machine, then security is improved, but hardware resource access capability deteriorates
Solution Approach 1:
The patent introduces device nodes as intermediary interfaces between secure dockers and physical hardware. The device node acts as a mediator that enables isolated secure dockers to access hardware resources without breaking security boundaries. For example, the v4l2 device driver creates device nodes that mediate between the isolated docker environment and the physical video hardware, allowing controlled access while maintaining isolation.
Solution Approach 2:
The patent creates virtual copies of hardware interfaces in the form of device nodes within the isolated docker environment. Instead of direct hardware access, each secure docker receives a copied interface (device node) that replicates the hardware's functionality at the software level. This copying approach enables hardware access capability within isolation boundaries, as the device node provides a software-based representation of the physical device.
3Reliability
If device nodes are created for each secure docker, then hardware access isolation is improved, but system complexity deteriorates
Solution Approach 1:
The patent implements self-service mechanisms where the v4l2 device driver automatically creates and manages device nodes for secure dockers without requiring manual intervention. The system self-configures the device nodes (e.g., /dev/vga0, /dev/vga1) and assigns them to corresponding dockers based on predefined rules or automatic detection. This self-service approach reduces operational complexity while maintaining the isolation benefits of multiple device nodes.
Data Source
AI summary
The present disclosure relates to a device access method and system for a secure docker. The method includes: creating a first communication module within the secure docker; creating a second communication module for communication with the first communication module in a server where the secure docker is located; creating a second device node corresponding to the secure docker in the server, and allocating at least part of hardware resources of a physical device to the second device node; creating a first device node corresponding to the at least part of the hardware resources within the secure docker; and transferring access operation information of an application program in the secure docker for the first device node to the second device node through the first communication module and the second communication module.