Trusted Container Execution Across REE and TEE Boundaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Containers in computing devices share a common operating system kernel, making them vulnerable to attacks that compromise the security and integrity of user data once the kernel is cracked.
Innovation Solution
Implementing a hardware security feature like TrustZone to divide the computing device into a rich execution environment (REE) and a trusted execution environment (TEE), where containers are run on the TEE side, protected by hardware security features, preventing access from the REE side, even if the OS kernel is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If containers share a common operating system kernel to achieve lightweight virtualization and fast startup, then productivity and ease of operation are improved, but security and reliability deteriorate because the entire system becomes vulnerable once the kernel is compromised
Solution Approach 1:
The patent segments the operating system into two distinct kernels: a host OS kernel for general system operations and a guest OS kernel specifically for container operations. This segmentation isolates container security from the host kernel, so that compromising the host kernel does not automatically compromise container security. The container namespace and cgroup mechanisms operate within this segmented architecture, maintaining lightweight virtualization while improving security posture.
2Adaptability or versatility
If the host operating system kernel is cracked, then attackers can control all containers running on it, but this creates a security vulnerability that affects the entire system
Solution Approach 1:
The patent introduces a guest OS kernel as an intermediary layer between the host OS and containers. This intermediary maintains the ability to support multiple containers system-wide while reducing the attack surface by preventing direct access from the host kernel to container resources. The guest kernel acts as a mediator that handles container management operations securely, isolating the containers from direct host kernel exposure.
3Device complexity
If containers run as processes on the host operating system, then resource allocation is simplified, but isolation between containers is damaged when the kernel is compromised
Solution Approach 1:
The patent segments the execution environment by introducing a guest OS kernel that provides a separate process execution context for containers. This segmentation maintains simplified resource allocation through the guest kernel while improving container isolation, as containers running under the guest kernel are protected from host kernel compromises. The namespace and cgroup mechanisms continue to function for resource management within this segmented architecture.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
This application provides a data processing method and apparatus, and a computer-readable storage medium, which may be applied to a computing device. A hardware resource of the computing device is divided into an REE side and a TEE side. The TEE side includes one or more containers. The method includes the following steps: A processor of the computing device obtains to-be-processed data on the REE side; and then runs a first container on the TEE side to process the to-be-processed data, where the first container is any one of the one or more containers included on the TEE side. According to the method, a risk of a container being attacked by an attacker can be reduced, and security of the container is improved, to improve security of user data in the container.