TEE Container Processing to Isolate Kernel Crack Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Containers in computing devices share a common operating system kernel, making them vulnerable to attacks that compromise the security and user data integrity when the kernel is cracked.
Innovation Solution
Implementing a hardware security feature called TrustZone to divide the computing device into a Rich Execution Environment (REE) and a Trusted Execution Environment (TEE), where containers are run on the TEE side, isolated from the REE, and using encryption and decryption keys stored on the TEE to protect data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If containers share a common operating system kernel to enable resource sharing and compatibility, then system resource utilization is improved, but security is worsened because kernel cracks compromise all container isolation
Solution Approach 1:
The patent segments the computing device into two distinct execution environments: a Rich Execution Environment (REE) for general operations and a Trusted Execution Environment (TEE) for secure container execution. This segmentation isolates containers from the host kernel, so that even if the REE kernel is compromised, the TEE containers remain protected and isolated.
2Device complexity
If containers are run as processes on the host operating system to enable lightweight operation, then system simplicity is improved, but security is worsened because the container relies on host kernel trust
Solution Approach 1:
The patent introduces a Trusted Execution Environment (TEE) as an intermediary layer between the host operating system and the containers. The TEE acts as a secure enclave that isolates container processes from the host kernel, providing a trust boundary that prevents kernel cracks from compromising container security while maintaining the lightweight process-based container operation.
3Ease of operation
If the host operating system kernel is used to manage all containers to simplify resource allocation, then management simplicity is improved, but security is worsened because the kernel becomes a single point of failure
Solution Approach 1:
The patent segments the management function by moving critical security management to a separate Trusted Execution Environment (TEE). The TEE manages container security isolation independently from the host kernel, allowing the kernel to remain simple for resource allocation while the TEE handles security isolation, eliminating the single point of failure.
Data Source
AI summary
This disclosure provides a data processing method and apparatus, and a computer-readable storage medium, which may be applied to a computing device. A hardware resource of the computing device is divided into an REE side and a TEE side. The TEE side includes one or more containers. The method includes the following steps: A processor of the computing device obtains to-be-processed data on the REE side; and then runs a first container on the TEE side to process the to-be-processed data, where the first container is any one of the one or more containers included on the TEE side. According to the method, a risk of a container being attacked by an attacker can be reduced, and security of the container is improved, to improve security of user data in the container.